PHP Releases Emergency PHP2Shell RCE Fixes as Attack Attempts Prompt Website Shutdowns

PHP released emergency updates for CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, after premature disclosure accelerated coordinated publication. Both vulnerabilities carry CVSS v4.0 scores of 9.2 and can enable unauthenticated remote code execution with PHP worker privileges. The first corrupts request state during out-of-memory handling; the second allows subsequent requests to access stale global state referencing freed memory. PHP demonstrated exploitation against Apache mod_php before application code executes, with PHP-FPM exploitation also demonstrated for the second flaw under application-dependent conditions. Cloudflare and other security firms reported attack traffic and exploitation attempts, but successful malicious compromises were not consistently established. European government services and other organizations temporarily took websites offline as a precaution, not necessarily because they had been breached.

Administrators should immediately update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12—or later corresponding releases or verified vendor-patched packages—and restart all affected workers and services. Inventory every web-serving runtime, including containers, hosting platforms, bundled applications, and appliance management interfaces, prioritizing internet-facing deployments and Apache mod_php. WordPress, plugin, and theme updates do not repair the underlying PHP flaws. Unsupported installations require migration or validated backports; the Dutch NCSC confirmed that minimal source patches were also provided for PHP 7.4, 8.0, and 8.1. WAF protections and configuration changes, including disabling upload-progress tracking, reduce only particular attack paths and do not replace updating. Isolate exposed systems that cannot be promptly remediated, verify that patched binaries are actually serving requests, and retrospectively investigate suspicious PHP child processes, worker crashes, webshells, and potential credential exposure.