PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x

PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x

CVE-2026-109618 and CVE-2026-109619 were disclosed on 25 October 2026. Both flaws reside in the PHP core and allow an unauthenticated attacker to execute arbitrary code on a vulnerable server. The vulnerabilities were identified by an AI-based analysis tool and named PHP2Shell.

Attack Path and Exploit Mechanism

The flaws stem from improper handling of internal PHP data structures during the parsing of user-supplied input. An attacker can craft a specially formatted request that triggers a buffer overflow in the Zend Engine. The overflow overwrites a function pointer, enabling the attacker to redirect execution to shellcode embedded in the request. No authentication or special privileges are required; the payload can be delivered via a standard HTTP request.

Exposure and Impact

PHP is used by approximately 75% of all websites. The affected releases—PHP 8.3.x and 8.2.x—are the current stable branches for many production environments. An exploitation event can lead to full server compromise, data exfiltration, or the deployment of ransomware. Early reports indicate that several high-traffic sites went offline as a precautionary measure.

Evidence of Exploitation

Within hours of the advisory, security researchers observed exploitation attempts in the wild. Traffic logs from a major hosting provider showed repeated POST requests containing malformed payloads that matched the exploit signature. The provider applied the patch immediately and reported no successful compromise.

Mitigation Steps

1. Verify PHP version – Run php -v or inspect phpinfo() output. If the version string contains 8.3. or 8.2., the system is vulnerable.
2. Apply the latest patch – Download the updated PHP package from the official PHP Project repository. The patch was released on 26 October 2026 and addresses both CVEs.
3. Restart services – After installing the new PHP binaries, restart the web server (Apache, Nginx, or PHP-FPM) to load the updated interpreter.
4. Validate the patch – Execute a simple PHP script that echoes a known string. If the script runs without error, the patch is in place.
5. Audit for compromise – Check system logs for unusual activity, such as unexpected outbound connections or file modifications.

Advisory Sources

• PHP Project: official patch release and advisory.
• CISA: national security advisory with mitigation guidance.
• CERT-EU: European coordination on vulnerability exploitation.
• NCSC: UK national guidance on PHP security.

Immediate Actions for Web Hosts

• Automated patch deployment – Configure your configuration management system to apply PHP updates automatically.
• Disable vulnerable features – If patching is delayed, consider disabling the allow_url_include directive and other risky PHP settings.
• Monitor traffic – Deploy intrusion detection rules that flag malformed requests matching the exploit pattern.

Long-Term Considerations

The rapid discovery and exploitation of PHP2Shell underscore the importance of continuous vulnerability scanning and automated patch management. Shared hosting environments should enforce strict version controls and isolate customer sites to limit lateral movement.

FAQ

What versions of PHP are affected by CVE-2026-109618 and CVE-2026-109619?

PHP 8.3.x and 8.2.x are affected; earlier versions are not impacted.

How can I verify if my server is vulnerable?

Check the PHP version with phpinfo() or php -v and compare against the affected ranges.

What is the recommended mitigation?

Apply the latest PHP patch released by the PHP Project; if unavailable, disable the vulnerable features or move to a non-affected version.

Are there any workarounds?

No reliable workarounds exist; patching is the only safe mitigation.

Related coverage

• PHP CVE-2026-109618 Trigger Widespread Site Outages
• PHP2Shell CVEs Force Immediate Patch for Millions of Sites

Explore more on this topic

• More php coverage