Critical "PHP2Shell" Vulnerabilities: Nearly 70% of the Web is Affected

 

Urgent Security Alert: Protect Your Servers from Critical "PHP2Shell" Vulnerabilities!

If your organization uses PHP in any capacity, it is time to drop everything and patch.

Cybersecurity agencies globally (including the UK's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)) are sounding the alarm over two critical vulnerabilities discovered in the core of PHP, one of the world's most popular server-side scripting languages.

These vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, carry a severe CVSS 4.0 score of 9.2 out of 10. Threat intelligence firms are already seeing proof-of-concept exploits and malicious activity in the wild.

Here is everything you need to know about this new "PHP2Shell" threat and, most importantly, the exact steps you need to take right now to protect your infrastructure.

Understanding the Threat: Unauthenticated RCE

The core issue lies in how PHP handles memory, allowing attackers to achieve unauthenticated Remote Code Execution (RCE). In simple terms: an attacker can execute malicious commands on your web server without ever needing a username or password.

• CVE-2026-109618 ("php2shell"): This vulnerability involves out-of-memory (OOM) corruption. If PHP's memory handling interrupts an operation, it can leave data partially initialized. The cleanup process then mistakenly treats this uninitialized, invalid data as valid.

• CVE-2026-109619: This flaw creates a "stale global state." PHP can sometimes retain an internal state even after the memory backing it has been freed. A subsequent request handled by the same worker process might then use that stale data before normal initialization resets it.

Who is at risk?

Any organization using any version of PHP is potentially vulnerable until patched.

The Global Action Plan: What to Do

Drawing from the latest guidance from CISA, the NCSC, and major threat intelligence firms, we have compiled a comprehensive, prioritized checklist for IT and security teams.

1. Discovery & Inventory (Leave No Stone Unturned)

Because PHP runs in the background of so many systems, you might be running it without realizing it.

• Audit everything: Identify all systems running PHP across your infrastructure, prioritizing anything internet-facing. Do not limit this to just outdated versions.

• Look beyond standard web servers: Ask your IT team, hosting providers, and software vendors (get it in writing!) if any of your systems use PHP. It is frequently bundled inside control panels, security appliances, phone systems, and other third-party tools.

2. Immediate Patching (The Only Complete Fix)

Updating is the only guaranteed way to mitigate these flaws.

• Update to safe versions immediately: Install the patched versions released on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

• Check vendor packages: If you get PHP through a Linux distribution or hosting provider, apply their updated packages and explicitly confirm with the vendor that the fixes for these specific CVEs are included.

• Restart services: After applying the patch, be sure to restart PHP-FPM or your web server so the worker processes load the newly secured code.

• Address unsupported versions: PHP 8.1 and older are no longer officially supported. If you are on an older version, you must upgrade to a supported release or contact your vendor immediately for a backported patch.

3. Emergency Mitigations (If You Cannot Patch Now)

If immediate patching is impossible, or you are stuck on an unsupported version, you must drastically reduce your exposure.

• Take systems offline: CISA’s direct guidance is clear—if you cannot update immediately, or if you use unsupported versions like PHP 8.1 or earlier, take those systems offline until they can be fixed.

• Deploy a WAF: If going offline is truly impossible, placing the applications behind a Web Application Firewall (WAF) may provide a temporary layer of protection.

• Apply temporary hardening: Review the official PHP security advisories for temporary settings you can apply to reduce risk in the interim.

4. Threat Hunting (Assume Breach)

Because exploit activity began shortly before the patches were widely available, patching alone might not be enough if an attacker has already slipped through.

• Scan for compromise: If you were delayed in patching, actively look for signs of a breach before upgrading.

• Look for specific indicators: Network defenders should monitor for PHP worker processes launching suspicious shells, downloading unexpected tools, creating new scheduled tasks, adding unknown user accounts, or modifying files in the web root.

5. Utilize Free Security Resources

• Check dependencies: Consult the NCSC-NL's published inventory list of software products with a PHP dependency to check if your third-party tools are vulnerable.

• Sign up for alerts: Organizations in the UK should utilize the free NCSC Early Warning service, while US companies should subscribe to CISA alerts to stay ahead of emerging threats.

Detailed Emergency Checks & Mitigation:

Step 1: Run an Emergency Read-Only Scan on GitHub

If you need to move quickly but require a "read-only" approach to avoid disrupting production environments with active exploit scanners, you can audit your code, dependencies, and environments directly via GitHub using the following methods:

Method A: GitHub Dependency Graph & Dependabot (Native & Safe) GitHub’s native software composition analysis is entirely read-only relative to your running production servers.

1. Go to your GitHub organization or repository.
2. Click on the Insights tab, then select Dependency graph on the left menu.
3. Click on Dependabot to see high/critical alerts instantly flagged for your repositories.
4. Check for any instances of Node.js packages or PHP dependencies triggering alerts. 

(Note: Because PHP2Shell and Node.js core flaws are runtime vulnerabilities, Dependabot will catch them if you pin specific vulnerable runtime versions or Docker base images in your repository).

