PHP php2shell (CVE-2026-109618 / 109619): patch Monday for every web PHP stack
Quotable summary
PHP shipped emergency releases fixing CVE-2026-109618 and CVE-2026-109619 — critical flaws nicknamed php2shell that can let an unauthenticated attacker run code on servers serving web PHP. CISA urges immediate upgrades to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Cloudflare deployed default WAF rules, but vendors agree: patch is the fix; WAF is temporary cover.
What happened
On 21 October 2026, the PHP project released security builds for supported branches after a disrupted embargo:
| Item | Detail |
|---|---|
| CVEs | CVE-2026-109618 (OOM / partial-init corruption) · CVE-2026-109619 (stale global state / use-after-free) |
| Nickname | php2shell |
| Fixed versions | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| CVSS (per PHP Foundation) | 9.2 (circulating “10.0” scores were wrong) |
| Highest-risk setup (PHP project) | Apache mod_php — exploit shown before application code runs |
| Also at risk | PHP-FPM, php-cgi, FrankenPHP, LiteSpeed |
| Unsupported | PHP 8.1 and older — no upstream fix; vendor/LTS backport or upgrade |
CVE-2026-109618 hits when out-of-memory handling interrupts a request while internal data is only partly initialized; cleanup can then treat bad data as valid. CVE-2026-109619 leaves request-owned state alive after memory is freed so a later worker request can reuse it.
The PHP Foundation documented a pre-release leak of CVE IDs (without full technical detail at first), a shortened release window, and PoCs circulating after disclosure. CISA’s alert (updated 23 October 2026) still reported no observed successful exploitation in the wild at the time of its publication — treat that as a snapshot, not a guarantee.
Cloudflare says free and paid WAF customers got default protections starting 21 October 2026, 03:02 UTC, about nine hours ahead of public disclosure, and that attack traffic was observed mutating payloads. WAF remains mitigation, not a substitute for upgrading PHP.
Who is affected
- Any org running PHP that serves HTTP (CMS, APIs, admin panels, shared hosting, containers).
- Internet-facing PHP first; internal apps next if reachable from untrusted networks.
- Teams on PHP 8.1 or earlier without a vendor backport — CISA says take those systems offline until patched or upgraded.
- Sites behind Cloudflare or another WAF: still inventory and patch; do not stop at “rule deployed.”
Monday checklist
- Inventory every host, container, and PaaS runtime that executes PHP (
php -v, image tags, managed-PHP dashboards). Include appliances that bury PHP inside other products. - Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or the vendor package that backports those fixes). Prefer distro/LTS packages that received early patches.
- Restart PHP workers / FPM pools / Apache after the package lands; confirm the running binary matches the patched version.
- Unsupported branches (≤8.1): schedule an upgrade path or isolate from the internet until a backport exists.
- If you cannot patch today: isolate internet-facing PHP; keep WAF on; follow temporary settings in the PHP advisory / CERT-EU note (
memory_limit/ upload limits reduce some paths — they do not make the stack safe). Record residual risk. - Detect: watch for PHP workers spawning shells or unexpected downloads; CISA published a SIGMA rule with its Oct 23 update.
- Record versions, change ticket, and owner for the next ops standup.
Sources
| Source | Role | Link |
|---|---|---|
| PHP project advisory | Primary patch guidance | PHP.net — Oct 21 2026 security advisory |
| PHP 8.5.12 announcement | Release confirmation | PHP — 8.5.12 release |
| PHP Foundation | Context, CVSS 9.2, disclosure timeline | PHP Foundation — security release note |
| CISA alert | Federal patch urgency + partner links | CISA — critical PHP vulnerabilities |
| Cloudflare Blog | WAF mitigation timeline | Cloudflare — PHP WAF protection |
| CVE.org | CVE records | CVE-2026-109618 · CVE-2026-109619 |
Last updated: 2026-10-25 (America/Chicago). Filed under Tech News by GeekDad · Cybersecurity section. Draft only — not published or emailed.