The PHP security team felt the need to drop some emergency patches for two monumental remote code execution (RCE) vulnerabilities, known as PHP2Shell. These gems are tracked under CVE-2026-109618 and CVE-2026-109619. Apparently, they thought no one would ever notice.
Discovered by the bright minds at Calif, OpenAI, and Wiz, these flaws affect practically every PHP installation that has the audacity to serve web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. You know, just the usual suspects.
The PHP security team issued a stern warning, declaring mod_php as the biggest risk factor. It turns out that an unauthenticated request can exploit the flaw before any application code even thinks about running.
Both vulnerabilities stem from PHP’s charming habit of leaving its memory in a questionable state after a request crashes and burns. CVE-2026-109618 lets attackers gain remote code execution as the web worker account by abusing a chain of weaknesses. Meanwhile, CVE-2026-109619 facilitates unauthenticated heap use-after-free, memory disclosure, and remote code execution with the web worker's privileges.
Admins are advised to install PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 before the next apocalypse hits. Those clinging to PHP 7 or earlier should probably think about migrating to something more secure.
PHP devs made it clear that PHP 8.1 and older are off the updates list. Some distributions claim to provide backported fixes, but checking with your vendor is a good way to avoid blind faith.
In case anyone was wondering, the PHP security team had the foresight to provide minimal source-backports for older versions. This is a soothing gesture for those still living in the past and building from source.
Just last week, the PHP developers warned admins to prepare for this patch party. They even hinted they reserved the right to release patches early if details of the vulnerabilities somehow leaked or if they found evidence of attacks in the wild. How generous.
Cloudflare's CTO already confirmed that attacks targeting these vulnerabilities are on the rise. They had the foresight to roll out a set of WAF rules, but hey, temporary fixes are just that—temporary.
The UK National Cyber Security Centre also chimed in, urging organizations to update ASAP or consider taking their systems offline. Clearly, everyone is on the ball about this one.
For those who can't patch immediately, PHP shared some not-so-reassuring mitigation measures that don’t actually prevent exploitation. But hey, it's better than nothing, right?
PHP is the backbone of 75% to 80% of all websites, including popular CMSs like WordPress and Joomla. The mind-boggling statistic? Over 5.1 million PHP hosts are exposed online, with 3.8 million flaunting at least one open port. A real safety net that inspires confidence.
