PHP Project issues mitigation guidance for critical PHP2Shell vulnerabilities
The PHP Project has issued mitigation steps for two critical vulnerabilities affecting server interfaces worldwide after releasing patches earlier this week.
FTMQ Startups, written by our newsroom0 views
The PHP Project issued instructions on October 23, 2026, to stop further Remote Code Execution vectors linked to PHP2Shell attacks, ZDNet Cloud and ZDNET reported. The release follows patches issued by the project on October 21, 2026, to address two critical security flaws. The vulnerabilities sparked a global scramble among website operators to update vulnerable systems. [1][2]
The PHP2Shell vulnerability covers two flaws tracked as CVE-2026-109618 and CVE-2026-109619, ZDNet Cloud reported. Both issues carry a critical severity score of 9.2 under version 4.0 of the Common Vulnerability Scoring System. CVE-2026-109618 involves out-of-memory handling failures where an abort via longjmp leaves internal request data partly initialized, leading to memory corruption during cleanup. [1][5]
Exposed server interfaces include PHP-FPM, the Apache HTTP Server module mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is highest for deployments running mod_php, where a demonstrated exploit can run before any application code executes. [5]
The PHP Project advises website operators to apply the official patches or implement recommended configuration changes immediately to prevent remote code execution in limited settings. [1]
In short
- PHP2Shell comprises two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
- Both vulnerabilities received critical severity scores of 9.2 under CVSS 4.0.
- The PHP Project released official patches on October 21, 2026, followed by mitigation steps on October 23, 2026.
- The vulnerability risk is highest for systems using the mod_php server interface.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]PHP2Shell: Haven’t patched yet? Take these steps now to mitigateZDNet Cloud, 2d ago (the report this story comes from)
- [2]PHP2Shell: Haven’t patched yet? Take these steps now to mitigateZDNET, 2d ago
Background
- [3]Log4Shell on Wikipedia
- [4]Meltdown (security vulnerability) on Wikipedia
- [5]PHP2Shell on Grokipedia
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.