PHP rushes out fixes for "PHP2Shell", two flaws that can take over a web server with one request
If your website runs on PHP, which covers WordPress, Drupal, Joomla and Laravel, update PHP itself today. The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 this afternoon, at about 5 PM Nairobi time, fixing two vulnerabilities each rated 9.2 out of 10 (CVSS v4.0). In PHP's words, CVE-2026-109618 lets out-of-memory handling interrupt PHP while request data is half set up, so cleanup then treats bad data as good; CVE-2026-109619 lets internal state from one request outlive its memory, so the next request on the same worker can use it. The bugs sit in PHP, not in your code, so a well-written app is still exposed. Every setup that serves web pages is affected, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed; PHP rates mod_php the highest risk, with a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. Researchers also showed the flaws can leak a worker's memory, and with it passwords, tokens and keys from other visitors' requests. The bugs were found by Wiz Research, Calif and OpenAI's Codex Security team, who say AI models helped turn them into working exploits; Wiz reported them to PHP on 24 August, and the code had been in PHP for more than a decade, in releases going back to 5.4. Details leaked on Hacker News on Tuesday, two days before the planned disclosure, so PHP brought the release forward. Cloudflare said it saw early exploit attempts and added firewall rules, while watchTowr had seen no attacks in the wild by this morning; the Netherlands took DigiD and other government sites offline as a precaution. What to do: update the PHP runtime and restart Apache, PHP-FPM and any long-running workers; on Linux distribution packages, check the changelog for the two CVE numbers rather than the version string; on shared hosting, check your PHP version in your control panel and ask your host whether it has patched. PHP 8.1 and older get no official updates, though PHP has published source fixes for 7.4, 8.0 and 8.1. Setting session.upload_progress.enabled=0 and keeping post_max_size low reduce the risk, but PHP says such steps "do not make an installation safe".
Sources: PHP · The Hacker News · Wiz · Qualys
