PHP has swiftly issued patches for two severe vulnerabilities known as PHP2Shell, which could allow unauthorized remote code execution (RCE) by attackers. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been assigned a CVSS score of 9.2, underscoring their critical nature. These flaws predominantly affect PHP’s memory management and error handling, making them particularly challenging to rectify.
Patches and Exploitation Attempts
The PHP Foundation released patches for these vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Minimal source backports were also made available for earlier versions like PHP 7.4, PHP 8.0, and PHP 8.1. Despite the rapid response, proof-of-concept exploits were already circulating before the patches were deployed.
WatchTowr, a firm specializing in attack surface management, reported the first exploitation attempts shortly after the patches were released. Although there have been no successful breaches to date, the potential for future exploits remains high, according to Jake Knott, head of threat intelligence at WatchTowr.
Broader Impact and Mitigation Strategies
Patches are crucial as nearly all PHP installations handling web requests are at risk, including popular configurations like PHP-FPM and Apache with mod_php. While patching is the recommended course of action, the PHP Foundation suggests interim measures to reduce exposure where patching isn’t viable.
The vulnerabilities stretch back to PHP version 5.4, posing a threat to sensitive data such as credentials and API keys. This makes it a lucrative target for cybercriminals who might exploit reputable websites for malicious purposes, as emphasized by Shahak Shalev of Malwarebytes.
Discovery and Response
The vulnerabilities were discovered by Wiz, OpenAI, and Calif in August. Despite being present for years, their exploitability wasn’t demonstrated until recently. The PHP Foundation prioritized addressing these issues following detailed reports from these organizations.
With PHP powering a significant portion of the web, including major platforms like WordPress and MediaWiki, the impact of these security flaws is extensive. Wiz has highlighted that memory-safety issues inherent in PHP affect about 70% of websites globally.
Coordinated Disclosure and Community Response
The PHP2Shell vulnerabilities were slated for public disclosure on October 22 but were leaked on October 20, prompting an early release of patches. A coordinated effort among cybersecurity firms ensured protections were in place prior to public disclosure, as demonstrated by Cloudflare’s preemptive measures.
This incident highlights the need for organizations to have rapid response plans for critical vulnerabilities. As Lee Rossey of SimSpace noted, knowing where PHP runs and having a strategy for urgent updates are vital for security teams facing such threats.
