{"id":"php-php2shell-emergency-patches-oct-2026","category":"patch","status":"live","title":"PHP2Shell flaws exploited: emergency PHP fixes released, but product updates and a follow-up fix remain","tldr":"PHP2Shell lets attackers run code on vulnerable web servers without logging in. The original two flaws have PHP fixes, but bundled-product updates remain uneven and a separate follow-up awaits release. Ask your website host or IT team to confirm protection.","summary":"PHP2Shell covers two critical flaws in PHP, software that runs websites and online services. They can let an attacker run code without logging in, with the permissions of the web server process. PHP identifies all installations serving web requests as at risk, with Apache mod_php at highest risk; exploitability depends on the server, configuration and application. Emergency releases on 21 October fixed both original flaws across supported stable PHP branches. ITPro reported precautionary shutdowns affecting UK government services and Orange websites, alongside millions of attack attempts reported by Cloudflare. CISA subsequently listed both flaws as exploited. Protection remains partial across products that bundle PHP: Red Hat still describes outstanding updates, and the Dutch NCSC's 2 November inventory records unresolved exposure. A separate session upload-progress issue, CVE-2026-115560, still awaits a regular PHP release as of 3 November; PHP provides a protective setting for its unusual configuration requirements.","action":"If you own a website, ask its host or IT team to confirm the running web server uses PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or a supplier-confirmed backported fix, and that every PHP worker has been restarted. Also ask them to apply PHP's session.upload_progress.enabled=0 advice for the follow-up issue until its fix arrives. Ordinary website visitors have no PHP update to install.","product":"PHP web servers and products that bundle PHP","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-109618","CVE-2026-109619","CVE-2026-115560"],"tags":["php","php2shell","remote-code-execution","actively-exploited","web-server"],"affected":["For CVE-2026-109618 and CVE-2026-109619, PHP's advisories list releases before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on their respective branches.","PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; precise exposure depends on configuration and application behaviour.","PHP 8.1 and older are outside upstream support; distribution and LTS supplier fixes must be checked separately.","CVE-2026-115560: applications with session upload progress enabled that configure php_binary or php_serialize, then switch to php at runtime before starting the session; PHP has not yet published full affected-version details."],"fixed":["PHP 8.2.35 — CVE-2026-109618 and CVE-2026-109619","PHP 8.3.36 — CVE-2026-109618 and CVE-2026-109619","PHP 8.4.27 — CVE-2026-109618 and CVE-2026-109619","PHP 8.5.12 — CVE-2026-109618 and CVE-2026-109619","PHP 8.6.0 RC4 — fixes both original flaws in the development branch; PHP warns against production use"],"matches":[],"sources":[{"kind":"advisory","title":"PHP October security releases and session upload-progress warning","url":"https://www.php.net/archive/2026.php","by":"PHP","date":"2026-10-23"},{"kind":"advisory","title":"RCE via OOM corruption","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","by":"PHP","date":"2026-10-21"},{"kind":"advisory","title":"RCE via stale global state","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","by":"PHP","date":"2026-10-21"},{"kind":"advisory","title":"RHSB-2026-013: PHP request-handling memory corruption","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-013","by":"Red Hat","date":"2026-10-23"},{"kind":"news","title":"PHP warns administrators ahead of emergency security updates","url":"https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/","by":"BleepingComputer","date":"2026-10-20"},{"kind":"news","title":"PHP attack attempts and precautionary website shutdowns","url":"https://www.itpro.com/security/cyber-attacks/ive-not-seen-anything-like-this-in-a-long-long-time-millions-of-hacking-attempts-recorded-and-websites-taken-down-as-organizations-scramble-to-patch-critical-php-vulnerabilities","by":"ITPro","date":"2026-10-22"},{"kind":"news","title":"CISA urges federal agencies to patch