---
type: analysis
slug: research-php-confirms-two-critical-php2shell-rce-flaws-patch-to-8-5-12-8-4-27-8-3-36-or
title: "PHP confirms two critical PHP2Shell RCE flaws; patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now"
description: "PHP's own advisories confirm that CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and that only upgrading fully fixes them. Exploit details leaked early and attack attempts began before the patches shipped. No confirmed real-world compromise has been reported so far."
published_at: 2026-11-09T00:00:00.000Z
topics: ["memory","openai","research"]
source_urls: ["https://www.php.net/archive/2026.php","https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote","https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
PHP2Shell is the name for two memory-safety bugs in the PHP engine itself, not in any framework or application. Attackers can reach them with a crafted HTTP request, before any application code runs. The fixes were scheduled for 14:00 UTC on October 21, 2026, and PHP pre-announced that release on October 20. Exploit details leaked on October 20, and patched builds arrived on October 21. The bugs were reported by researchers credited to Calif, Wiz, OpenAI and (per Cloudflare) Quarkslab.

Builders should care because PHP still runs a large share of web backends, admin panels, CMS-backed content pipelines and webhook endpoints, including ones that sit beside AI services. A successful exploit runs code as the web worker. Researchers have also shown that worker memory can be read, which can expose API keys, tokens and passwords held by the PHP process.

## What we checked

- **Can the official PHP security advisory confirm both CVE identifiers, fixed versions, exploitability, and any evidence of active exploitation?** partly confirmed. php.net and the two php-src GitHub advisories confirm CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4 9.2 and fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's advisory confirms an unauthenticated RCE exploit against Apache mod_php, but it says nothing about attacks in the wild. That evidence comes from Cloudflare, Amazon and watchTowr, and none of them has confirmed a real compromise. [1][2][3][5][6]
- **Were the flaws added to CISA's Known Exploited Vulnerabilities (KEV) catalog?** unresolved. Tenable says neither CVE was in the catalog as of October 23. It also says CISA's October 21 alert stated CISA had not yet seen exploitation at that point. I did not check the KEV catalog directly as of October 26. [4][7]

## What we found

- PHP's October 21 advisory says the two flaws 'can allow unauthenticated remote code execution'. It says they affect every PHP install that serves web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where there is 'a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.' Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP 8.6.0 RC4 also includes the fixes. [1]
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) comes from PHP using longjmp() to abort a request when it runs out of memory, which can leave memory half set up for request shutdown to read. RCE was confirmed over HTTP against mod_php with default limits. For PHP-FPM, source analysis suggests it is vulnerable but no complete exploit has been shown. FrankenPHP and LSAPI are rated 'likely susceptible'. The fix replaces longjmp with a soft out-of-memory stop at the next safe point and a hard _exit() at a higher threshold. [2]
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is a use-after-free in global state that a long-lived worker carries from one request into the next. The strongest case is PHP 8.5's fatal_error_backtraces against mod_php. The session upload progress path, which is on by default, was validated against both mod_php and PHP-FPM. Both advisories score CVSS v4 9.2 with high attack complexity and present attack requirements (AC:H/AT:P), and both credit reporters from Wiz, OpenAI and others. [3]
- PHP says its mitigations 'do not make an installation safe.' For CVE-2026-109618: set memory_limit=-1 through admin-level settings and lower post_max_size, and avoid RLIMIT_AS and RLIMIT_DATA. For CVE-2026-109619: set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, then restart all workers. Suppressing errors with error_reporting or @ does not help. PHP 8.1 and older get no official releases, only minimal source backports for 7.4, 8.0 and 8.1. Tenable reports the vulnerable code goes back to PHP 5.4.0. [1][4]
- Cloudflare says the flaws 'leaked before the official release date' and that it saw attack traffic aimed at its customers. Its WAF rules went live by default on all plans, including Free, starting at 3:02 UTC on October 21. On October 23 it noted a related issue, CVE-2026-115560, that also affects fully patched releases such as 8.5.12. Its rule only covers sites that keep PHP's default session.upload_progress.name. [5][1]
- Per The Register, Amazon's MadPot honeypots caught an exploitation attempt on October 17, four days before the patches. Several proof-of-concept exploits followed from around 02:00 UTC on October 21, which Amazon read as multiple actors. Amazon said it is unclear whether those attempts would have worked against real systems, and advises investigating activity back to October 17. watchTowr says its honeypots saw exploitation of both CVEs on October 21. [6][7]
- Tenable reports that the PHP Foundation inspected the PoCs that appeared after the leak and 'did not identify any functional exploits at the time of release/public disclosure.' Tenable also warns that unverified exploit code may contain malware. According to Tenable, CISA's October 21 alert urged immediate patching (or taking systems offline if they cannot be patched) and said it had not seen exploitation yet. Neither CVE was in KEV as of October 23. [4]

## What it means

Treat any internet-facing PHP as exposed until it runs 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor-backported build. That includes containers, base images, sidecar admin tools and CI runners that serve HTTP. The WAF rules and php.ini changes are a stopgap to buy time, not a fix. Cloudflare's coverage already has a gap for the related CVE-2026-115560 issue. Do the cheap steps now: set session.upload_progress.enabled=0, set fatal_error_backtraces=0 on 8.5, and limit request size and multipart handling at the proxy. Then rebuild and redeploy images instead of patching running hosts, because the bug lives in persistent worker state and new config only takes effect after workers restart. Prioritize Apache mod_php and anything on PHP 8.1 or older, which gets no official release.

Because attempts were seen from October 17 and worker memory can leak, assume any secret a PHP process could read may be exposed. That includes LLM API keys, database credentials and OAuth tokens. If you can't rule out compromise, rotate those secrets and check logs back to October 17. Don't run public 'PHP2Shell' PoCs from GitHub to test your systems. PHP says the early ones weren't functional, and Tenable warns some may carry malware.

## Still open

- Has any production PHP system been confirmed compromised, as opposed to honeypot hits and blocked WAF traffic?
- Will CISA add either CVE to the KEV catalog, and has it done so since October 23?
- How did the actor Amazon saw on October 17 get exploit details before disclosure?
- When will the fix for the related CVE-2026-115560 issue ship, and how severe is it?

## Sources

1. [PHP News Archive 2026 (Oct 20 pre-announcement, Oct 21 security advisory and releases)](https://www.php.net/archive/2026.php) (primary)
2. [GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) (primary)
3. [GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) (primary)
4. [Tenable: php2shell FAQ](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)
5. [Cloudflare deploys protections against php2shell vulnerability](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/)
6. [The Register: Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure](https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749)
7. [watchTowr: PHP2Shell RCE Exploited](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/)
8. [BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Memory](https://newruntime.com/topics/memory.md): Explore the memory topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)