Today PHP published the emergency fix for two critical flaws that leaked ahead of schedule. The name the community gave the case already delivers the severity: PHP2Shell.
What is known, with sources: the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, score 9.2 Critical and allow unauthenticated remote code execution. And PHP runs on roughly seven in ten websites.
How the two flaws work
On the first path, memory-overflow handling interrupts PHP with internally half-initialized data, and request cleanup treats the invalid as valid. On the second, a request’s internal state outlives the memory sustaining it, and the next request on the same worker uses that state before reset.
The confirmed path goes through session.upload_progress: a legacy feature enabled by default that most developers forgot exists. Attack surface is, almost always, what has been enabled since installation.
The timeline is the lesson
Details leaked before the agreed date, the proof of concept went public within hours, and the emergency fix landed the day after the leak, with PHP exercising exactly the clause it had written into its notice: ship early if details go public or exploitation is active.
And the worst case is stated without hedging in the official notice: every installation serving web, with mod_php as the grave case, where a demonstrated exploit runs before any line of your code.
The market’s response, the same day
Cloudflare enabled edge protections, hosting vendors published their own rules, and European cybersecurity guidance recommended taking exposed sites that cannot be fixed offline. Hundreds of sites are already preemptively down.
It is the response the severity demands: unauthenticated RCE in a runtime serving seven in ten sites is not a monthly patch cycle, it is an emergency with preemptive downtime as a legitimate measure.
What to do today, in this order
- Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (the official notice says mitigation does not replace the fix).
- Confirm your vendor’s package: distributions received the patches in advance.
- If it does not fit today: disable the compromised session feature with a restart of all workers, and tighten memory and POST limits at the edge.
- Migrate branches if you are on PHP 8.1 or older: those no longer receive fixes from the project.
At Tech86, this was the day’s work for clients: inventorying what runs PHP on each host, applying the fix or mitigation, and documenting, in the same operation design that applied WordPress’s core patch last week.
Conclusion
PHP2Shell closes the week where runtimes became mass targets, and the takeaway is the inventory: the vulnerable feature was one most people forgot existed, enabled by default since forever.
Patch today, branch migration this week, and the default-enabled feature inventory on the permanent backlog. The bulletin informs; the inventory protects.