PHP2Shell Critical Advisory: RCE Flaws (CVE-2026-109618 & CVE-2026-109619) & Update Guide

# PHP2Shell Critical Advisory: RCE Flaws (CVE-2026-109618 & CVE-2026-109619) & Update Guide

The global cybersecurity and web development communities are on high alert following the active exploitation of PHP2Shell. This pair of critical vulnerabilities resides directly in the core PHP runtime engine, allowing unauthenticated remote attackers to trigger Remote Code Execution (RCE) and disclose sensitive server memory.

Because this vulnerability exists within the PHP interpreter itself rather than application-layer code, virtually all applications built on PHP—including WordPress, Laravel, Symfony, Drupal, Magento, and custom microservices—are vulnerable if running on unpatched PHP interpreters.

---

1. Vulnerability Breakdown: What is PHP2Shell?

PHP2Shell consists of two core memory-safety defects within the Zend Engine:

A. CVE-2026-109619: Use-After-Free in Upload Progress (CVSS 9.8 - Critical) PHP includes a core feature called `session.upload_progress` enabled by default. It tracks the progress of multipart file uploads by populating session variables. Due to improper state handling during multipart upload parsing and session lifecycle cleanup, an attacker can manipulate multipart upload requests to trigger a **Use-After-Free (UAF)** condition. This allows attackers to seize control of internal memory pointers and pivot into arbitrary shell execution.

B. CVE-2026-109618: Out-of-Memory Request Corruption (CVSS 9.2 - Critical) This flaw occurs when PHP encounters an abrupt Out-of-Memory (OOM) condition during request processing. Zend Engine fails to atomically clean up partially allocated request structures, leaving dangling pointers in memory. Subsequent cleanup cycles process invalid structures, enabling heap corruption and remote code execution.

---

2. Affected Versions & Patched Releases

The vulnerability affects all major PHP versions ranging from legacy branches up through modern release lines:

| Release Line | Status | Affected Versions | Patched / Safe Release | | :--- | :--- | :--- | :--- | | PHP 8.5 | Current | < 8.5.12 | 8.5.12 | | PHP 8.4 | Supported | < 8.4.27 | 8.4.27 | | PHP 8.3 | Supported | < 8.3.36 | 8.3.36 | | PHP 8.2 | Maintenance | < 8.2.35 | 8.2.35 | | PHP 8.1 / 7.x / 5.x | End-of-Life | All Versions | No official fix — Migrate to 8.2+ immediately |

---

3. Immediate Workaround: Disabling Upload Progress

If you cannot immediately reboot or update system binaries across all production servers, you can neutralize the primary attack vector for CVE-2026-109619 by disabling session.upload_progress:

1. Open your php.ini configuration (e.g., for PHP 8.3 FPM or CLI):

sudo nano /etc/php/8.3/fpm/php.ini
sudo nano /etc/php/8.3/cli/php.ini

2. Locate the [Session] block and set:

session.upload_progress.enabled = Off

3. Restart your PHP-FPM service and web server:

sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx # or apache2

**Note:** While this mitigation effectively blocks the CVE-2026-109619 UAF exploit vector, it does **not** protect against CVE-2026-109618. A full binary upgrade remains mandatory.

---

4. Step-by-Step Update Guide

A. Ubuntu & Debian (via Ondřej Surý PPA)

# 1. Update package lists and PPA
sudo apt install -y software-properties-common
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update

# 2. Upgrade PHP packages to the patched versions
sudo apt --only-upgrade install php8.3 php8.3-cli php8.3-fpm php8.3-common php8.3-mysql php8.3-curl php8.3-xml

# 3. Verify the installed version
php -v
# Ensure version is >= 8.3.36 (or 8.2.35 / 8.4.27 / 8.5.12)

# 4. Restart services
sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx

B. AlmaLinux, Rocky Linux & RHEL (via Remi RPM)

# 1. Check for upstream updates in Remi repo
sudo dnf check-update

# 2. Upgrade PHP packages
sudo dnf upgrade -y php php-cli php-fpm php-common

# 3. Restart PHP-FPM daemon
sudo systemctl restart php-fpm
php -v

C. Docker & Kubernetes Environments Update your application `Dockerfile` to pin patched official base images:

# Replace vulnerable base images:
# FROM php:8.3-fpm-alpine

# Pin to the verified patched release:
FROM php:8.3.36-fpm-alpine

WORKDIR /var/www/html
COPY . .

Trigger a rebuild and redeploy:

docker compose build --no-cache
docker compose up -d --force-recreate

---

5. Post-Upgrade Verification

Run the following diagnostics to confirm your server is fully secured:

# Check runtime version
php -v

# Check session upload progress status
php -i | grep -i "upload_progress"

# Confirm daemon health
systemctl status php*-fpm

Upgrading your PHP runtime protects your web applications from automated in-the-wild exploitation tools targeting PHP2Shell.