PHP2Shell: Critical PHP Vulnerabilities Put Web Servers at Risk of Remote Code Execution

PHP2Shell: Critical PHP Vulnerabilities Put Web Servers at Risk of Remote Code Execution

Two critical vulnerabilities in the PHP programming language, collectively known as PHP2Shell, are putting web servers worldwide at risk of remote code execution (RCE).

Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS v4.0 score of 9.2 and could allow unauthenticated attackers to execute arbitrary code on vulnerable servers.

The PHP project released security updates on October 21, 2026, urging organizations to patch immediately. DirectDefense has also observed active exploitation attempts across our honeypot network, reinforcing the importance of identifying and remediating affected systems.

For organizations running PHP, particularly in internet-facing environments, immediate action is critical.

Understanding the PHP2Shell Vulnerabilities

Unlike vulnerabilities affecting a specific web application, framework, or plugin, PHP2Shell vulnerabilities exist within the PHP runtime itself.

This distinction is important because even securely developed applications may be exposed if they rely on a vulnerable PHP runtime. Updating application code or plugins alone will not resolve the underlying issue.

The two vulnerabilities involve different memory-handling weaknesses:

1. CVE-2026-109618: An out-of-memory handling vulnerability that can corrupt internal request data during processing.
2. CVE-2026-109619: A vulnerability involving stale internal state that may persist after associated memory has been freed, potentially allowing subsequent requests to access invalid data.

Both vulnerabilities can lead to unauthenticated remote code execution. The PHP security team has identified Apache with mod_php as particularly high risk because exploitation can occur before application code executes.

Other potentially affected environments include PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, content management systems, internal and external web applications, and third-party products that incorporate PHP.

Successful exploitation could enable attackers to:

• Execute arbitrary code without authentication.
• Access sensitive information within PHP worker processes.
• Potentially extract credentials, session tokens, API keys, or certificates.
• Establish persistent access to compromised systems.
• Because PHP is widely used across websites, business applications, and third-party software, organizations should assess their entire environment rather than focusing exclusively on public-facing websites.

How to Protect Your Organization from PHP2Shell

Organizations should prioritize identifying vulnerable PHP installations, applying available security updates, and reviewing their environments for signs of exploitation.

1. Identify Affected PHP Systems

Review your asset inventory to identify all systems running PHP, including internet-facing websites, internal applications, CMS platforms such as WordPress and Drupal, load-balanced environments, and third-party appliances.

Pay particular attention to systems that may not be covered by routine vulnerability scanning or that rely on embedded PHP installations.

2. Apply Available Security Updates

The PHP project released the following patched versions on October 21, 2026:

Organizations should update affected PHP runtimes to the appropriate patched release, as documented in the official PHP changelog. After updating, restart relevant services, including Apache, PHP-FPM, and long-running PHP worker processes.

Important: Updating applications such as WordPress, Laravel, Drupal, or Magento does not automatically update the underlying PHP runtime.

For Linux distributions that maintain their own PHP packages, consult vendor security advisories and package changelogs. Some vendors backport fixes while retaining older upstream version numbers.

3. Validate Security Controls and Monitoring

In addition to patching, organizations should verify that existing security controls provide adequate visibility into potentially affected systems.

Recommended actions include:

• Confirming WAF protections are enabled and current.
• Reviewing exposure of public-facing applications and administrative interfaces.
• Ensuring web-server logging and security telemetry are operational.
• Verifying endpoint security agents are installed, healthy, and actively reporting.
• Reviewing monitoring and alerting coverage for suspicious PHP-related activity.

Security teams should also confirm that process creation logging is available on affected servers to support investigations.

4. Hunt for Indicators of Exploitation

Given the reported exploitation activity surrounding PHP2Shell, organizations should investigate potentially suspicious activity rather than relying solely on successful patch deployment.

Review relevant logs dating back to October 17, 2026, for indicators such as:

• Unusual multipart HTTP requests or malformed Content-Type headers.
• Abnormally large PHPSESSID cookies.
• Memory limit errors or excessive HTTP 500 responses.
• Unexpected PHP process crashes or restarts.
• Suspicious child-process creation originating from PHP processes.
• Requests containing the string p2sRedir.

These indicators may warrant further investigation but do not individually confirm successful exploitation.

Organizations should also prepare for continued internet-wide scanning, opportunistic exploitation attempts, and targeted attacks against exposed PHP services.

What If Immediate Patching Isn’t Possible?

For organizations unable to patch immediately, temporary configuration changes may reduce exposure to certain known exploit paths.

The PHP security team has recommended disabling session upload progress as a precaution:

session.upload_progress.enabled = Off

Additional configuration changes, including adjustments to memory limits and error backtrace behavior, may be relevant to specific exploit paths. However, these changes should only be implemented following technical review because they may affect application behavior, resource consumption, and operational stability.

Restart affected services after making configuration changes and verify that the intended settings are active.

These mitigations are not a substitute for patching. Updating to a patched PHP release remains the recommended long-term solution.

Guidance for Legacy PHP Versions

Organizations running unsupported PHP versions face additional challenges because official upstream security fixes may not be available.

For these environments, administrators should evaluate vendor-supported patches, temporary risk-reduction measures, and opportunities to restrict unnecessary exposure.

Some vendors have published patched builds for legacy PHP branches, including PHP 7.4, 8.0, and 8.1. Organizations should validate the availability and effectiveness of these updates with their respective vendors.

Where feasible, migration to a supported PHP release should be prioritized following appropriate compatibility testing.

Strengthening Threat Detection and Response

Patching addresses the underlying vulnerabilities, but organizations also need visibility into potential exploitation attempts that may have occurred before remediation.

Endpoint monitoring, web-server logging, and process creation telemetry can help security teams identify suspicious behavior and investigate possible compromise.

Organizations using CrowdStrike Falcon can leverage the CrowdStrike Falcon – Emerging Threat Response dashboard within NGSIEM to review emerging threats, suspicious process execution, and other activity that may require investigation.

Security teams should prioritize monitoring servers hosting internet-facing PHP applications and validate that endpoint agents are operational and reporting.

For organizations working with a managed security provider, coordinating asset inventories, telemetry coverage, and investigation priorities with the SOC can help ensure potentially affected systems receive appropriate monitoring.

How DirectDefense Is Responding to PHP2Shell

DirectDefense is actively monitoring threat intelligence, exploitation activity, indicators of compromise, and emerging vendor guidance related to PHP2Shell.

Our security team has observed active exploitation attempts across our honeypot network, providing additional visibility into malicious activity targeting vulnerable PHP environments.

For customers leveraging DirectDefense Vulnerability Management services, proactive notifications have been issued identifying potentially affected PHP assets where visibility is available. These findings are intended to help customers assess exposure and prioritize remediation, particularly for internet-facing and business-critical systems.

Our SOC is also working with customers to validate endpoint monitoring coverage, review available security telemetry, and investigate suspicious activity associated with potentially vulnerable systems.

Prioritize PHP2Shell Remediation Now

With active exploitation attempts already observed and the potential for unauthenticated remote code execution, organizations should prioritize PHP2Shell remediation to reduce the risk of system compromise, unauthorized access, and exposure of sensitive data.

Organizations should focus on identifying vulnerable PHP systems, applying available security updates, validating monitoring coverage, and investigating potential indicators of compromise.

Need assistance assessing your exposure to PHP2Shell?

DirectDefense can help organizations identify potentially affected systems, prioritize remediation, conduct threat hunting, investigate suspicious activity, and strengthen security monitoring.

Talk With an Expert

   By: Christopher Walcutt   10.23.26