PHP Critical Remote Code Execution Vulnerabilities

This is an update notice from the Information Security Office regarding two critical remote code execution vulnerabilities affecting PHP, collectively referred to as PHP2Shell.

The PHP security team has now released emergency security updates, and active exploitation has been observed in the wild. System administrators and service owners should identify affected systems and apply the available patches as soon as possible.

Summary

The PHP security team has released emergency patches for two critical, unauthenticated remote code execution vulnerabilities:

• CVE-2026-109618
• CVE-2026-109619

These vulnerabilities, collectively referred to as PHP2Shell, could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable web server with the privileges of the PHP web worker.

Security researchers and vendors have reported active exploitation attempts against vulnerable systems. Organizations are being advised to patch immediately or isolate systems that cannot be updated.

Impact

Both vulnerabilities have been assigned an official CVSS v4.0 score of 9.2 by the PHP security team. Some external security researchers have assessed the vulnerabilities at CVSS 10.0 (the highest possible score).

Successful exploitation could allow a remote attacker to:

• Execute arbitrary code on the affected server
• Access or expose application data
• Compromise the PHP web worker process
• Potentially use the compromised server for additional attacks

The vulnerabilities affect PHP web environments broadly, including many systems supporting content management systems, ecommerce platforms, and custom web applications.

The PHP security team has identified mod_php as a particularly high-risk configuration because an attacker may be able to trigger the vulnerability before application code begins processing the request.

What is Vulnerable

• Affected PHP environments may include:
• PHP FPM
• Apache with mod_php
• Php-cgi
• FrankenPHP
• LiteSpeed
• CVE identifiers:
• CVE-2026-109618
• CVE-2026-109619
• Affected versions:
• PHP 5.x, 7.x, and 8.x may be affected.
• Fixed releases:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
• PHP 8.1 and earlier versions are no longer supported through normal PHP security updates. Organizations running older versions should work with their operating system or LTS vendor to determine whether patched packages are available, or migrate to a supported PHP release.

Recommendations

1. Patch immediately. Upgrade supported PHP 8.x systems to the appropriate fixed release as soon as possible.
2. Address legacy PHP systems. For systems running PHP 8.1 or earlier, check with your Linux distribution or LTS vendor for patched packages or backported fixes. Where possible, plan to migrate to a currently supported PHP release.
3. Prioritize internet facing systems. Publicly accessible PHP servers should receive the highest priority because they are directly exposed to remote exploitation attempts.
4. Isolate systems that cannot be patched. If a vulnerable system cannot be updated promptly, be prepared to restrict access, isolate it from the network, or temporarily take the service offline until the risk can be addressed.
5. Monitor for suspicious activity. Review relevant web server, PHP, authentication, and system logs for unexpected requests, processes, or other indicators of compromise.

Mitigation

The PHP development team has indicated that temporary mitigations do not fully protect against all known attack paths. Applying the security updates remains the recommended solution.

If immediate patching is not possible, the following measures may help reduce exposure.

For CVE-2026-109618:

• Set memory_limit=-1, preferably in a way applications can’t override, such as php_admin_value in the FPM pool or Apache configuration.
• Set a low post_max_size: 8M for applications that don’t require file uploads, 32M if uploads are necessary.
• Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker.

For CVE-2026-109619:

• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks only the confirmed fatal backtrace path.
• Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help.
• Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.

Suppressing PHP errors through settings such as error_reporting, display_errors, or the @ operator does not prevent exploitation.

ADDITIONAL DEFENSES

Web Application Firewall protections may help reduce exposure to known attack patterns while systems are being updated. However, WAF protections should be considered an additional layer of defense and not a replacement for patching.

ADDITIONAL INFORMATION

Active exploitation attempts targeting unpatched PHP systems have been observed following the public disclosure of vulnerability information.

Administrators should continue monitoring PHP security communications and their operating system or hosting provider for updated packages, detection guidance, and additional information.

REFERENCES

1. https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
2. https://www.php.net/archive/2026.php

If you have any questions about the vulnerability or would like some assistance patching or mitigating it, please contact security@berkeley.edu.