PHP2Shell (CVE-2026-109618 and CVE-2026-109619): The PHP Vulnerabilities Security Teams Should Patch Now

PHP2Shell is a family of memory-safety bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2. The PHP Foundation shipped an emergency fix on October 21, 2026. The flaws allow an unauthenticated attacker to execute code as the PHP web worker or read its process memory, including passwords, tokens, and API keys from other users' requests. 

The flaws sit in PHP itself, so the exposure reaches beyond any single application such as WordPress, Drupal or Joomla. Wiz Research demonstrated pre-authentication remote code execution against all three, and even a simple PHP application can be exposed on a vulnerable deployment. At least one of the flaws affects PHP versions dating back more than a decade, and PHP powers an estimated 70% of websites.  

Below, we break down how the flaws work, what to patch and how to test your defenses with the PHP2Shell scenarios we've already added to Cymulate Exposure Validation. 

How Does the PHP2Shell Exploit Work? 

Both CVEs involve PHP continuing to use an invalid internal state after a request fails. CVE-2026-109618 concerns out-of-memory handling that can leave request memory partially initialized before cleanup. CVE-2026-109619 concerns a request-owned state that can survive into a later request on the same worker. Session upload progress is one confirmed path for the latter flaw, not a universal trigger for both CVEs. 

Some attack paths run before application code, so application-level authentication and logs may miss important evidence. Successful exploitation can disclose PHP worker memory or execute code with the worker's privileges. 

Exploitation attempts have already started. ELLIO recorded PHP2Shell traffic on October 21, including requests that tried to deliver a Mirai-variant Linux payload. So far, those observations indicate attempted exploitation and payload delivery, with no confirmed compromise of victims. 

How to Patch PHP2Shell 

Update affected PHP runtimes to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install a vendor package with the relevant backported fixes. Restart the PHP workers that serve requests. PHP 8.1 and earlier are no longer supported upstream, although some vendors provide backports. Confirm the status of those installations with the vendor or move to a supported branch. 

If you cannot update immediately, follow the PHP project's path-specific guidance: controls for out-of-memory handling and request size can reduce exposure to CVE-2026-109618, while disabling session upload progress and restarting workers blocks one confirmed CVE-2026-109619 path. PHP 8.5 has a separate fatal-error-backtrace setting to consider. Web application firewall (WAF) rules and request limits can add protection, but each has coverage limits. Updating PHP is the only complete mitigation. 

Vulnerability details 

• php2shell.com: Researcher summary and mitigation guide 
• Wiz Research on PHP2Shell: Technical root cause 
• CVE-2026-109618 / CVE-2026-109619: MITRE 
• ELLIO Threat Research Lab: PHP2Shell observations and Mirai-variant payload 

Patching resources 

• PHP Foundation security release, October 21, 2026 
• AWS: Using AWS WAF to apply mitigations for PHP2Shell 

How to Test Your Defenses Against PHP2Shell With Cymulate 

Our research team tracks new threats as they emerge and turns them into tests you can run right away, so you're ready for PHP2Shell and whatever comes next. Cymulate Exposure Validation includes four PHP2Shell attack-pattern scenarios for testing how controls handle each simulated request or traffic replay: 

1. Web Application Firewall  

• CVE-2026-109618 - PHP Upload-Progress Attack Pattern (php2shell) 
• CVE-2026-109619 - PHP Upload-Progress Attack Pattern (php2shell) 

These simulate multipart request patterns associated with the CVEs against protected sites. Compare the WAF verdict and its logs before and after rule tuning. Each result shows how the control handled that specific simulation, so run every scenario that applies to your environment. 

2. Traffic Simulation (Advanced Scenarios, IPS/IDS) 

• Traffic Simulation - CVE-2026-109618 - PHP Upload-Progress Attack Pattern (php2shell) 
• Traffic Simulation - CVE-2026-109619 - PHP Upload-Progress Attack Pattern (php2shell) 

These replay PHP2Shell-associated traffic between Cymulate agents to assess whether intrusion prevention and detection system (IPS/IDS) controls detect or block the replayed packets. A traffic-simulation verdict does not establish whether the destination PHP runtime is exploitable or patched. 

The four scenarios are rated Critical, mapped to the MITRE ATT&CK® technique T1190 (Exploit Public-Facing Application), and tagged with their corresponding CVEs in the content catalog. Those labels do not, by themselves, establish complete coverage of exploits. 

3. Advanced Scenario: PHP2Shell Scanner (CVE-2026-109618 & CVE-2026-109619) 

Enter one or more target URLs to check the PHP version advertised in HTTP response headers against the fixed releases. The scanner sends no exploit payload. A missing version returns an unknown result. An older advertised version is an exposure signal, not proof of exploitability, because vendor backports and inaccurate or hidden headers can change the answer. Confirm findings against the installed package and vendor advisory. 

4. Threat feed campaign: PHP2Shell Exploitation Attempts Delivering a Mirai-Variant Payload

Cymulate threat feed campaign for PHP2Shell Mirai-variant payload. 

We published this threat feed campaign based on ELLIO's October 21 observations of PHP2Shell exploitation attempts that carried a loader for a Mirai-variant Linux payload. Use it to test how your endpoint and web gateway controls handle the observed indicators and delivery path. 

Together, these tests give you a clear view of your PHP2Shell readiness in Cymulate Exposure Validation: the attack-pattern simulations show how your controls respond, the scanner flags servers that may still be exposed and the threat feed campaign tests your defenses against the delivery activity seen in the wild. From there, confirm patch status in your asset and vendor records, close any gaps with tuning or remediation and rerun the same tests to prove your defenses hold. 

Want to know how your controls can handle PHP2Shell? Book a demo to see Cymulate in action.