PHP2Shell: two critical PHP flaws require immediate patching

Two critical vulnerabilities in the PHP runtime have turned an ordinary patch cycle into an urgent incident-response task. CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, can allow an unauthenticated attacker to execute code on a vulnerable web server before the application itself has a chance to protect the request.

The PHP security team’s advisory rates both vulnerabilities at CVSS 9.2 and tells users to update immediately. A joint European statement from ENISA, CERT-EU, Europol EC3, the European Commission and the CSIRTs Network gives the same advice: identify PHP applications, coordinate with hosting providers and prioritise internet-facing systems.

This is a PHP runtime problem, not a defect in WordPress, Drupal, Joomla or a particular application plugin. Updating a CMS while leaving the underlying PHP runtime vulnerable does not resolve it.

What the vulnerabilities do

Both flaws involve PHP’s internal handling of memory across web requests.

CVE-2026-109618 involves out-of-memory error handling. PHP can interrupt a request while internal request data is only partly initialised. Later cleanup may interpret invalid data as though it were valid, creating a path to memory corruption and remote code execution.

CVE-2026-109619 involves stale global state. Internal state can continue pointing to request memory after that memory has been freed. A later request may use that stale reference and again reach memory corruption and remote code execution.

The practical consequence matters more than the implementation detail: an attacker may be able to compromise a server with a crafted request and without logging in. The PHP project says the risk is highest for Apache mod_php, where exploitation has been demonstrated before application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments serving web requests are also in scope.

Which versions are safe

The fixed releases are:

• PHP 8.5.12 or later
• PHP 8.4.27 or later
• PHP 8.3.36 or later
• PHP 8.2.35 or later

PHP 8.1 and older branches are affected but have reached end of life and do not receive fixes. Those systems need migration to a supported branch, not another attempt to extend an obsolete runtime.

The NHS England cyber alert provides a concise affected-version list and warns that proof-of-concept exploitation has been demonstrated in products integrating PHP. The PHP project states that there is no complete configuration workaround: installing a fixed release is the only complete remediation.

What teams should do now

Start with an inventory. Search production servers, containers, managed hosting accounts and forgotten administrative tools for PHP runtimes. Do not assume the version reported by a developer’s terminal is the version actually serving traffic. Different pools, virtual hosts and command-line environments can use different binaries.

Then work through this sequence:

1. Patch internet-facing PHP first. Upgrade to one of the fixed releases and restart the relevant web server or PHP-FPM workers so old processes do not remain in memory.
2. Verify the runtime from the serving environment. Confirm the version used by each live application, then remove any temporary version pages that reveal configuration details.
3. Check managed services. Ask hosting and platform providers which runtime is active, when it was patched and whether customers must select a new version themselves.
4. Hunt for compromise. Review web-server, application, process and outbound-network telemetry from the period before patching. Look for unusual child processes, new files, unexpected scheduled jobs, new users, credential access and unexplained outbound connections.
5. Rotate exposed secrets when warranted. If evidence suggests exploitation—or if reliable evidence is unavailable on a high-value system—treat application secrets, database credentials and signing keys accessible to the PHP process as potentially exposed.
6. Record the response. Regulated organisations should retain the asset list, patch evidence, exposure window, investigation results and risk acceptance for any system that could not be patched immediately.

If a vulnerable system cannot be updated now, assess whether it should be taken offline until it can be fixed. A web application firewall rule may reduce some attack traffic, but it is not a substitute for correcting memory-safety flaws inside the runtime.

What this means for globalsoftware.ai

Globalsoftware.ai does not use PHP. The site is built with Next.js and React, runs on Node.js through Netlify, and has no PHP runtime or PHP dependencies in its repository. These two vulnerabilities therefore do not directly affect this site.

That does not make the story irrelevant. Suppliers, client portals, marketing sites and older internal applications often run PHP even when a company’s main product does not. The right question is not “Do our developers write PHP?” but “Does any internet-facing service in our estate or supply chain execute PHP?”

The broader lesson is familiar: runtime inventory and supported-version policies are security controls. Teams that can answer which versions they run, where they run and who owns the upgrade can turn a critical disclosure into a routine emergency change. Teams that cannot answer those questions must first discover their infrastructure while the patch clock is already running.

For help reviewing exposure, patch evidence or the wider vulnerability-management process, see our security consulting service.