PHP has launched emergency updates that repair two crucial flaws within the language itself, letting an attacker with out an account run code on an internet server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and eight.2.35, and the PHP workforce says solely updating absolutely protects a server.
The failings, collectively referred to as PHP2Shell, sit within the PHP runtime, not in any utility, so a website is uncovered even when its personal code is safe. The chance is highest on servers utilizing Apache’s mod_php, the place a working exploit triggers the assault earlier than any utility code runs.
Each flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619. PHP revealed them across the scheduled launch time of 14:00 UTC on October 21, a day after particulars leaked forward of a deliberate October 22 disclosure.
Researchers at Wiz, Calif, and OpenAI discovered and reported the failings, which have an effect on almost each PHP model again to PHP 5.4.
Who Is Affected
Each PHP set up that serves internet requests is in danger, together with PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, in keeping with the PHP safety advisory.
As a result of the failings are within the engine reasonably than in any website’s code, even a easy “Hi there World” web page on a susceptible PHP model will be attacked.
The advisory singles out mod_php as the best threat, with a demonstrated exploit wherein a single unauthenticated request triggers the assault earlier than any utility code runs. PHP-FPM behaves in a different way, as a result of it shuts the employee down when a request fails early in setup.
For one of many two flaws, PHP’s personal evaluation helps that FPM is inclined however says no full FPM exploit has been proven; the second flaw was proven to achieve code execution on each mod_php and PHP-FPM, although the FPM path there will depend on an operation contained in the operating utility.
An attacker can even learn reminiscence from the PHP employee course of, which can maintain passwords, authentication tokens, API keys, and certificates belonging to different requests, with out first gaining code execution.
The researchers demonstrated this studying of reside employee reminiscence towards purposes they didn’t management, making it impartial of the appliance operating on high of PHP.
What to Set up
Replace the PHP runtime that serves internet requests, then restart Apache, PHP-FPM, and any long-running PHP staff. Updating an utility comparable to WordPress or Laravel doesn’t replace the PHP runtime beneath it; that comes from the server package deal, the host, or the container picture.
| PHP department | Susceptible | First mounted model |
|---|---|---|
| 8.5 | under 8.5.12 | 8.5.12 |
| 8.4 | under 8.4.27 | 8.4.27 |
| 8.3 | under 8.3.36 | 8.3.36 |
| 8.2 | under 8.2.35 | 8.2.35 |
PHP 8.1 and older not obtain updates from the PHP challenge, and PHP 8.2 reaches finish of life on December 31, 2026. For the older branches, the PHP safety workforce has revealed supply backports for PHP 7.4, 8.0, and 8.1 to assist folks constructing from supply or ready on a vendor.
Linux distributions and long-term-support distributors acquired the patches upfront, so a distribution package deal can carry the repair underneath an old-looking model quantity; examine the package deal changelog for the CVE, as Debian advises, not the model string.
If You Can’t Replace But
Solely updating is a whole repair. The measures under scale back publicity to particular assault paths and don’t make a server secure, in keeping with the advisory.
For CVE-2026-109618, set memory_limit=-1 so purposes can’t override it, preserve post_max_size low, and implement request-size limits on the internet server or proxy. Don’t use RLIMIT_AS or RLIMIT_DATA in its place, as a result of PHP warns they’ll set off the identical susceptible path.
For CVE-2026-109619, set session.upload_progress.enabled=0 and restart each employee, and on PHP 8.5 additionally set fatal_error_backtraces=0. Turning off session add progress blocks the confirmed session paths however not different variants, and no configuration change absolutely mitigates this flaw wanting updating.
That setting is the one circulated as a workaround earlier than the patch, and the discharge confirms it was by no means a whole repair. Session add progress is turned on by default and may attain session dealing with earlier than PHP finishes establishing a request, which is why it takes half in a single confirmed assault path for CVE-2026-109619 and why turning it off does nothing for CVE-2026-109618.
“The one factor I can say is that the one mitigation is patching/upgrading PHP. I sadly know an excessive amount of,” PHP core developer Gina Peter Banyard wrote earlier than the discharge, replying to somebody who prompt the setting is likely to be sufficient.
After updating, overview your reminiscence settings. The repair provides a brand new arduous reminiscence restrict, and reaching it ends the method and stops shutdown handlers from operating, so examine memory_limit and post_max_size towards what your utility wants.
If you happen to already patched however suspect an earlier break-in, the researchers counsel awaiting uncommon multipart requests adopted by memory-limit errors or repeated HTTP 500 responses, oddly giant PHPSESSID response cookies, and unexplained restarts of PHP staff.
Is It Being Attacked
Earlier than the patch shipped, Cloudflare stated it was seeing early makes an attempt to take advantage of the failings. “We’re seeing early assaults rising and are updating mitigations as new vectors present up,” Cloudflare CTO Dane Knecht stated, calling the firewall guidelines Cloudflare deployed a stopgap and urging directors to patch.
No supply has confirmed a profitable break-in. watchTowr, which reproduced CVE-2026-109618, reported no exploitation within the wild as of 11:26 UTC on October 21, and neither flaw was in CISA’s Recognized Exploited Vulnerabilities catalog at the moment.
Some organizations took providers offline as a precaution reasonably than in response to any break-in. BambooHR took its service offline throughout the US, Canada and Eire, warned that payroll could be interrupted, and stated it didn’t but have a restoration time.
Within the Netherlands, MijnOverheid, DigiD, the decrease home of parliament’s website, the nationwide cyber-security middle and a number of other schooling techniques went offline, the broadcaster NOS reported; the centre stated it had not seen the flaw abused however urged everybody to patch.
How It Got here Out
A leak pulled the discharge ahead. On October 20, as The Hacker Information reported, a publish on Hacker Information stated two PHP distant code execution flaws, with the 2 CVE identifiers, have been set for disclosure on October 22, on not more than a trusted tip.
PHP posted an advance discover that night and moved the discharge to October 21. The leak’s declare of a CVSS 10.0 rating was not PHP’s; PHP charges each flaws 9.2.
The failings have been discovered by Wiz Analysis, Calif, and OpenAI’s Codex Safety workforce, working with the PHP safety workforce and Google’s Gemini workforce on the repair. The underlying code had been in PHP for greater than a decade.
The researchers say AI fashions helped flip these long-standing flaws into working exploits, letting one researcher do in a couple of week what they are saying would in any other case have taken a workforce months.
Calif, which traced the bug’s lineage to PHP analysis from 2004, says understanding the goal’s historical past nonetheless mattered, and that present fashions don’t reliably begin from obscure, twenty-year-old primitives on their very own.