after PHP exploits observed","url":"https://www.itpro.com/security/cisa-urges-federal-agencies-to-patch-after-php-exploits-observed","by":"ITPro","date":"2026-10-28"},{"kind":"advisory","title":"PHP2Shell operational guidance and software inventory","url":"https://github.com/NCSC-NL/php2shell","by":"NCSC-NL","date":"2026-11-02"}],"started":"2026-10-20","closed":null,"created":"2026-11-03T20:50:55.705Z","updated":"2026-11-03T20:50:55.705Z","cve_notes":[{"cve":"CVE-2026-109618","name":"Memory corruption during PHP out-of-memory cleanup","what":"PHP can leave request data partly initialised when memory allocation fails, then use that invalid data during cleanup, allowing an unauthenticated attacker to run code with the web worker's permissions.","severity":"critical","cvss":9.2},{"cve":"CVE-2026-109619","name":"Use-after-free across PHP web requests","what":"PHP can retain references to freed request memory and use them during a later request handled by the same worker, allowing an unauthenticated attacker to disclose memory or run code.","severity":"critical","cvss":9.2},{"cve":"CVE-2026-115560","name":"PHP session upload-progress serialisation flaw","what":"PHP's session upload-progress feature has an unlikely code execution path when an application changes its session serialisation handler at runtime under the configuration described by PHP.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-11-02","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The Dutch NCSC's inventory listed 930 products: 167 marked fixed, 215 vulnerable and 93 under investigation, with others runtime-dependent, unaffected or unknown. These are inventory classifications, not counts of compromised systems.","url":"https://github.com/NCSC-NL/php2shell","by":"NCSC-NL","patch":null},{"at":"2026-10-26","added":"2026-11-03T20:32:12.437Z","kind":"cisa-added","text":"CISA added both original PHP2Shell flaws to its Known Exploited Vulnerabilities catalogue, according to ITPro's 28 October report. US federal civilian agencies were given until 29 October to apply fixes.","url":"https://www.itpro.com/security/cisa-urges-federal-agencies-to-patch-after-php-exploits-observed","by":"ITPro","patch":null},{"at":"2026-10-23","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Red Hat's revised bulletin said some fixes were available and others remained in progress. It also said RHEL 7 was affected by CVE-2026-109619 but lacked the vulnerable code for CVE-2026-109618.","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-013","by":"Red Hat","patch":null},{"at":"2026-10-23","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"PHP disclosed a separate, unlikely remote code execution issue, CVE-2026-115560, awaiting the next regular release. It recommended disabling session upload progress; applications that never change their session serialisation handler at runtime are not exposed to this issue.","url":"https://www.php.net/archive/2026.php","by":"PHP","patch":"partial"},{"at":"2026-10-22","added":"2026-11-03T20:32:12.437Z","kind":"wider-attacks","text":"ITPro reported that Cloudflare had counted millions of exploitation attempts. Dozens of UK government services and some Orange websites were taken offline as a precaution while organisations assessed exposure and patched.","url":"https://www.itpro.com/security/cyber-attacks/ive-not-seen-anything-like-this-in-a-long-long-time-millions-of-hacking-attempts-recorded-and-websites-taken-down-as-organizations-scramble-to-patch-critical-php-vulnerabilities","by":"ITPro","patch":null},{"at":"2026-10-21","added":"2026-11-03T20:32:12.437Z","kind":"new-fix","text":"PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing CVE-2026-109618 and CVE-2026-109619. Organisations using distribution packages or bundled PHP still needed their supplier's updates.","url":"https://www.php.net/archive/2026.php","by":"PHP","patch":"partial"},{"at":"2026-10-20","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"PHP announced emergency updates for two critical flaws for 21 October. BleepingComputer reported that information had leaked before the planned disclosure.","url":"https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/","by":"BleepingComputer","patch":"none"}],"url":"https://hard.fyi/live/php-php2shell-emergency-patches-oct-2026/","json":"https://hard.fyi/api/live?id=php-php2shell-emergency-patches-oct-2026"}