PubliéPHPsecurityCVE-2026-109618CVE-2026-109619php2shell

php2shell: two critical PHP flaws, what to do

Seagle team22 ottobre 20265 min de lecture

Summary

On 21 October 2026, the PHP project fixed two critical flaws nicknamed "php2shell". This article sets out what is established, who is affected and what to do, in order. It is written to be useful even if you manage everything yourself.

1. What happened

On 21 October 2026 (14:00 UTC) the PHP project released fixes for two remote code execution flaws:

CVE-2026-109618: memory corruption when PHP runs out of memory (OOM), triggered by multipart requests.
CVE-2026-109619: reuse of stale state between two requests handled by the same process.

Each is rated 9.2 out of 10 (CVSS v4.0). Both can be exploited without authentication, with a request sent before any of your application code runs. A successful attacker can run code on the server and read the process memory, which may include passwords, tokens or API keys.

What is observed, as of 21 October:

Palo Alto Networks (Unit 42) has seen proofs of concept for both flaws and estimates more than 22.6 million potentially vulnerable instances (estimation method not detailed).
Cloudflare observed attack traffic among its customers.
Patchstack reported only probing, with no proof of compromise; CERT-FR does not mention exploitation.
Fake exploit code is circulating on GitHub, some of it booby-trapped (JFrog).

What is not established: a large-scale outage or compromise. No source confirms it.

2. Who is affected

Any server running PHP for the web: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. The mod_php case is the most exposed.

For CVE-2026-109618, a normally started PHP-FPM is exposed.
For CVE-2026-109619, the cross-checked condition is session.upload_progress.enabled=On (the default value), without a call to session_start().

Wiz states that all versions since 5.4 are affected by at least one of the two flaws.

WordPress, PrestaShop or Laravel are not at fault: the flaw is in the PHP interpreter. Updating the site or its plugins fixes nothing; it is PHP, on the server, that must be updated.

3. What to do now

Updating PHP is the only complete measure. Fixed versions:

Branch	Fixed version
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35 (end of support 31 Dec 2026)

Branches 8.1 and earlier have no official fix. Source backports exist for 7.4, 8.0 and 8.1; otherwise, ask your vendor for a fix, migrate, or isolate the service.

By situation:

Shared hosting: PHP is managed by the host. Ask them for the date of the fix.
Server (VPS): apply your distribution's updates, then restart PHP-FPM or Apache.
Container: rebuild on an official php image at a fixed version, then redeploy. If you use an application image (Nextcloud, WordPress), check the embedded PHP.

If you cannot update right away, partial workarounds exist. They reduce the risk without removing it and are not qualified by CERT-FR:

Disable session.upload_progress.enabled in php.ini or in the FPM pool (php_admin_flag[session.upload_progress.enabled] = off), then restart all workers. ini_set() and .user.ini are not enough. This covers CVE-2026-109619 only.
On PHP 8.5, fatal_error_backtraces=0.
On FPM, pm.max_requests=1, at a performance cost.
At the web application firewall (WAF): block Content-Type: multipart requests if your application does not need them, otherwise monitor them. Cloudflare has enabled default rules since 21 October 03:02 UTC, including on the free plan; this is not a fix.

Avoid: installing an unofficial "patch" plugin, and running attack code found online.

Signs to watch for: unusual multipart requests together with memory_limit errors, oversized PHPSESSID cookies, worker restarts. If you see them, assume compromise and rotate your secrets.

4. How to check your version

Command line: php -v gives the command-line PHP version. The one used by the web (FPM, mod_php) may differ if several PHP versions are installed.
Container: docker exec <container> php -v.
WordPress: Tools > Site Health > Info > Server.
Laravel: php artisan about (CLI version).
Shared hosting: the "PHP version" section of your host's control panel, whose location varies.
phpinfo(): possible through a temporary page, to be deleted right after reading, since it exposes your configuration.

Then compare with the table above.

5. What Seagle offers

Seagle is a French software publisher. If you would rather not handle this alone, we offer an express diagnosis and update: checking the version in place, moving to a fixed version, an immediate workaround if needed, then a short report. We never probe a site or server without written request from its owner. To discuss it, write to us through the site's contact page.

Sources

Accessed 21 October 2026.