https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
The PHP security team has released emergency patches addressing two critical remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which affect all PHP installations that serve web requests. Discovered by researchers from Calif, OpenAI, and Wiz, the unauthenticated flaws impact widely used server configurations including PHP-FPM, Apache with mod_php, and LiteSpeed. Both vulnerabilities stem from PHP leaving its memory in a corrupted state when a request ends abnormally, with CVE-2026-109618 enabling out-of-memory corruption exploits and CVE-2026-109619 allowing heap use-after-free attacks — both capable of granting attackers remote code execution with web worker privileges. Administrators running PHP 8.x are urged to immediately update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
The severity of the situation has drawn warnings from multiple cybersecurity bodies, with the UK National Cyber Security Centre urging organisations to patch immediately or take affected systems offline. Cloudflare confirmed the company had already observed early exploitation attempts in the wild, noting that whilst the company deployed temporary Web Application Firewall (WAF) rules, these measures were not a permanent fix. PHP core developer said no mitigation would fully block potential attacks, stressing that official patches remain the only reliable defence.
For organisations unable to patch immediately, the PHP security team has outlined temporary mitigations, including setting memory limits, disabling session upload progress, and restarting workers — though these measures do not fully protect against exploitation. The urgency of the situation cannot be understated given PHP powers between 75 and 80 per cent of all websites globally, including those running popular content management systems such as WordPress, Joomla, and Drupal. With over 5.1 million PHP hosts currently exposed online, the potential attack surface is enormous, making swift action critical for administrators worldwide.