PHP2Shell names two flaws in PHP’s handling of request memory. A remote attacker may be able to execute code without signing in. Exploitability varies with the server configuration. PHP’s OOM advisory and stale-state advisory explain the conditions.
Identify where PHP is exposed.
Inventory PHP-backed websites, business applications, hosting accounts, containers and vendor-managed services. Record the service owner, exposure and update responsibility. The Australian Cyber Security Centre recommends identifying PHP, applying updates and monitoring related systems.
PHP identifies web-serving deployments including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk. It rates mod_php highest because a demonstrated attack can execute before application code runs. Read PHP’s deployment guidance.
Apply the update.
Verify the running service.
The original upstream fixes for both PHP2Shell CVEs are listed below. Install the latest applicable vendor-supported package. Check the PHP advisory.
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Distributions and LTS vendors may backport fixes. Confirm the installed package against your vendor’s notice; its displayed upstream version alone may not settle patch status. For older branches, obtain a supported vendor fix or upgrade. PHP’s update guidance.
Have the administrator confirm that the updated runtime is loaded by the web service, including any required worker restart or container redeployment. A command-line PHP version can belong to a different installation.
This table covers the original pair. Review the separate session-upload notice below as part of the same change.
PHP follow-up · 23 October
Check session upload progress.
PHP’s follow-up describes a separate issue, CVE-2026-115560, under an unusual combination of session-handler changes in application code and enabled upload progress.
PHP recommends session.upload_progress.enabled=0 pending its regular fix. Retain this setting if already applied. Have your administrator follow the startup-configuration and worker-restart instructions, and assess application impact. The original PHP2Shell releases do not fix this separate issue. Read the current PHP follow-up.
Using managed hosting?
Ask your provider for a service-specific confirmation. You can send this request:
Please confirm whether our hosted services use PHP affected by CVE-2026-109618 or CVE-2026-109619, which vendor fix is running, when it was deployed, and whether the web workers were restarted. Please also confirm your assessment of PHP’s session-upload follow-up, CVE-2026-115560, and any review for suspicious activity during exposure.
Keep the reply with your change record, including the services covered, package or build reference, and verification time.
Review activity on exposed systems.
Amazon reports exploitation attempts beginning on 17 October 2026. Include that period when available logs allow, and review the service’s wider exposure history. Amazon’s first-party observations provide investigation context.
- Review unusual upload requests and PHP or web-server crashes.
- Investigate unexpected shells, interpreters or download tools launched by server processes.
- Check web directories for unfamiliar or changed files, and unexpected outbound activity.
These are investigation leads. A clean endpoint alert list or missing log entry does not establish that a server is safe. PHP’s technical advisory describes failures that may occur before useful diagnostics.
If compromise is suspected, preserve relevant logs and files and involve your incident responder. Updating addresses the corrected vulnerability; it does not remove an existing intrusion.
Sources & review date
- PHP project: security release and follow-up notices
- PHP project: CVE-2026-109618
- PHP project: CVE-2026-109619
- CISA: Known Exploited Vulnerabilities catalog
- Australian Cyber Security Centre: PHP guidance
- Amazon Threat Intelligence: observed PHP2Shell attempts
Reviewed
Initial publication, incorporating the original PHP advisories, session-upload follow-up and known-exploitation information. This is general guidance about third-party software.