PHP reports an Apache mod_php exploit that triggers before your application code ever runs. The PHP2Shell security update patches two flaws allowing unauthenticated remote code execution. Here is how to pick the right fixed build, verify the runtime actually serving requests, and use temporary mitigations without mistaking them for a complete fix.
Internet-facing PHP services get priority. The Qualys advisory notes Cloudflare has already seen attack traffic targeting these vulnerabilities, including attempts to evade its protections. Apache mod_php needs immediate attention, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments are also in scope. Researchers have additionally demonstrated unauthenticated disclosure of worker memory — passwords, authentication tokens, API keys, the works.
How PHP2Shell reaches request memory
The flaws live in PHP's internal request state, not in application-level mistakes you can validate away. Each carries a CVSS v4.0 score of 9.2, but the mechanisms differ.
CVE-2026-109618 concerns out-of-memory corruption. An OOM error interrupts a vulnerable operation and leaves request data partially initialized. Cleanup routines then process that invalid state, creating a path to remote code execution.
CVE-2026-109619 concerns stale global state. PHP retains references to request data after its backing memory has been freed. A later request handled by the same worker accesses those references before initialization resets them. Researchers have demonstrated remote code execution through that use-after-free sequence.
PHP-FPM's startup behavior blocks a particular out-of-memory attack path. That distinction does not remove the need to patch: PHP has validated session-lifecycle remote code execution against FPM under suitable application conditions. Exploitability varies with configuration and application behavior, so the deployment model matters without providing a blanket exemption.
Match your branch to its fixed release
The following upstream releases address both vulnerabilities. Match the branch you actually deploy to its fixed version:
- PHP 8.5 is fixed in 8.5.12.
- PHP 8.4 is fixed in 8.4.27.
- PHP 8.3 is fixed in 8.3.36.
- PHP 8.2 is fixed in 8.2.35.
Distribution-managed installations need a different check: compare the complete installed package version with the distribution vendor's advisory. A backported fix can retain an older upstream version number. I would not reject a vendor package merely because its upstream-looking version falls below this list; the applicable advisory is the deciding evidence.
PHP 8.1 and earlier are outside regular upstream support. Limited source backports are available for 7.4, 8.0 and 8.1. Those installations need a fixed build from a distribution or support vendor, the appropriate source backport, or an upgrade to a supported release. Do not interpret the availability of a limited backport as renewed regular support.
Patch the runtime actually serving your applications
Installing a package is only part of remediation. Verify each application's runtime and replace workers still running the previous build.
Start with internet-facing Apache mod_php deployments, then work through the remaining web-facing runtimes.
Find every installation before selecting an update
Include parallel PHP branches, hosting-panel packages, containers, and PHP bundled with appliances or other software. Multiple copies can exist on the same asset, so updating the primary installation can leave another vulnerable copy behind.
The familiar version command is useful, but its result has a specific boundary:
php -vIt may report a different installation from the one serving web requests. Record that distinction during inventory instead of treating command-line output as proof that the application runtime is fixed.
Update the package, binary or image actually in use
For distribution packages, use the full package version and vendor advisory. For containers, obtain a patched image or rebuild the application image with patched dependencies. Include build artifacts and deployed workloads in the review, rather than checking only traditional servers. Trace the workload back to its image, update the dependencies, rebuild and redeploy.
Say a vulnerable image is both stored in a registry and deployed in production. Identifying the stored image alone does not complete that workflow.
Replace workers and verify the running application
Restart the relevant services or redeploy containers after updating. Confirm that the running application uses the updated runtime, and check for workers that remain on the previous build.
After verification, review emergency configuration changes as a separate part of the rollout. Restore an appropriate finite memory limit and reconsider temporary upload restrictions and worker-recycling settings. Keep that configuration review attached to the remediation task so emergency settings are not forgotten.
Mitigations do not close every attack path
Updating is the only complete fix. PHP's temporary measures reduce exposure to particular paths; they do not make an unpatched installation safe. Assign an owner and patch deadline to every temporarily mitigated system.
