CriticalCVE
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
The Hacker News·Source published ·1 min read
What happened?
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own
Key details
- PHP released emergency patches for two critical RCE flaws named PHP2Shell affecting the PHP runtime itself.
- Both flaws are rated CVSS 9.2 and tracked as CVE-2026-109618 and CVE-2026-109619.
- Apache mod_php is highest risk with a demonstrated exploit triggering before any application code runs.
- Attackers can read live worker memory containing secrets like passwords and API keys without code execution.
- Only updating the PHP runtime fully protects a server; application updates do not fix the underlying runtime.
Affected
- PHP 8.1 and older no longer receive updates
Fixes and mitigations
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart Apache, PHP-FPM, and long-running workers.
- For CVE-2026-109619: set session.upload_progress.enabled=0 and restart workers; on PHP 8.5 also set fatal_error_backtraces=0.
What to look for
- Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses.
- Oddly large PHPSESSID response cookies.
- Unexplained restarts of PHP workers.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.