PHP2Shell: Immediate Mitigation Steps for Unpatched Systems

The PHP Project released patches for two critical bugs, CVE-2026-109618 and CVE-2026-109619, on Wednesday. The flaws enable unauthenticated remote code execution (RCE) and memory disclosure directly within the PHP interpreter, independent of the application layer. Attackers can read process memory or execute arbitrary code on any server running an affected PHP build.

How the Vulnerabilities Work

Both CVEs stem from improper bounds checking in PHP’s handling of certain internal data structures. CVE-2026-109618 allows an attacker to trigger a buffer overflow that leaks memory contents. CVE-2026-109619 expands that overflow into a full RCE vector by exploiting a race condition in the Zend Engine’s opcode cache. The combination of these bugs creates a two-step exploit chain that is difficult to construct manually but was demonstrated by the PHP Project’s own proof-of-concept code.

Patch Status and Deployment Gap

The patches are available for all supported PHP 8.x and 7.4 releases. Despite the urgency, a survey of public repositories shows that less than 40% of WordPress sites had applied the update within 48 hours. The rapid exploitation window—four days before the public disclosure—suggests that many administrators are still running legacy PHP versions or have not yet applied the security update.

PHP Project’s Interim Mitigation

While the patches fix the underlying bugs, the PHP Project issued an advisory urging organizations to disable the session upload progress feature. The specific instruction is to set session.upload_progress.enabled=0 in php.ini. This setting prevents the upload progress handler from initializing the opcode cache in a state that the CVE exploits rely on, effectively blocking the attack chain until the patch is applied.

Attack Landscape Post-Patch

Amazon Threat Intelligence reported that exploitation attempts began four days before the vulnerabilities were made public. Proof-of-concept code appeared hours after the disclosure, and a threat actor linked to the P2P2Shell chain is reportedly deploying a Mirai-style botnet. Cloudflare’s network has logged millions of exploitation attempts, indicating that attackers are actively scanning for unpatched PHP instances.

Operational Impact for Web Administrators

Web hosts and content managers must verify that their PHP installations are at least at the patched version. A quick check can be performed by running php -v on the server and comparing the output to the latest release notes. If an upgrade is not immediately feasible, disabling session upload progress is a low-overhead mitigation that can be applied in minutes.

What Happens If the Mitigation Is Ignored

Failing to disable session.upload_progress.enabled leaves the opcode cache in a vulnerable state. An attacker who can upload a crafted file to a PHP script that triggers the cache will be able to execute arbitrary code. The memory disclosure flaw can also leak sensitive data such as database credentials if the process memory contains such strings.

Monitoring and Detection

Administrators should monitor web server logs for repeated 404 or 500 errors that may indicate an exploitation attempt. Cloudflare and other CDN providers can surface anomalous traffic patterns; integrating these alerts with a SIEM can surface potential RCE attempts early.

Next Steps for PHP Users

  1. Verify PHP version and apply the latest patch from php.net.
  2. If an upgrade is delayed, edit php.ini to set session.upload_progress.enabled=0 and restart the web server.
  3. Enable logging of upload progress events to detect attempts to trigger the opcode cache.
  4. Deploy a web application firewall rule that blocks known exploit payload signatures.
  5. Keep an eye on the PHP Project’s advisory feed for any follow-up patches or additional mitigations.

Implications for Enterprise Deployments

Large-scale hosting providers that ship pre-configured PHP images must audit their base images for the presence of the vulnerable opcode cache state. Containers that expose the PHP binary without disabling session upload progress inherit the same risk profile. Enterprises that rely on legacy PHP 7.0 or 7.1 should prioritize a migration plan, as those releases are no longer supported and will not receive future security updates.

What to Watch Next

The PHP Project has not announced a follow-up advisory, but the rapid exploitation window suggests that attackers may pivot to alternative vectors if the current mitigations are bypassed. Security teams should stay alert for new signatures that target the Zend Engine’s internal structures. Monitoring the CVE database for related identifiers and subscribing to the PHP Project’s mailing list will provide the earliest notice of any emerging threats.

Related coverage

Explore more on this topic