PHP has released emergency security updates for two critical vulnerabilities known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated attackers to execute code on affected servers. If you run PHP applications, identify affected deployments and update the runtime immediately. The fixes are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. See the PHP security advisory.
Affected versions
What’s happening
The vulnerabilities involve memory safety in PHP’s core engine. Errors during request processing can leave internal data in an invalid state or leave references to memory that has already been freed. Attackers can exploit those conditions to corrupt memory and execute code. The details and prerequisites vary by deployment, as described in PHP’s advisories for out-of-memory corruption and stale global state.
Wiz researchers demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla deployments, along with disclosure of sensitive process memory. These applications illustrate the impact: the flaws are in PHP itself, so secure application code alone does not remove the exposure.
Why this matters
The response is international. Before patches were released, CERT-EU urged organizations to prepare for immediate patching and said those unable to apply the fixes should consider taking affected websites offline. The Australian Cyber Security Centre also urged organizations to identify PHP systems, prepare to patch, and monitor for malicious activity, Reuters reported.
The potential consequences include data theft, website defacement, and full system compromise, hosting provider GoDaddy warned in the same report. For teams running PHP applications, the response may require emergency updates across hosting environments and container images, or temporary downtime while fixes are applied. PHP may arrive through a base image or hosting provider, so remediation can require coordination beyond the application team.
PHP identifies Apache deployments using mod_php as the highest risk, with a demonstrated attack that can trigger before application code runs. Other PHP web deployments also require attention. Updating a CMS or its plugins alone won’t replace a vulnerable PHP runtime. PHP’s advisory urges all PHP users to update immediately.
What to do
- Find affected deployments. Inventory PHP runtimes across containers, servers, and managed hosting. Prioritize services exposed to the internet.
- Apply the runtime fix. Upgrade to a patched release for your PHP branch, or install a distribution package with a confirmed backported fix. For older, unsupported branches, check your vendor’s guidance and plan a supported upgrade.
- Rebuild and redeploy. For containers, pull a patched base image or update PHP in the layer where it is installed, then rebuild, test, and replace running containers. Verify the deployed runtime includes the fix.
- Reduce exposure if patching is delayed. PHP says configuration changes offer only partial protection. Consider temporarily restricting access or taking affected services offline until patched. Reuters reported that EU cybersecurity officials advised organizations unable to apply the fixes to take affected websites offline.
- Put a WAF in front of exposed PHP services. Cloudflare deployed WAF rules for PHP2Shell on October 21, about nine hours before public disclosure. They are enabled by default on all plans with WAF, including Free, through the Cloudflare Managed Free Ruleset and the Cloudflare Managed Ruleset. Paid-plan customers should confirm the managed ruleset is in block mode. Cloudflare reports that attackers are already mutating payloads to evade the rules and recommends patching PHP even with the WAF in place.
Actions for Endor Labs customers
PHP2Shell affects the runtime rather than a Composer dependency, so Endor Labs customers can use container scanning to identify affected PHP versions in their images. Container reachability adds evidence about whether the affected OS package is used by the application at runtime. This helps prioritize the response; it does not establish whether a specific vulnerable function is exploitable. We recommend upgrading affected PHP installations regardless of reachability status.
When PHP comes from your base image, base image remediation compares your current image with a refreshed build, the next version, and the latest version. It shows which findings each option fixes or introduces, helping you choose an update.
Confirm the candidate includes the PHP fix, then rebuild, redeploy, and rescan.
Resources
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
