# PHP2Shell: Two Critical PHP Vulnerabilities

Two critical vulnerabilities. One vulnerable runtime. Potential remote code execution.

CRITICAL · CVSS 4.0: 9.2

CVE-2026-109618 · CVE-2026-109619

PHP2Shell refers to two reported PHP runtime vulnerabilities involving unsafe memory handling. Under exploitable conditions, they can potentially allow an unauthenticated attacker to execute code on a vulnerable server.

How the Attack Works

       Attacker
          |
          v
  Crafted HTTP Request
          |
          v
  Vulnerable PHP Runtime
          |
     +----+----+
     |         |
     v         v
   Memory    Use-After-
  Corruption    Free
     |         |
     +----+----+
          |
          v
   Potential Remote
   Code Execution

Two Vulnerabilities. Two Failure Modes.

01. CVE-2026-109618 — Memory Corruption

An out-of-memory condition triggers vulnerable error-handling behaviour. Incorrect handling of internal state can corrupt memory and potentially enable code execution.

02. CVE-2026-109619 — Use-After-Free

PHP accesses memory that has already been released through a stale reference. This can cause unsafe memory access and potentially enable code execution.

What Is at Risk?

• Remote code execution: Attackers may execute code with PHP worker privileges.
• Credential exposure: Database passwords, API keys, and application secrets may be exposed.
• Sensitive data: Patient records and other protected information may be at risk.

The actual impact depends on the deployment, process permissions, and accessible resources.

Remediation

1. Identify

Check the PHP version installed on your system:

php -v

For Docker deployments, check the PHP runtime inside the relevant container as well.

2. Patch

Apply the appropriate security update from PHP or your operating-system vendor. Verify the relevant advisories for distribution-managed and legacy installations.

3. Verify

Restart affected PHP workers and confirm that the running runtime uses the patched package.

4. Investigate

Review logs and system activity for suspicious behaviour, particularly if the server was exposed while vulnerable.

Important: Updating your application does not necessarily patch the PHP interpreter.

The Takeaway

Application security extends beyond application code. Runtime integrity, memory safety, least-privilege execution, and timely patching are equally important.

Patch the runtime. Verify the deployment. Protect the data.

References

• PHP Security Announcements
• Ubuntu Security Guidance
• Cloudflare Technical Analysis
• Canadian Centre for Cyber Security Advisory

Verify CVE details and fixed versions against authoritative security advisories before publication.