PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws
The NSA advises taking unpatched PHP servers offline immediately as emergency updates address two critical remote code execution vulnerabilities.
Key points
- PHP released emergency patches on October 21 for CVE-2026-109618 and CVE-2026-109619.
- The NSA and CERT-EU urge organizations to take affected systems offline if patching is not immediate.
- Approximately 48.5% of PHP sites run on end-of-life versions that no longer receive security updates.
The PHP project released emergency security updates on October 21 to address two critical remote code execution flaws collectively branded as PHP2Shell. These vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute arbitrary code on web servers without authentication. The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Both flaws carry a CVSS v4.0 score of 9.2, classifying them as high-severity issues. The NSA has recommended taking affected systems offline until they are fully mitigated. CERT-EU added that organizations unable to patch should consider isolating their applications from public networks. These advisories highlight the immediate risk posed to internet-facing applications.
View the original post on X
View the original post on X
Attack Landscape and Vulnerability Details
Cloudflare reported observing active attack traffic targeting these vulnerabilities, noting that adversaries are modifying payloads to evade detection. Security researcher Andrew Case warned that the severity of the situation is difficult to overstate. The flaws stem from memory safety errors within the PHP engine. CVE-2026-109618 involves out-of-memory errors that interrupt work before data initialization completes, leading the engine to treat unfinished data as valid during cleanup.
CVE-2026-109619 occurs when internal state persists after the memory it references has been freed. A subsequent request handled by the same worker process can exploit these stale references. Researchers identified affected code paths dating back to PHP 5.4. The highest risk environment is Apache with mod_php, where an unauthenticated request can trigger the attack before any application code executes.
Who Is Affected by PHP2Shell
PHP powers approximately 69.3% of websites with identifiable server-side languages, according to W3Techs data from October 21. Major platforms like WordPress, Drupal, Joomla, and MediaWiki rely on the language. A significant portion of these installations runs on unsupported software. PHP 7 accounts for 27% of sites, PHP 5 for 7.7%, and PHP 4 for 0.1%.
Even among sites running PHP 8, many use end-of-life subversions. Approximately 15.2% use PHP 8.1 and 5.8% use PHP 8.0. Combining these figures suggests that nearly 48.5% of PHP websites operate on branches that no longer receive routine security updates from the upstream project. While some Linux distributions provide backports, many installations remain exposed.
What should you do?
Administrators must verify their PHP versions immediately. Those running unsupported branches face significant risk as no official patches exist for those versions. For supported versions, apply the latest updates without delay. If patching is not immediately possible, follow agency guidance to take systems offline or isolate them from the internet. Monitor logs for suspicious activity indicative of exploitation attempts.
What to do and how to stay safe: PHP
- Verify the PHP version on all servers and compare it against the list of patched releases.
- Take unpatched, internet-facing PHP applications offline if immediate patching is not feasible.
- Isolate affected systems from public networks to limit exposure while mitigation is prepared.
- Monitor server logs for unusual traffic patterns or payload modifications that may indicate exploitation.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions include the patches for CVE-2026-109618 and CVE-2026-109619?
The patches are included in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Do I need to patch if I am using PHP-FPM instead of mod_php?
Yes, researchers confirmed a code-execution path for PHP-FPM involving operations during application execution.
How many websites are running on unsupported PHP versions?
Approximately 48.5% of PHP websites run on branches that no longer receive routine security updates.
