PHP2Shell CVEs Force Immediate Patch for Millions of Sites

PHP2Shell CVEs Enable Unauthenticated Remote Code Execution

The PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619 on 24 October 2026. Both flaws allow an unauthenticated attacker to execute arbitrary code on a server running a vulnerable PHP version. The vulnerabilities, codenamed PHP2Shell, affect all PHP releases prior to 8.3.0 and are exploitable through crafted HTTP requests that trigger internal PHP functions.

Immediate Impact on the Web

After public disclosure, Cloudflare reported that it detected millions of exploitation attempts targeting the two CVEs. The sheer volume of scans indicates that attackers are actively probing for vulnerable hosts. Several high-traffic websites, including government portals and e-commerce platforms, took precautionary downtime to avoid potential compromise.

Technical Details of the Exploit

Both CVEs stem from improper validation of user input in PHP’s internal function handling. An attacker can send a specially crafted request that forces PHP to evaluate an arbitrary string as code. The payload can be delivered via GET, POST, or custom headers, and does not require authentication or session cookies. The vulnerability is independent of the web application layer, meaning any PHP script exposed to the internet is at risk.

Patch Availability and Deployment

The PHP Foundation released official patches on 24 October 2026. The patches are available for all supported PHP versions and can be applied by updating the PHP package through the system’s package manager or by downloading the source and recompiling. After applying the patch, administrators should verify that the vulnerable functions are no longer callable by testing with a benign payload.

Mitigation Steps for Security Teams

1. Inventory: Identify all servers running PHP versions older than 8.3.0. Use configuration management tools or scripts that query the PHP version via php -v.
2. Patch: Apply the official PHP patches immediately. For environments that cannot be updated, consider disabling the vulnerable functions (eval, assert, etc.) in php.ini or via .htaccess.
3. Monitor: Enable logging of PHP errors and monitor for suspicious execution patterns. Cloudflare and other WAFs can be configured to block requests containing known exploit signatures.
4. Validate: After patching, perform a quick test by sending a benign payload that would trigger the vulnerability if it remained. Confirm that the request fails with a 500 error or is blocked.
5. Audit: Review access logs for any anomalous activity during the window of vulnerability exposure. Look for repeated attempts to access /phpinfo.php or other diagnostic scripts.

Long-Term Recommendations

• Version Management: Adopt a policy that deprecates PHP versions older than 8.3.0 within 90 days of release. Automate updates through CI/CD pipelines.
• Runtime Hardening: Disable functions that are rarely needed and pose high risk, such as eval, assert, and system. Use disable_functions in php.ini.
• Web Application Firewall: Deploy a WAF that can detect and block known PHP2Shell payload patterns. Regularly update rule sets to include new signatures.
• Incident Response Playbook: Include PHP2Shell in the list of high-priority vulnerabilities. Define clear escalation paths and communication channels for affected teams.

Related coverage

• Microsoft Patch Tuesday 2026: 1,417 Vulnerabilities, Including Exploited Shell Bypass and Exchange RCE
• Brotli Decoder Memory Corruption Enables RCE in Node.js, Bun, Python and More

Explore more on this topic

• More php coverage