A coordinated global security alert has been issued across the cybersecurity ecosystem following the disclosure of two critical vulnerabilities in the core PHP runtime. Both the United States National Security Agency (NSA) and major cloud infrastructure providers including DigitalOcean have published urgent advisories warning of unauthenticated Remote Code Execution (RCE) flaws that threaten web servers worldwide.

Collectively tracked in the security community as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), these vulnerabilities carry a critical CVSS v4.0 rating of 9.2. They enable remote attackers to gain full, unauthorized code execution privileges on vulnerable web servers without prior authentication or administrative access. Due to the acute severity of the threat, the NSA has taken the extraordinary step of advising organizations to take vulnerable internet-facing systems completely offline if immediate patching is not possible.

Understanding the Vulnerabilities: How “PHP2Shell” Operates

The two vulnerabilities stem from deep memory-management and state-handling mechanics within the PHP engine when processing web requests. While independent in mechanism, both can be weaponized over ordinary HTTP requests:

  • CVE-2026-109618 (Out-of-Memory Handling & Memory Corruption): This flaw occurs when the PHP runtime encounters out-of-memory (OOM) conditions during request initialization. Under specific payload structures, request-level structures are only partially created. When PHP initiates its error recovery and cleanup sequence, it performs unsafe deallocations on invalid memory references, leading to heap corruption and enabling arbitrary shellcode execution.
  • CVE-2026-109619 (Stale Global State Across Worker Requests): In persistent worker architectures such as PHP-FPM, Apache mod_php, and LiteSpeed, worker processes handle multiple consecutive requests before recycling. This vulnerability allows request-scoped internal state to persist across request boundaries even after its backing memory allocation is freed. An attacker can prime a worker with a malicious request, causing subsequent requests handled by that worker to trigger memory overwrite primitives and execute arbitrary commands.

Notably, both flaws were uncovered through security audits leveraging frontier AI models for automated source code verification, demonstrating how rapid AI advancements are fundamentally transforming vulnerability discovery for both defenders and adversaries.

Who is Affected?

Because these flaws reside in the fundamental request-handling routines of the PHP engine, the exposure profile is vast:

  • Virtually all deployment modes: Environments running PHP via PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are susceptible.
  • CMS and Web Frameworks: Applications built on WordPress, Drupal, Joomla, Laravel, Symfony, and Magento running on unpatched PHP runtimes are exposed to exploitation.
  • Cloud & Container Infrastructure: Cloud workloads across DigitalOcean Droplets, DigitalOcean Kubernetes (DOKS), AWS EC2, GCP Compute Engine, App Platform services, Docker containers, and Marketplace 1-Click appliances are vulnerable unless updated.
  • Hidden Internal Services: Organizations often overlook internal tooling—such as legacy internal wikis, database management tools (e.g., phpMyAdmin), and diagnostic dashboards—that run on outdated, internet-accessible PHP runtimes.

Required Action: Patching Releases & Guidance

The PHP Security Team has released emergency maintenance updates across all actively supported branches. Applying these updates is the only reliable and complete mitigation against exploitation.

Upstream Official Security Patches

Ensure your production, staging, and container environments are updated to at least the following version levels:

  • PHP 8.5: Upgrade immediately to 8.5.12
  • PHP 8.4: Upgrade immediately to 8.4.27
  • PHP 8.3: Upgrade immediately to 8.3.36
  • PHP 8.2: Upgrade immediately to 8.2.35

The Threat to End-of-Life (EOL) Versions

Organizations operating PHP 8.1, PHP 8.0, PHP 7.x, or legacy PHP 5.x are in immediate jeopardy. The PHP project does not provide official patches for unsupported EOL releases. Teams running older runtimes must choose one of the following paths without delay:

  1. Fast-track an upgrade: Modernize application dependencies and move to a supported branch (PHP 8.2 or newer).
  2. Deploy vendor backports: If operating on LTS Linux distributions (such as Ubuntu ESM, Red Hat Enterprise Linux, Debian LTS, or Rocky Linux), verify whether your operating system vendor has issued backported security packages for your specific package version.
  3. Network Isolation / Offline Transition: Following the NSA advisory, if an unsupported PHP server cannot be patched or upgraded immediately, isolate it behind private VPNs, restrict ingress via strict firewall access lists, or take the host offline until a secure remediation is in place.

5-Step Incident Response & Remediation Playbook

Engineering and DevOps teams should execute this systematic verification procedure across their server fleet:

  1. Inventory All PHP Environments: Inspect both bare-metal instances, virtual machines, and container images. Run php -v and inspect running daemon versions using php-fpm --version or httpd -V.
  2. Execute System Updates: On Debian/Ubuntu systems, refresh package lists and apply the security updates via sudo apt update && sudo apt --only-upgrade install "php*". On RHEL/AlmaLinux systems, run sudo dnf upgrade "php*".
  3. Rebuild Container Images: In containerized pipelines (Docker, Kubernetes), pull the latest base images from official repositories and rebuild images to replace cached vulnerable layers.
  4. Restart Process Managers: Upgrading packages on disk does not terminate running workers in memory. Ensure all PHP-FPM daemons, web servers, and container pods are completely restarted (e.g., sudo systemctl restart php*-fpm && sudo systemctl restart nginx).
  5. Verify Log Activity: Inspect web server access and error logs for suspicious OOM spikes, segmentation faults (SIGSEGV), abnormal HTTP payload lengths, or recurring worker crashes that may signal exploit attempts.

Summary

The PHP2Shell vulnerability disclosure represents one of the most critical infrastructure alerts of recent years due to PHP’s prevalence across enterprise web applications and managed cloud environments. Given that public exploit proof-of-concepts often follow rapid advisory disclosures, engineering teams must prioritize patching and verifying all active PHP web handlers immediately.

Official Advisories and References

For primary technical documentation, vendor advisories, and official alerts, consult the following sources: