PHP2Shell: Critical PHP Vulnerabilities Expose Web Applications to Remote Code Execution

Threat Intelligence & Vulnerability Management

Two critical PHP vulnerabilities, collectively known as PHP2Shell, have raised significant security concerns for organizations running PHP-based websites and applications. Tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities carry a critical CVSS score of 9.2 and could allow unauthenticated attackers to execute malicious code remotely on vulnerable servers. Unlike vulnerabilities affecting individual plugins or applications, PHP2Shell impacts the underlying PHP runtime, potentially exposing platforms such as WordPress, Drupal, Joomla, Magento, and custom PHP applications. With exploitation attempts already reported, organizations should prioritize immediate patching and security monitoring.

Understanding the PHP2Shell Vulnerabilities

CVE-2026-109618: Out-of-Memory Memory Corruption

This vulnerability involves improper memory handling when PHP encounters certain out-of-memory conditions. Attackers may exploit specially crafted HTTP requests to trigger memory corruption and potentially achieve remote code execution.

Potential impact:

• Unauthorized server access and code execution
• Web application compromise
• Data theft and service disruption

CVE-2026-109619: Use-After-Free Vulnerability

This vulnerability occurs when PHP improperly retains references to previously released memory during request processing. Attackers may manipulate these conditions to execute arbitrary code within affected PHP processes.

Potential impact:

• Remote code execution
• Exposure of sensitive application data
• Compromise of application sessions and credentials
• Potential lateral movement within connected environments

Both vulnerabilities demonstrate how weaknesses in core application infrastructure can create significant enterprise-wide security exposure.

Affected PHP Versions and Security Fixes

PHP released emergency security updates on October 21, 2026.

PHP VersionFixed ReleaseActionPHP 8.58.5.12Update immediatelyPHP 8.48.4.27Update immediatelyPHP 8.38.3.36Update immediatelyPHP 8.28.2.35Update immediatelyPHP 8.1 and olderEnd of life upstreamMigrate or apply verified vendor security backports

Organizations should validate the PHP versions running across web servers, cloud workloads, containers, and hosted applications.

Important: Updating a CMS or its plugins alone does not remediate PHP2Shell. The underlying PHP runtime must be patched. Vendor-maintained distributions may provide security backports without changing the upstream version number.

Why Organizations Should Act Immediately

PHP powers a significant portion of the internet, making these vulnerabilities a potentially widespread threat.

Security researchers have reported exploitation attempts, including activity observed before public disclosure.

Successful exploitation could result in:

• Data breaches: Unauthorized access to sensitive customer and business information
• Business disruption: Compromise or downtime of critical websites and applications
• Infrastructure compromise: Attackers gaining a foothold for further network intrusion
• Compliance exposure: Potential regulatory and contractual consequences

Organizations running internet-facing PHP applications face particular urgency.

Recommended Remediation and Security Measures

Fortuna Cysec recommends the following immediate actions:

1. Identify vulnerable assets

Inventory PHP installations across websites, applications, servers, cloud environments, and containers. Prioritize internet-facing systems.

2. Apply security patches

Upgrade to the appropriate fixed PHP release or verified vendor-patched package. Rebuild affected container images and restart PHP workers to ensure updated code is running.

3. Implement temporary mitigations

Where immediate patching is not possible:

• Restrict HTTP request and upload sizes.
• Evaluate memory_limit=-1 for CVE-2026-109618, considering resource-exhaustion risks.
• Disable session.upload_progress.enabled for CVE-2026-109619.
• Disable fatal_error_backtraces on affected PHP 8.5 deployments.
• Strengthen WAF protections and request filtering.

These mitigations reduce specific exploitation paths but do not replace security patching.

4. Monitor for exploitation

Investigate unusual PHP worker crashes, suspicious HTTP requests, unexpected processes, unauthorized file changes, and abnormal outbound connections.

5. Validate remediation

Confirm patched versions are deployed, affected services have restarted, and security monitoring remains operational. Investigate any evidence of possible compromise.

How Fortuna Cysec Helps Protect Your Organization

PHP2Shell highlights the importance of continuous vulnerability visibility, proactive risk management, and rapid threat detection.

Through the Fortunox Security Operations Platform, Fortuna Cysec combines Continuous Threat Exposure Management (CTEM) and Managed Detection and Response (MDR) to help organizations:

• Identify exposures: Discover vulnerable assets and prioritize critical security risks.
• Accelerate remediation: Track vulnerabilities and coordinate risk-based remediation.
• Detect threats: Monitor suspicious activity through 24/7 managed security operations.
• Respond effectively: Investigate security incidents and coordinate containment and recovery.
• Strengthen resilience: Maintain continuous visibility into evolving threats and security posture.

Our integrated approach helps organizations move beyond reactive vulnerability management toward continuous security risk reduction.

Final Thoughts: Patch Today, Protect Continuously

PHP2Shell is a reminder that even mature, widely adopted technologies can introduce critical security risks.

Organizations should immediately identify affected PHP installations, deploy security updates, implement appropriate protective controls, and monitor for potential exploitation.

Cybersecurity is not just about identifying vulnerabilities. It is about reducing exposure before attackers exploit it.

Is Your Organization Exposed to PHP2Shell?

Fortuna Cysec can help assess your exposure, prioritize remediation, and strengthen your defenses through Fortunox CTEM and MDR services.

Contact Fortuna Cysec today to strengthen your organization's cybersecurity posture.

‍