Critical PHP2Shell Flaws Expose PHP Web Servers to Unauthenticated Remote Takeover

ALERT ESSENTIALS

PHP shipped emergency patches on October 21 for two critical, unauthenticated remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each), after details leaked ahead of the planned disclosure. Any internet-facing PHP web server is a target, and exploit tooling dubbed PHP2Shell is circulating. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now; PHP 8.1 and older receive no official fix. Neither CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at publication, but Cloudflare reports early attacks, so treat exploitation as imminent.

THREAT DESCRIPTION

PHP is the open-source scripting language behind WordPress, Drupal, Joomla, Laravel and Magento, and it runs on roughly 69% of websites whose server-side language is known. Both flaws trace to one root problem: PHP can leave its memory in a corrupted state when a request ends abnormally. CVE-2026-109618 abuses out-of-memory handling that interrupts PHP while request data is only partly initialized, so cleanup trusts invalid data and the attacker runs code as the web worker account. CVE-2026-109619 leaves request state in memory after its backing memory is freed; the next request on the same worker uses that stale state, enabling a use-after-free, memory disclosure and code execution. PHP rates the risk highest for Apache mod_php, where an unauthenticated request can trigger the attack before any application code runs, and says every installation serving web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed) is exposed.

Researchers at Calif and Wiz discovered the flaws. Details leaked on October 20, ahead of an embargoed disclosure, and a demonstration of the PHP2Shell exploit tool briefly circulated, which pushed PHP to release early. Public proof-of-concept code is reported, though Tenable warns that unverified exploit code is sometimes laced with malware. Cloudflare says it is seeing early attacks and has deployed temporary WAF rules, while Huntress and watchTowr had observed no in-the-wild exploitation as of release morning. Because patches reveal where the bugs live, researchers expect rapid weaponization; estimates of internet-exposed PHP hosts range from about 1.3 million to over 5 million depending on method. No attribution exists. A successful exploit hands the attacker the web server’s privileges, a standard foothold for web shells, data theft and lateral movement.

HEALTHCARE IMPACT

PHP quietly underpins much of a health system’s web footprint: patient portals, online scheduling and billing pages, telehealth intake forms, public websites, PHP-based clinical add-ons, and third-party vendor applications that bundle their own PHP. No healthcare-specific targeting has been reported, but code execution on these servers exposes the application databases and configuration files, including stored database credentials, behind them. That puts protected health information (PHI) at risk, can knock patient-facing services offline, and gives ransomware operators a web shell foothold to move toward clinical networks. A confirmed compromise of a PHI-bearing system triggers a HIPAA breach risk assessment, so finding every PHP host, including vendor-run ones, is the first move.

AFFECTED PRODUCTS / CVE TABLE

† EOL/EOS systems cannot receive vendor patches. Immediate isolation or migration is required. PHP 8.2.35 is fixed, but the 8.2 branch loses security support on December 31, 2026; plan a move to 8.3 or later. CVSS is the PHP security team’s v4.0 score; NVD had no record at publication. CVE-specific Tenable plugins are pending; detection plugins 48243, 58987, 200476 and 216936 identify PHP installs and unsupported versions.

RECOMMENDATIONS

Patching & Remediation

Patch

• Upgrade internet-facing PHP now, mod_php hosts first. Get 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from https://www.php.net/downloads (Windows binaries: windows.php.net/download), or your distribution or LTS vendor’s backported package.
  • Confirm the fix landed: php -v and php-fpm -v (the CLI binary can differ from the web server’s)
  • Distro packages: apt changelog php8.3-cli or rpm -q –changelog php, and look for CVE-2026-109618
  • Restart PHP-FPM or the web server so running workers load the fixed code
• Inventory every PHP runtime, including containers, control panels, CMS hosts and vendor software that bundles PHP. Run Tenable plugins 48243 (PHP Version Detection) and 58987 (Unsupported Version Detection), and demand patch status in writing from vendors.
• Retire PHP 8.1 and older. Migrate to a supported branch; where that is impossible, use PHP’s minimal source backports for 7.4, 8.0 and 8.1 (php-src branches PHP-<version>-CVE-2026-109618-109619) or an LTS vendor build, and isolate the host behind a VPN or WAF.
• Interim controls (reduce exposure, do not replace the patch)
• If you cannot patch today, apply PHP’s stopgaps and consider isolating or taking the application offline:
  • CVE-2026-109618: set memory_limit=-1 where apps cannot override it (php_admin_value), set post_max_size to 8M (32M if uploads are required), and cap workers with a container or cgroup limit
  • CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker; on PHP 8.5 also set fatal_error_backtraces=0
  • Cloudflare managed WAF rules cover only traffic routed through Cloudflare and are temporary

Detect

• Hunt for compromise since October 20. No indicators of compromise are published, so look for behavior:
  • php-fpm, php-cgi, httpd or apache2 spawning sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget or ncWeb server commands such as whoami, id, uname -a, or strings with /dev/tcp/, fsockopen or mkfifo
  • New files in web roots, new cron jobs or scheduled tasks, new accounts; if found, isolate the host, keep logs, and rotate database and API credentials stored in app configs
• Do not run public PoC code from unvetted sources; it may carry malware.

Reach out to your Fortified VTM analyst for a manual check of PHP versions in your environment

Admin / Executive Recommendations

• Authorize an emergency change window for internet-facing PHP; patching should not wait for the normal cycle.
• Require written PHP patch attestations from hosting, portal, EHR add-on and other vendors, and log gaps in the risk register.
• Budget the retirement of PHP 8.1 and older now, and set a migration date ahead of the 8.2 security cutoff on December 31, 2026.
• Brief privacy and legal early so a HIPAA breach risk assessment can start immediately if a PHI-bearing server shows signs of compromise.

Sources

• PHP Security Announcement / GitHub Advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp): www.php.net/archive/2026.php  |  github.com/php/php-src/security/advisories
• PHP Supported Versions: www.php.net/supported-versions.php
• Tenable FAQ: www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
• Huntress Rapid Response: www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
• Brandefense Analysis: brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/
• NVD / CISA KEV (no entry or listing at publication): nvd.nist.gov/vuln/detail/CVE-2026-109618  |  www.cisa.gov/known-exploited-vulnerabilities-catalog

---

From Fortified Health Security

Fortified Health Security is committed to maturing your healthcare organization’s cybersecurity posture. We will monitor and update this bulletin as the situation progresses.

Fortified recommends applying patches and updates where possible and only after adequate testing in a development environment to ensure stability and compliance with organizational change management policies.

Should you have any questions about this threat or any other issue you are facing, please reach out to us. We’re here to help you on your cybersecurity journey.

Email: connect@fortifiedhealthsecurity.com    Phone: 615-600-4002