The recently disclosed vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are critical security flaws that could potentially allow attackers to execute arbitrary code remotely (Remote Code Execution, or RCE).
These vulnerabilities are related to PHP’s internal memory management and could pose serious security risks to web servers running affected PHP versions.
To address these vulnerabilities, administrators should update PHP to a patched version and review relevant PHP configuration settings to reduce potential security risks.
Overview of PHP2Shell Vulnerabilities
On October 21, 2026, two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed. Collectively known as PHP2Shell, both vulnerabilities are related to memory management issues within PHP.
Both vulnerabilities have been assigned a CVSS v4.0 score of 9.2 (Critical). If successfully exploited, they could allow an unauthenticated attacker to execute arbitrary code remotely using the privileges of the PHP process running on the affected web server.
CVE-2026-109618: Vulnerability in Out-of-Memory (OOM) Handling
CVE-2026-109618 is a vulnerability related to improper error handling when PHP encounters an out-of-memory (OOM) condition.
Normally, when PHP runs out of available memory during script execution, it terminates the operation and releases the allocated memory. However, this vulnerability may cause execution to be interrupted before certain internal data structures have been fully initialized.
During the subsequent cleanup process, PHP may incorrectly treat these uninitialized data structures as valid, potentially resulting in memory corruption.
Under certain conditions, this memory corruption could be exploited by an attacker to achieve Remote Code Execution (RCE).
CVE-2026-109619: Vulnerability in Memory Management Between Requests
CVE-2026-109619 is a vulnerability related to improper management of PHP’s internal state during request processing.
Normally, PHP releases memory allocated for a request after processing is complete and prepares the execution environment for the next request.
However, this vulnerability may allow references to previously released memory or outdated internal state to remain accessible after a request has finished.
When the same PHP worker process handles a subsequent request, it may access this stale internal state, potentially resulting in invalid memory access.
Under certain conditions, this issue could also lead to Remote Code Execution (RCE).
Differences Between the Two Vulnerabilities
Although both vulnerabilities involve PHP’s internal memory management, their underlying causes are different.
CVE-2026-109618 involves improper cleanup and error handling when an out-of-memory condition occurs.
In contrast, CVE-2026-109619 involves the reuse of stale internal state that remains after a request has been processed.
Both vulnerabilities affect PHP itself and may impact environments that process web requests using PHP-FPM, Apache’s mod_php, or other PHP execution methods.
To fully address these vulnerabilities, administrators must update PHP to a patched version.
PHP2Shell Vulnerability Mitigation Methods
To address the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the following measures should be implemented:
- Update PHP: Upgrade PHP to a patched version that fixes these vulnerabilities. This is the primary and most effective solution.
- Modify
php.iniSettings: Edit/etc/php.inior the appropriate PHP configuration file to review and adjust memory management and file upload settings. These changes serve as additional mitigation measures and do not replace the need to update PHP.
Note that the location of php.ini may vary depending on the Linux distribution and how PHP was installed.
PHP Versions Affected by PHP2Shell
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) consists of critical vulnerabilities affecting multiple versions of PHP, including PHP 8.2 through 8.5.
The PHP Group released patched versions on October 21, 2026. If you are running any of the affected versions listed below, you should update PHP as soon as possible.
| PHP Version | Affected Versions | Patched Version |
|---|---|---|
| PHP 8.5 | 8.5.0–8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0–8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0–8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0–8.2.34 | 8.2.35 |
Older PHP versions, including PHP 8.1 and earlier, may also be affected by these vulnerabilities. Since these versions are no longer officially supported, upgrading to a currently supported PHP version is strongly recommended.
Because these vulnerabilities exist within PHP itself, they may affect environments using NGINX with PHP-FPM, Apache with mod_php, and other PHP execution methods.
Administrators running PHP-based web applications, including WordPress, should verify the PHP versions installed on their servers and apply the appropriate security updates.
Note that some Linux distributions provide security fixes through backporting, which allows vulnerabilities to be patched without changing the upstream PHP version number. Therefore, administrators should check the security advisories and package information provided by their operating system or package vendor rather than relying solely on the PHP version number.
Security Configuration in php.ini
To address the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the most important step is to update PHP to a patched version. Additionally, reviewing the php.ini configuration can help reduce risks associated with memory usage and file uploads.
