Critical PHP Security Alert: PHP2Shell (CVE-2026-109618 & CVE-2026-109619)
Current Security Status
CRITICAL | CVSS 9.2/10
Security patches: RELEASED — Immediate action required
PHP has released security updates addressing two critical vulnerabilities that could allow unauthenticated Remote Code Execution (RCE).
The fixed upstream versions are:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Current risk: Systems running vulnerable, unpatched PHP remain at critical risk. WAF protections and configuration-based mitigations may reduce exposure but do not provide complete protection.
PHP 8.1 and older are no longer supported through normal upstream releases. Administrators should verify vendor security backports or migrate to supported versions.
What Are the Vulnerabilities?
The vulnerabilities, collectively referred to as PHP2Shell, affect PHP’s core runtime rather than a particular CMS or application.
- CVE-2026-109618: Memory corruption related to out-of-memory handling.
- CVE-2026-109619: Unsafe reuse of internal state after memory has been freed.
Both vulnerabilities may allow unauthenticated remote code execution. Web-facing PHP applications, including WordPress, Laravel, Drupal and Joomla installations, may be exposed when their underlying PHP runtime remains vulnerable.
Security Timeline
| Date | Event |
|---|---|
| October 20, 2026 | PHP announces two critical vulnerabilities and schedules an emergency release for October 21. |
| October 20–21 | Initial security research, exploit disclosures and vendor warnings emerge. |
| October 21 – Before release | CloudLinux confirms Imunify360 ruleset 8.83 blocks a publicly known exploit pattern. |
| October 21 – 14:00 UTC | Scheduled PHP security release time. |
| October 21 – Latest update | PHP officially releases versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 addressing both CVEs. |
| October 21 – Latest update | Cloudflare publishes emergency WAF rules addressing anomalous request patterns. |
| Ongoing | Hosting vendors distribute updated packages; administrators must verify and deploy applicable fixes. |
Mitigation and Required Actions
Priority 1 — Apply security patches
Upgrade to the fixed PHP release for your branch, or install the security-fixed package supplied by your operating system or hosting vendor.
Priority 2 — Verify temporary protections
Review Cloudflare WAF, Imunify360 and other applicable security controls. Ensure traffic cannot bypass the protected endpoint and access the origin directly.
Priority 3 — Review PHP configurations
PHP has published temporary mitigations for specific attack paths, including PHP memory limits, request size restrictions, session upload progress and PHP 8.5 fatal-error backtraces. These require careful evaluation, may affect application behavior and are not complete fixes.
Priority 4 — Monitor and verify
Review security events, access logs and unusual PHP worker activity. Verify that patched packages are installed and that web-serving processes are using the updated runtime.
Hosting Service Responsibilities
Shared Hosting: Libyan Spider is responsible for infrastructure-level updates within its managed shared hosting environment. Customers should monitor the service status page for relevant announcements.
Managed VPS / Dedicated Servers: Updates are handled according to the agreed management scope.
Unmanaged VPS / Dedicated Servers: Customers and their system administrators are responsible for evaluating exposure, applying security patches and monitoring their environments. Immediate action is strongly recommended.
Hosting Vendor Updates
| Platform | Latest reported status |
|---|---|
| PHP | Security fixes available |
| CloudLinux / Alt-PHP | Confirm package availability and security backports |
| Imunify360 | Ruleset 8.83 mitigates a publicly documented attack pattern |
| Cloudflare | Emergency WAF rules published; verify applicable protection |
| cPanel / EasyApache 4 | Verify security-fixed EA-PHP package availability |
| Plesk | Check updated Plesk PHP packages and vendor advisories |
Sources and Ongoing Updates
- Official PHP security updates
- PHP security announcements
- CloudLinux security advisory
- Cloudflare WAF changelog
- Plesk security advisory
- Libyan Spider service status
Editorial note: This article is maintained as a continuously updated security advisory. Earlier timeline entries reflect information available at their original publication time.
Share:
Leave a Reply