Method B: Global Code Search (Max-Effort Manual Hunt) To look for exposure in chat projects or custom codebases where you might be routing data to self-hosted engines, go to your GitHub search bar and execute global, organization-level searches:

1. For PHP Environments: Search for active PHP deployments using extension:php or filename:Dockerfile "FROM php".
2. For GitLab self-hosted endpoints: Search for URLs pointing to your internal instances using path:.env "GITLAB_URL" or filename:config "gitlab". Ensure they aren't publicly exposed.
3. For Node.js / Chat Projects: Search for vulnerable versions or Brotli usage in your backend chat structures using filename:package.json "node" or look for code utilizing the Brotli decoder.

Method C: Run a Local Read-Only Scanner via CLI If you want a deeper "max-effort" scan over your cloned repositories without granting write permissions to third-party cloud apps, you can use CLI-based open-source tools locally. For example, you can run a read-only filesystem or Docker image scan using Trivy:

trivy fs ./your-repo-directory

This will cross-reference your project lockfiles against the newly updated vulnerability databases containing today's CVEs.

Step 2: Careful Steps to Mitigate

If your scans or asset inventories reveal that you are running internet-facing or internal instances of these stacks, execute these mitigation procedures immediately:

PHP Runtime:

• Identified Exposure:
  Any web server utilizing PHP versions prior to today's emergency releases.
  
  
• Mitigation Action Steps: 
1. Update Runtime Immediately. 
2. Upgrade your servers or container base images to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Updating repository web-code alone will not fix this. 
3. If using a WAF (like Cloudflare), ensure specific rules for PHP2Shell are toggled on to block payload injection.

GitLab:

• Identified Exposure:
  Self-managed GitLab instances (CE/EE).
  
  
• Mitigation Action Steps: 
1. Emergency Patching. If you host your own GitLab instance, immediately upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. 
2. If you cannot patch immediately, isolate the server from the public internet or put it behind a strict VPN. (Note: GitLab.com SaaS instances are already safely patched).

Node.js:

• Identified Exposure:
  Backends, APIs, or chat apps running Node.js 22, 24, or 26.
  
  
• Mitigation Action Step: 
1. Rebuild and Upgrade. 
2. Update your Node runtimes to v22.23.4, v24.22.1, or v26.12.1. 
3. Rebuild your Docker images to pull these latest secure binaries.

Step 3: Hunt for Post-Exposure Compromise

Because active exploits are already occurring in the wild, clearing a code scan isn't enough if your servers were previously exposed. You must assume breach and hunt for indicators of compromise:

1. Check Server Logs:
   Inspect web server logs for abnormally large application/x-www-form-urlencoded POST bodies or suspicious requests hammering session.upload_progress.
   
   
2. Audit Process Spawns:
   Monitor your infrastructure to see if php-fpm, php-cgi, or node processes are spawning unauthorized reverse shells, curl requests, or unexpected system binary calls.

The Bottom Line:
The "PHP2Shell" vulnerabilities are not something you can schedule for next week's maintenance window. Treat this as an active, critical incident. Locate your PHP instances, patch them immediately, and hunt for signs of compromise.

Sources:

Government Cybersecurity Alerts

• UK National Cyber Security Centre (NCSC): "Critical security issue affecting PHP" (October 21, 2026). The NCSC alerts UK organizations to CVE-2026-109618 and CVE-2026-109619, urging immediate discovery of PHP instances and priority patching for internet-facing systems. Link to NCSC Guidance
  
  
• Computer Emergency Response Team for the EU (CERT-EU): "Critical Vulnerabilities in PHP" (Advisory 2026-018, October 20, 2026). CERT-EU notes the CVSS 9.2 severity of CVE-2026-109618, explaining it allows remote code execution through memory corruption. Link to CERT-EU Advisory
  
  
• U.S. CISA: While not directly linked in the search results above, CISA's official domain is cisa.gov, where their alerts on critical vulnerabilities are posted.
  
  

Threat Intelligence & Vendor Reports

• Palo Alto Networks Unit 42: "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619" (October 21, 2026). Unit 42 reports both flaws as remote code execution (RCE) vulnerabilities rated 9.2 (CVSS 4.0), confirms seeing proof-of-concept exploits, and notes that at least one European government took its website offline as a precaution. Link to Unit 42 Brief
  
  
• Google Cloud Security: "Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619" (October 21, 2026). Google outlines the vulnerable versions (5.4 through 8.5.11) and the patched versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35). They confirm the upstream PHP project is not releasing fixes for PHP 8.1 or earlier. Link to Google Cloud Blog
  
  
• CrowdStrike: "CrowdStrike Protects Customers from Threats Delivered via PHP RCE Zero-Days" (October 21, 2026). This report details the technical shared root cause in the Zend engine (longjmp() without unwinding) that leads to the memory corruption in both CVEs. Link to CrowdStrike Blog
  
  
• Help Net Security: "PHP2Shell: Critical PHP vulnerabilities patched, update now!" (October 21, 2026). This article quotes the NCSC and computer forensics experts warning about the "long tail" of unpatched embedded installations. Link to Help Net Security

Created & Maintained by Pacific Northwest Computers

Pacific NW Computers

www.linktr.ee/pnwcomputers

www.pacificnwcomputers.com

📞 Pacific Northwest Computers offers Remote & Onsite Support Across: 

SW Washington including Vancouver WA, Battle Ground WA, Camas WA, Washougal WA, Longview WA, Kelso WA, and Portland OR