TWO critical PHP flaws, dubbed “php2shell”, could let unauthenticated attackers run code on affected web servers. CVE-2026-109618 enables remote code execution through out-of-memory corruption, while CVE-2026-109619 involves stale global state. The bugs were discovered by security consultancy Calif and received a critical CVSS v4.0 score of 9.2. WatchTowr said the flaws affect PHP installations serving web requests across configurations including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed.
It identified mod_php as the highest-risk configuration, and said the default-enabled Session Upload Progress feature provides one confirmed route to triggering the issue.
Details and a proof-of-concept tool emerged before the planned coordinated disclosure. WatchTowr reported seeing exploitation attempts in the wild, but said none had succeeded at the time of its report. It warned that success could follow soon. PHP users should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older, unsupported branches have no official patch available; organisations must move to a supported branch or use a backported fix.
PHP maintainers said an update is the complete solution, while their advisory also describes steps to reduce exposure in the meantime. Huntress researcher John Hammond recommended inventorying PHP installations, identifying end-of-life versions and alerting on PHP worker processes that launch shells, interpreters or download tools. The article reports that some organisations, including the Netherlands’ National Cyber Security Centre, took websites or services offline to limit exposure or enable emergency patching.