For CVE-2026-109618, PHP recommends administratively enforcing the following setting, such as through php_admin_value in an FPM pool or Apache configuration:
memory_limit=-1Restart every worker and verify that no pool, directory or application setting restores a finite limit. This removes the attacker-controllable failure caused by PHP's configured memory cap. Underlying allocation failures can still reach the vulnerable code, however, and removing the cap increases resource-exhaustion risk.
Request limits provide another temporary boundary. The source recommends post_max_size=8M for applications without file uploads, or post_max_size=32M where uploads are necessary, with upload_max_filesize below post_max_size. For applications built around form handling and data validation, review whether multipart requests and uploads are required before preserving permissive limits.
Independently enforce decoded request-size limits at the web server or proxy, including requests without a usable Content-Length. Reduce max_input_nesting_level and bound input variables, multipart parts, headers within each part, and uploads. Block multipart requests before PHP if the application does not use them.
Container or cgroup memory limits can provide an availability boundary, preferably terminating only the affected worker. They do not guarantee protection against allocation failures. PHP specifically warns against substituting RLIMIT_AS or RLIMIT_DATA, which can force allocation failures that trigger the vulnerable path.
For CVE-2026-109619, disable session upload progress before request parsing:
session.upload_progress.enabled=0Apply it through php.ini, an FPM pool or server configuration, then restart every worker. Application-level ini_set() and FPM .user.ini are not sufficient. This blocks the confirmed session paths only.
On PHP 8.5, administratively setting fatal_error_backtraces=0 and restarting workers blocks the confirmed fatal-backtrace path only. Resolve diagnostics before initialization or during cleanup, and fix attacker-triggerable fatal errors and timeouts. Suppressing messages with error_reporting, display_errors or @ does not prevent the underlying access.
FPM operators can consider pm.max_requests=1, accepting its performance cost to limit each worker to one request. It remains optional and does not replace patching. If a fixed build cannot be deployed promptly, consider restricting public access or temporarily isolating the service.
After patching, test behavior under memory pressure. The fixed runtime can terminate a worker immediately at its hard memory threshold, bypassing normal shutdown handlers. That behavior belongs in the post-update application checks, not just the package verification.
Use detections to verify the rollout
Qualys customers should separate discovery from vulnerability assessment. QID 45110 — PHP Server Detected identifies PHP installations; it does not confirm either CVE. Use its results to find systems for review, then validate them against the applicable PHP or vendor advisory.
The source lists QID 389102 for PHP2Shell assessment and QID 39033 as the unauthenticated detection. Distribution-specific checks are also listed. After remediation, rerun the applicable checks and verify both installed packages and running PHP instances.
For cloud-native deployments, Qualys TotalCloud and Container Security can connect vulnerable components in images with deployed workloads. Runtime Vulnerability Reachability adds evidence of packages observed in use within running containers. That context helps prioritize actively running, internet-exposed applications rather than treating every stored image as equivalent.
A newer package on disk is progress; a confirmed fixed runtime serving requests is the finish line.
Frequently asked questions
Can Qualys Deep Scan find PHP copies outside standard installation directories?
Yes. Deep Scan can inspect custom application folders, secondary drives and other configured directories. Findings include the full binary path, installed version and recommended fixed version. The source says it is included with VMDR and available on Windows assets running Cloud Agent 6.2 or later.
Can Qualys surface new distribution advisories without waiting for another scheduled scan?
Qualys InstaScan matches new vendor advisory intelligence against existing software inventory, typically surfacing findings within minutes of advisory processing without requiring a new scan. Coverage depends on the assets in scope and current inventory. The source lists Red Hat, Ubuntu, Debian and Oracle Linux among supported advisory sources.
Source: PHP2Shell: PHP Patches Two Critical RCE Vulnerabilities, Urges Immediate Updates
How this article was made: drafted with AI from the source above and fact-checked against it. How we write and check articles.
Vishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
