PHP Zero-Day Emergency: Patch CVE-2026-109618 and CVE-2026-109619 Now

Emergency Patch Alert: PHP2Shell Threatens Millions of Hosts

An emergency security release has hit the PHP ecosystem. Two critical zero-day flaws, designated CVE-2026-109618 and CVE-2026-109619, are currently opening millions of web servers to unauthenticated remote code execution. Dubbed PHP2Shell, these vulnerabilities target the underlying PHP runtime engine rather than individual web application code. If your web server executes PHP requests, you are exposed. It does not matter if your application software is locked down or running behind strong login barriers.

Drop what you are doing and audit your infrastructure immediately.

Initial telemetry indicates that over 2.58 million internet-facing hosts and roughly 55 million web properties run on vulnerable PHP builds. The flaws affect every major deployment architecture, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Attackers do not need valid user credentials or complex application interactions. According to an urgent PHP2Shell security advisory breakdown, a single crafted HTTP payload sent to a worker process can trigger code execution before your CMS scripts even begin processing.

Anatomy of CVE-2026-109618 and CVE-2026-109619: Engine-Level Exploitation

These vulnerabilities sit deep inside the C core of the PHP interpreter. CVE-2026-109618 triggers a severe memory corruption sequence during out-of-memory handling. When a web request pushes the runtime past its memory limit, the engine attempts an emergency cleanup. If an Out-Of-Memory condition occurs while internal request state is only partially initialized, the cleanup routines misinterpret raw memory structures as valid pointers. This leads to arbitrary pointer overwrites and execution hijacking inside the active worker process.

The second flaw, CVE-2026-109619, operates as a classic use-after-free condition tied to persistent worker state. Web server architectures like PHP-FPM reuse worker processes to handle multiple sequential HTTP requests. When request-owned internal data structures persist across worker resets without being sanitized, subsequent requests can manipulate that stale global state. Attackers exploit this leftover data to gain arbitrary memory read and write capabilities, bypassing address space layout randomization and dropping persistent access.

Both flaws received a CVSS v4.0 score of 9.2. A Rapid7 emergency threat analysis confirms that both vulnerabilities give unauthenticated threat actors full shell access under the execution context of the underlying web server user.

AI-Accelerated Exploit Development: Frontier Models Break Human Boundaries

What makes this incident particularly alarming is how the vulnerabilities were weaponized. The underlying code bugs lay dormant in the PHP runtime for over a decade. Human security researchers struggled for years to turn these subtle memory anomalies into reliable, deterministic exploits due to complex state conditions. Frontier AI models changed that math entirely. Security analysts at Wiz revealed that frontier LLMs assisted in analyzing the C source code, calculating precise memory offsets, and constructing stable multi-stage payload chains.

This represents a distinct operational shift in software security. Threat actors and researchers can now leverage automated models to analyze historical memory safety flaws and build functional weaponized exploits in hours rather than months. An attacker no longer needs to possess deep expertise in custom C allocators to achieve a buffer overflow or use-after-free outcome. Automated engines do the heavy math, reducing the technical barrier to entry for exploiting deep system-level software.

Your defense strategy can no longer rely on the assumption that complex bugs are safe from exploitation.

Immediate Sysadmin Protocols: Audit, Upgrade, and Isolation

Your first priority is a comprehensive inventory audit. Scan your environment for every instance of PHP, including legacy servers, staging boxes, forgotten testing environments, and embedded software agents. PHP often ships bundled inside third-party administrative utilities, database management panels, and enterprise monitoring agent binaries. If you only check your primary web servers, you will leave critical internal vectors wide open to lateral movement.

Once you have mapped your assets, execute direct upgrade paths for supported installations. Upgrade active nodes to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Restart every web service and FPM pool process after updating to flush old binaries from memory. A package update without a process restart leaves the vulnerable shared libraries running in active daemon threads.

# Check active CLI and FPM runtime versions
php -v

# Identify running PHP-FPM processes requiring restart
ps aux | grep php-fpm

# On Debian/Ubuntu environments
sudo apt-get update && sudo apt-get install --only-upgrade php8.3-fpm php8.3-cli
sudo systemctl restart php8.3-fpm nginx

# Scan webroot for recently created or altered PHP files (last 48 hours)
find /var/www/html/ -type f -name "*.php" -mtime -2 -ls

For systems running EOL releases like PHP 7.4 or 5.6, standard repository updates do not exist. If you cannot immediately refactor your code to support PHP 8.2+, you must isolate those servers behind a strict web application firewall, disable vulnerable extensions, or disconnect them from public network routing. Your opsec is failing if legacy boxes sit exposed directly to edge traffic.

Hunting Persistent Web Shells Post-Patch

Patching the PHP engine fixes the vulnerability, but it does not remove backdoors planted before the fix was applied. Attackers who successfully exploited PHP2Shell prior to your update cycle have likely dropped an obfuscated web shell inside your public directory paths. These malicious scripts allow adversaries to maintain persistent access, log user input, execute operating system commands, and install secondary Keylogger" target="_blank" rel="noopener noreferrer" class="hover:text-violet-400 transition-colors">keylogger tools.

Begin forensic triage by auditing file creation timestamps and file integrity across your application directories. Look for unusual file extensions, double extensions, or standalone PHP files residing inside uploads or asset directories where code execution should never occur. Inspect web worker process trees for child processes executing system binaries like `/bin/sh`, `/bin/bash`, `curl`, or `wget` under the web user context.

Check process metadata and network sockets immediately. If an unprivileged FPM worker process holds open an outbound TCP connection to an unknown external IP address, treat that box as fully compromised. Rebuild the host from clean source repositories.