PHP2Shell RCE Vulnerabilities: Critical Update Guide

The PHP community is facing a serious threat due to two critical remote code execution (RCE) vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a CVSS score of 9.2, indicating high severity, and are already being exploited, especially on Apache mod_php setups. If you're running PHP, updating immediately is crucial to protect your system.

What Are CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 arises from an out-of-memory error during certain PHP operations, which leaves request data partially initialized. This incomplete state can be exploited to execute remote code. Meanwhile, CVE-2026-109619 involves stale global state issues, where PHP retains references to freed memory, potentially leading to code execution if reused.

Why These Vulnerabilities Matter for Your Systems

If your organization uses PHP to serve web requests, particularly with Apache mod_php, PHP-FPM, or php-cgi, these vulnerabilities are a significant risk. Any PHP environment exposed to the internet is susceptible to remote code executions, potentially leading to unauthorized access and data breaches. Cloudflare has reported active exploitation, underscoring the urgency of updating.

PHP Versions Affected and Fixed

The vulnerabilities affect multiple PHP branches, with fixed versions now available:

• PHP 8.5: Update to 8.5.12
• PHP 8.4: Update to 8.4.27
• PHP 8.3: Update to 8.3.36
• PHP 8.2: Update to 8.2.35

Users of PHP 8.1 and older need to rely on backported updates or upgrade to supported versions.

Securing Your PHP Deployments

Here's how you can secure your PHP environments:

1. Update PHP: Upgrade to the latest fixed version and verify using the php -v command. It's tempting to delay updates in production environments due to the potential impact on application stability, but given the severity of these vulnerabilities, this is not a risk worth taking. I'd prioritize this step even if it means scheduling some downtime.
2. Restart Services: Restart PHP services and web servers post-update. This ensures that all patches are applied correctly. In my experience, missing this step can leave systems vulnerable despite having the correct PHP version installed.
3. Consider Temporary Mitigations: If immediate updating isn't feasible, apply mitigations like disabling session upload progress and enforcing memory limits. These mitigations can reduce the attack surface but are not foolproof. I'd consider them as a temporary measure while planning for a full update.
4. Scan for Vulnerabilities: Use tools like Qualys VMDR to detect and validate vulnerable PHP versions. Regular scans can help identify other potential configuration issues that might not be addressed by the updates alone.
5. Review Configurations: After patching, adjust any temporary settings to maintain application stability. This includes revisiting any temporary mitigations and ensuring they're set to appropriate levels to avoid performance bottlenecks.

Limitations of the Current Fixes

While updating PHP is crucial, it isn't a comprehensive solution:

• The updates don't address all potential PHP configuration issues. For instance, server configurations that expose PHP to unnecessary risks should be reviewed and tightened.
• Temporary mitigations are only stop-gap measures. They can help in the short term but should not replace a proper update process. My advice is to use them only when absolutely necessary.
• Older PHP versions require backports or upgrades for continued security. Sticking with outdated versions poses ongoing risks and can lead to more complex problems down the line, especially as new vulnerabilities are discovered.

Am I Affected?

If your servers run PHP for web applications, especially on internet-exposed setups, here's how to assess your risk:

• Check PHP versions using php -v. This simple command can quickly show if you need to take action.
• Scan with tools like Qualys for detailed insights. These tools can provide a comprehensive overview of your security posture and help identify not only known vulnerabilities but also configuration weaknesses.
• Review configuration files for potential vulnerabilities. Ensure that settings are not inadvertently exposing your applications to risks.

Next Steps for Administrators

Administrators should prioritize applying updates and stay informed about any additional patches. It's critical to keep abreast of security advisories from PHP and other vendors to ensure no new vulnerabilities slip through the cracks. Regular monitoring and scanning are vital for maintaining security in dynamic environments.

Continuous Security with Qualys

Qualys provides tools like InstaScan and Deep Scan to ensure PHP installations are up-to-date. These tools help identify vulnerable setups, aiding in proactive security management. For organizations using mixed PHP versions across servers, Qualys Deep Scan can be particularly useful to ensure no vulnerability is missed.

Ultimately, securing your PHP environment requires ongoing vigilance and prompt action against new threats. Especially if your applications rely heavily on PHP, consider these updates as critical as any vulnerability in recent years. Regularly revisiting your security posture and updating your systems as new threats emerge is key to maintaining a robust defense against potential attackers.