Critical PHP2Shell Flaws (CVE-2026-109618) Trigger Emergency Patches: Is Your Website at Risk?

A high-severity remote code execution flaw dubbed PHP2Shell is putting millions of servers and content management systems worldwide on high alert.

The vulnerability chain tracked primarily under CVE-2026-109618 alongside CVE-2026-109619—carries a critical CVSS v4.0 rating of 9.2.

It allows unauthenticated threat actors to crash web engines or execute unauthorized remote commands directly on affected web hosts.

With automated scanners actively probing web properties and reports of attacks surfacing across global telemetry, webmasters and DevOps teams must check their server configurations immediately.

What is the PHP2Shell Vulnerability?

PHP powers over 75% of the web’s backend infrastructure, running everything from WordPress blogs to enterprise-grade platforms.

The primary flaw, CVE-2026-109618, stems from an internal Out-Of-Memory (OOM) handling error within PHP’s core. When an oversized or maliciously crafted payload triggers an allocation failure, PHP is abruptly interrupted while request data is only partially built.

During the subsequent shutdown routine, the engine erroneously processes uninitialized memory as valid, handing attackers a clean pathway to exploit the server process.

Clone Dual Apps Without Parallel Space: This Hidden Android Feature Makes It Easy!

The companion issue, CVE-2026-109619, involves a use-after-free scenario where request-owned internal state survives in memory and leaks into subsequent web requests handled by the same worker thread.

According to technical analysis shared in the Google Cloud Security Advisory, these issues affect nearly every standard server deployment model, including Apache mod_php, PHP-FPM, LiteSpeed, and containerized runtime clusters.

Vulnerability Overview: Scope and Patches

Metric	Official Assessment Details
Tracking IDs	CVE-2026-109618 & CVE-2026-109619
Severity Score	CVSS v4.0: 9.2 (Critical)
Attack Vector	Remote, Pre-Authentication (No login credentials required)
Vulnerable Versions	All PHP iterations from version 5.4 up through 8.5.11
Official Patched Releases	PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35
Unpatched / End-of-Life	PHP 8.1, 8.0, 7.x, and older receive no direct official release

Security researchers at Qualys Threat Research and watchTowr Intelligence confirmed that automated exploitation attempts have already been observed in the wild, targeting misconfigured web hosts.

Are Websites Going Down?

Yes, several service disruptions and anomalous crashes have been observed across shared hosts and unpatched virtual machines.

When attackers send complex multipart payloads designed to exhaust memory limits, the PHP daemon can enter a loop of abrupt segmentation faults and worker restarts.

For sites without load-balancing or auto-scaling clusters, this attack knocks database connections offline and produces persistent 502 Bad Gateway or 503 Service Unavailable errors.

How to Reduce Battery Drain After an Android or iOS Update (2026)

How to Protect and Patch Your Website Immediately

Because configuration tweaks alone cannot completely seal the flaw, system administrators must apply official updates. Follow these four steps to secure your stack:

1. Check Your Active PHP Version:Log in to your hosting panel (cPanel, Plesk, RunCloud) or run php -v via SSH. If you are running an affected branch, deploy the relevant patch:
   • PHP 8.5: Update to 8.5.12
   • PHP 8.4: Update to 8.4.27
   • PHP 8.3: Update to 8.3.36
   • PHP 8.2: Update to 8.2.35
2. Handle Legacy Runtimes (PHP 8.1 or Lower):If your server still relies on older legacy versions like PHP 7.4 or 8.0, the core PHP group will not be issuing an upstream patch. You must either upgrade your application stack immediately to PHP 8.2+ or utilize hardened vendor-backported OS packages (such as Ubuntu ESM or CloudLinux).
3. Restart Web Workers:Applying the update package does not protect active processes. Always restart PHP-FPM and your web server daemon (systemctl restart php-fpm && systemctl restart nginx or apache2) so memory handles are flushed.
4. Deploy WAF Inspection Rules:Enforce request body inspection on your Web Application Firewall (Cloudflare, AWS WAF, or Google Cloud Armor). Restricting oversized or irregular multipart/form-data uploads mitigates the primary trigger vectors until your underlying servers are completely updated.