On systems such as Amazon Linux 2023, where the PHP configuration file is typically located at /etc/php.ini, review the following parameters.
memory_limit = 128M
post_max_size = 8M
upload_max_filesize = 3M
session.upload_progress.enabled = Off
; PHP 8.5-specific setting
fatal_error_backtraces = OffThe purpose of each parameter is explained below.
| Parameter | Description |
|---|---|
memory_limit | Defines the maximum amount of memory a PHP script can allocate. 128M is a common configuration example, but it does not directly prevent OOM-related vulnerabilities. |
post_max_size | Specifies the maximum size of data accepted through an HTTP POST request. |
upload_max_filesize | Defines the maximum size of an individual uploaded file. |
session.upload_progress.enabled | Controls whether PHP records file upload progress information in session data. Disable this feature if it is not required. |
fatal_error_backtraces | Introduced in PHP 8.5, this directive controls whether backtraces are displayed when fatal errors occur. Setting it to Off disables this functionality. |
Additional Configuration for PHP 8.5
The fatal_error_backtraces directive was introduced in PHP 8.5 and does not need to be configured in PHP 8.4 or earlier versions.
For PHP 8.5, disabling this feature has been recommended as a temporary mitigation measure related to the PHP2Shell vulnerabilities.
Additionally, the post_max_size value should be greater than the upload_max_filesize value to ensure that file uploads are processed correctly.
After modifying php.ini, restart the relevant PHP service, such as PHP-FPM, to apply the changes.
Important: These configuration changes do not provide a complete fix for PHP2Shell. Updating PHP to a patched version remains the primary security measure. If an immediate update is not possible, consult the official security advisories for mitigation guidance specific to each CVE.
The memory_limit = 128M setting shown above is a general operational configuration example, not a dedicated mitigation for PHP2Shell. It should not be confused with a security fix for the vulnerabilities.
How to Edit php.ini Using the vi Command
On Linux servers, you can use the vi command to edit PHP configuration files. On systems such as Amazon Linux 2023, where the PHP configuration file is typically located at /etc/php.ini, execute the following command:
sudo vi /etc/php.iniOnce the file is open, type /memory_limit and press Enter to search for the corresponding parameter. You can use the same method to locate other configuration parameters.
To edit a parameter, press the i key to enter insert mode, then modify the configuration values as needed.
memory_limit = 128M
post_max_size = 8M
upload_max_filesize = 3M
session.upload_progress.enabled = Off
; PHP 8.5 only
fatal_error_backtraces = OffAfter completing the changes, press the Esc key to exit insert mode. Then type :wq and press Enter to save the changes and exit vi.
Before restarting PHP-FPM, verify that its configuration is valid by executing the following command:
sudo php-fpm -tIf the configuration is valid, a message indicating that the configuration test was successful will be displayed.
You can also check the installed PHP version using the following command:
php -vTo verify the PHP configuration values, execute:
php -i | grep -E 'memory_limit|post_max_size|upload_max_filesize|session.upload_progress.enabled|fatal_error_backtraces'Note that the php -i command displays configuration information for the PHP command-line interface (CLI). PHP-FPM may use a different configuration file or additional settings.
Finally, restart PHP-FPM to apply the changes:
sudo systemctl restart php-fpmAfter restarting the service, verify that PHP-FPM is running correctly:
sudo systemctl status php-fpmIf the service status displays active (running), PHP-FPM is running successfully.
Note: The location of php.ini, the PHP-FPM executable name, and the service name may vary depending on the Linux distribution and how PHP was installed. Additionally, restarting PHP-FPM may briefly interrupt PHP request processing, so configuration changes should be performed during an appropriate maintenance window.
Conclusion
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) represents a critical security risk that could potentially allow attackers to execute arbitrary code remotely.
To protect PHP-based web applications and servers, administrators should update PHP to a patched version and review the relevant security settings in php.ini.
Although configuration changes can help mitigate certain risks, they do not replace the need for security updates. Keeping PHP and its extensions up to date is essential for maintaining a secure server environment.
Regularly checking security advisories, applying updates, and reviewing server configurations can help reduce vulnerabilities and improve the overall security of PHP-based applications, including WordPress.
References
The following official security advisories and technical documentation were referenced in preparing this article.
- The PHP Group – Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
PHP Official Security Advisory - The PHP Group – PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 Security Releases
PHP Release Announcements - Information-technology Promotion Agency (IPA) – PHP Vulnerability Mitigation (CVE-2026-109618 and CVE-2026-109619)
IPA Security Advisory - JPCERT Coordination Center (JPCERT/CC) – Security Alert for Multiple PHP Vulnerabilities
JPCERT/CC Security Alert - The PHP Group – PHP Runtime Configuration Documentation
PHP Runtime Configuration - The PHP Group – Session Upload Progress Configuration
PHP Session Upload Progress