PHP2Shell makes runtime inventory the urgent patch problem
PHP is often treated as a dependency of an application rather than an internet-facing runtime. The October 2026 PHP2Shell release shows why that distinction breaks down. Two critical vulnerabilities in the PHP interpreter can lead to unauthenticated remote code execution under the right conditions, and the affected component may be present in containers, shared hosting, serverless images, and long-lived virtual machines.
The PHP project released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Both are relevant to web applications because the interpreter processes request data before the application's own authorization logic has any chance to run.
CVE-2026-109619 is described as a stale-global-state problem: request-owned internal state can survive after its backing memory has been freed. CVE-2026-109618 involves memory corruption during out-of-memory handling. The exact exploit conditions are not universal to every PHP request, but the security consequence is broad enough that affected runtimes need priority treatment.
CISA added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, 2026. The known-exploited status changes the response from routine patch planning to an active incident-prevention exercise.
Patch the interpreter, not only the application
The most common failure is to patch a CMS plugin while the PHP runtime under it remains old. PHP can be installed at the operating-system level, bundled into a container base image, supplied by a hosting provider, or compiled into a custom image. The application inventory may know that WordPress, Drupal, or a custom service is running without knowing which PHP binary executes the request.
Use a runtime inventory that records the PHP version, patch level, build provenance, process owner, and container digest. Check the command used by the web server and PHP-FPM pool, not only the version reported by a developer workstation. Shared hosting and managed platforms need written confirmation from the provider that the patched build is active on the affected pools and that old workers have been restarted.
After patching, restart PHP-FPM, the web server, or the container process. Replacing files on disk does not guarantee that a long-running worker is using the new binary. Run a request-path test that prints the runtime version from a restricted endpoint or an administrative check, and remove the endpoint when the verification is complete.
The third issue is not part of the same fix
On October 23, 2026, the PHP project published an informational advisory for CVE-2026-115560 in session upload progress. Canadian and European advisories note that this issue is not addressed by the October 21 updates. The distinction matters. A system can be fully patched for CVE-2026-109618 and CVE-2026-109619 and still require a separate configuration or later update for the session upload progress issue.
For CVE-2026-115560, the published mitigation is to set session.upload_progress.enabled=0 where the application does not need that feature. Apply the change to every relevant PHP-FPM pool and restart the workers. Follow the PHP project's current advisory before deciding that the setting is sufficient for the organization's configuration.
Detection and response
Review web-server and PHP-FPM logs for crashes, worker restarts, abnormal request bodies, and unusual child-process behavior around the public disclosure window. Application logs may show a request reaching a code path it should not control. Container runtime telemetry may show an unexpected shell, file write, or network connection from a PHP worker.
If a host is suspected of compromise, preserve process, memory, container, and network evidence before rebuilding it. Rotate application secrets, database credentials, session keys, and any cloud credentials available to the PHP process. Check for persistence in cron jobs, systemd units, PHP auto-prepend files, web shells, and container layers.
Remove explanations that rely on the application being "behind a login." These vulnerabilities can be triggered before the application authenticates a user. The best immediate controls are a patched runtime, a request path that cannot execute the vulnerable code with untrusted input, and a monitored egress policy that limits what a compromised worker can reach.
