PHP2Shell Makes PHP Inventory and Patch Ownership Urgent
4 minute read time
TL;DR
-
PHP2Shell is the name being used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution.
-
PHP says all PHP installations serving web requests are at risk, with the highest risk in Apache configurations using mod_php. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
-
Organizations should inventory PHP across their environments, prioritize internet-facing systems, monitor for suspicious activity, and apply the update through PHP or the relevant distribution or product vendor. If a system cannot be remediated promptly, consider taking it offline until it is fully mitigated.
PHP2Shell Is Two Critical Flaws in the PHP Runtime
PHP2Shell refers to two vulnerabilities in PHP's internal request handling. Because PHP is used in websites, applications, and products, affected installations may be managed by different teams or supplied through different vendors.The urgent work is to find those systems, establish who owns each one, and verify that the fix reaches every deployment.
Sonatype's PHP2Shell Security Event tracks current guidance and response recommendations.
-
CVE-2026-109618 involves out-of-memory handling: PHP may interrupt a request while internal data is only partly initialized, then handle that data incorrectly during cleanup.
-
CVE-2026-109619 involves a stale global state that can persist after its underlying memory has been freed.
Under affected conditions, the flaws can allow a remote attacker to execute code without authentication.
Ilkka Turunen, Sonatype's Field CTO, puts the operational priority plainly: "The immediate priority is clear accountability: know where PHP is used across your services and products, who owns remediation, and how quickly fixes can be deployed."
The Hard Part Is Finding Every PHP Installation
Organizations may know that their public websites use PHP but have less visibility into internal portals, older services, appliances, or software that bundles its own runtime. Different teams may also install and maintain PHP through separate operating system distributions, hosting providers, or third-party vendors.
Turunen expects remediation to extend beyond visible websites and services. PHP is bundled into other products and remains in older environments, creating what he calls "a long tail of environments needing to apply this patch."
A complete response starts with an inventory that connects each runtime to an owner and a patch path. Teams should identify:
-
Which internet-facing and internal systems run PHP.
-
The PHP version and how it is supplied or maintained.
-
Which applications, containers, images, appliances, and products include a PHP runtime.
-
The business or service owner responsible for remediation.
-
Whether a fixed package is available from PHP, the operating system distributor, hosting provider, or another vendor.
Include systems that are easy to overlook: older applications with little traffic, test environments that remain reachable, and deployments maintained outside the central platform team. An incomplete inventory can make an organization believe remediation is finished while vulnerable installations remain online.
PHP 8.1 and older no longer receive updates from the PHP project. PHP says some distributions and long-term support vendors provide backported fixes, and it has also published source backports for selected older branches. Organizations using these versions should confirm the status with their distribution or vendor, or plan an upgrade to a supported release. Do not assume an upstream version number alone tells you whether a vendor-maintained package includes the fix.
Patch, Verify, and Monitor Across the Estate
PHP says updating to a fixed release is the only complete solution. Temporary controls can reduce exposure to specific attack paths, and a web application firewall can add protection for traffic routed through it. Cloudflare reported deploying protections and seeing attack traffic aimed at its customers, while urging users to patch.
If a system cannot be remediated promptly, the UK National Cyber Security Centre advises organizations to consider taking it offline until it is fully mitigated. If it must remain available, assign an owner and document interim protections and a reassessment date.
The discovery and response also highlight the role AI is playing in vulnerability research. The Wall Street Journal reported that Calif and Wiz researchers used AI tools during a PHP source-code audit, and that developers, researchers, and distributors coordinated on fixes after details leaked ahead of the planned disclosure.
As Turunen warns: "The age of AI has also sped up exploitation where it's likely we are going to see scaled up attacks imminently across the internet."
What Organizations Should Do Now
PHP2Shell is a test of whether organizations can find, own, and update the software running across their environments. PHP has published fixes, but a release only reduces risk when the update reaches every affected runtime, including those inside products and services maintained by other vendors.
Organizations should:
-
Inventory systems running PHP, prioritizing internet-facing systems.
-
Monitor internet-facing PHP systems for suspicious activity.
-
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply the relevant vendor backport. Include products and services that bundle PHP.
-
Check PHP, distribution, and third-party vendor advisories for updates, especially when running PHP 8.1 or older.
-
If a system cannot be remediated promptly, consider taking it offline until it is fully mitigated.
For ongoing details and links to current advisories, see the official PHP security advisory.
Written by Sonatype Research Team
Sonatype's Research Team is focused on bringing real-time, in-depth intelligence and actionable information about open source and third party vulnerabilities to Sonatype customers.
Explore All Posts by Sonatype Research TeamTags
