Critical PHP Vulnerabilities (PHP2Shell)

The current alert covers two critical vulnerabilities (dubbed “PHP2Shell”) that allow
unauthenticated Remote Code Execution (RCE) against servers running PHP:

• CVE-2026-109618 (CVSS 9.2): Memory corruption caused during out-of-memory (OOM) handling. When PHP aborts a request exceeding memory_limit (often triggered via multipart file uploads), it interrupts execution while request data structures are only partially initialized. The cleanup routine then attempts to free memory containing uninitialized or attacker-controlled data.

• CVE-2026-109619 (CVSS 9.2): Stale global worker state. When a fatal error occurs,residual state can survive after its backing memory has been freed. A subsequent request handled by the same worker process can access this stale state before reinitialization takes place.

Because both flaws reside within the PHP core runtime, an unauthenticated attacker can
trigger code execution before any application-level code (such as WordPress, Laravel, or
custom scripts) even runs. Every setup serving web requests (PHP-FPM, Apache
FrankenPHP, LiteSpeed) is vulnerable, with mod_php carrying the highest risk.

What websites are affected?

Any website or web application running on an unpatched PHP runtime is fundamentally affected. Because these flaws reside inside the PHP core request lifecycle rather than in application-level logic, an attacker can trigger them before web applications even start executing custom code.

1. By Application & CMS Type

Because the exploit payload executes during low-level HTTP parsing (such as multipart form-data handling), application code does not protect the host:

• Content Management Systems (CMS): WordPress, Drupal, Joomla, and Typo3. WordPress alone powers over 40% of the web, making standard blog, corporate, and e-commerce setups prime targets for mass automated scanning.

• E-Commerce Platforms: WooCommerce, Magento/Adobe Commerce, and PrestaShop, where unauthenticated RCE can expose customer databases, order history, and payment gateway configs.

• Modern PHP Frameworks: Laravel, Symfony, CodeIgniter, and Yii applications. Even if all routing, CSRF protection, and middleware are configured securely, incoming requests hit the vulnerable core engine first.

2. By Server Architecture & SAPI

The web server’s PHP execution model directly dictates the severity and boundary of an exploit:

• Apache with mod_php (Highest Risk): In embedded modules, PHP runs directly inside the Apache web server process. Memory corruption here easily compromises the entire web worker process space and anything sharing it.

• PHP-FPM (FastCGI Process Manager): The standard deployment with Nginx or Apache proxy_fcgi. Exploitation compromises the php-fpm pool worker (typically running as www-data or nginx), allowing access to all files, database credentials, and internal sockets that user can read.

• High-Performance Runtimes (FrankenPHP, LiteSpeed, Swoole): Runtimes that maintain worker state across requests to maximize speed are susceptible to both OOM heap corruption and cross-request state pollution.

• Bespoke / Legacy Applications: Custom-coded PHP sites and older intranet tools, particularly those still running end-of-life versions (PHP 7.x through 8.1) without backported patches.

3. Attack Surface Multipliers

Websites with the following characteristics face the highest immediate risk of active exploitation:

• Publicly Exposed File Upload Endpoints: Any public contact form, support ticket portal, avatar uploader, or guest comment area that accepts file attachments makes triggering out-of-memory (OOM) conditions trivial.

• Shared Hosting Environments: If multiple websites share an operating system user or run within unsegmented FPM pools, compromising a single worker via stale global state can lead to cross-site data access.

• Sites Behind Unfiltered Proxies: Reverse proxies or load balancers that pass through unlimited request body sizes (post_max_size large or unbounded) without inspection allow exploit buffers to reach the backend worker intact.

What is NOT Affected?

• Static Sites: Pure HTML, CSS, JavaScript sites (e.g., hosted on GitHub Pages, Cloudflare Pages, S3).

• Non-PHP Stacks: Backends entirely powered by Node.js, Python, Go, Ruby, or .NET (unless they use PHP microservices for specific legacy endpoints).

• PHP CLI / Offline Cron Jobs: Standalone command-line scripts that do not parse external HTTP multipart requests or maintain long-lived pooled workers are generally insulated from unauthenticated remote triggers.

Remediation: Versions Upgrade Requirements

The PHP development team released emergency patches across all actively maintained
branches. Update your PHP runtime to at least the following versions:

Implementation Checklist

1. Rebuild Containers & Packages: Run system package updates (apt-get , equivalent) or pull updated container base images.
2. Restart Web Workers: Restart php-fpm , Apache, or any container instances so the running worker processes unload the vulnerable libraries.
3. Temporary Mitigation (if patching is delayed):
1. Set session.upload_progress.enabled = Off in your PHPue
2. Filter or block unneeded reverse proxy / WAF, or restrict vectors.php.ini .multipart/form-data POST requests at yourpost_max_size to limit OOM exploitation