PHP patches two critical RCE flaws in PHP-CGI, CVE-2012-1823 and CVE-2012-2311

Key Takeaways

• PHP has released urgent security updates for two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell.
• The flaws, CVE-2026-109618 and CVE-2026-109619, affect PHP’s core engine, specifically its memory and state handling during web requests.
• Both vulnerabilities are rated 9.2 out of 10 on the CVSS 4.0 scale, indicating severe impact.
• Affected versions include PHP 8.2, 8.3, 8.4, and 8.5. Patched versions are available: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Immediate patching is strongly recommended for all administrators running affected PHP installations.

Emergency PHP Patches Address Critical RCE Vulnerabilities

The PHP project has issued emergency security updates to address two severe vulnerabilities that could enable unauthenticated attackers to execute arbitrary code on vulnerable web servers. These critical flaws, identified as CVE-2026-109618 and CVE-2026-109619, are collectively referred to as PHP2Shell and stem from weaknesses in how PHP manages memory and internal state during web request processing.

Both vulnerabilities carry a high severity rating of 9.2 out of 10 on the CVSS 4.0 scale. System administrators are urged to apply the available patches as quickly as possible to mitigate the significant risk posed by these issues.

Affected Versions and Patches

The security updates target PHP branches 8.2, 8.3, 8.4, and 8.5. Specifically, the patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Any versions prior to these specific patch levels within their respective branches are considered vulnerable.

For PHP 8.1 and older versions, official support from the PHP project has ceased. However, some Linux distributions and long-term support (LTS) providers may offer backported fixes. Organizations utilizing these older releases should consult their specific vendor for guidance or prioritize migrating to a currently supported PHP version.

Details of the PHP2Shell Vulnerabilities

According to the PHP2Shell research website, security researchers from Wiz Research, OpenAI Codex Security, and Calif were instrumental in discovering these two classes of critical vulnerabilities within PHP’s core engine.

The first flaw, CVE-2026-109618, arises from PHP’s previous method of handling out-of-memory (OOM) conditions. Historically, PHP used the longjmp() mechanism to abruptly exit an operation when memory was exhausted. This sudden termination could leave request data in a partially initialized or invalid state. Subsequent shutdown processes within PHP might then attempt to read or operate on this corrupted data, creating a pathway for remote code execution.

The official PHP advisory clarifies that certain types of multipart form data can trigger this memory issue. For instance, a request containing numerous headers within a part, or many empty file fields that still necessitate PHP metadata creation, can contribute to memory exhaustion. Nested field names further exacerbate the memory requirements for processing requests. The advisory also details a scenario where a multipart request lacking a usable content length can bypass initial size checks, allowing PHP to continue parsing data and eventually exhaust memory, even if the request appears to conform to configured limits.

The impact of CVE-2026-109618 is particularly pronounced for Apache environments utilizing mod_php. The PHP security advisory confirms that researchers successfully demonstrated unauthenticated code execution over HTTP against this setup, even with default PHP input and memory limits. The vulnerability can be exploited before an application’s own code begins execution. While source analysis indicates PHP-FPM’s susceptibility, a complete exploit for this server configuration was not demonstrated in the same manner.

The second vulnerability, CVE-2026-109619 involves the persistence of stale global state in long-running PHP worker processes. A worker might retain a reference to memory that PHP has already deallocated after a request has completed. If an error or other event disrupts the proper cleanup process, and a subsequent request encounters this lingering invalid state before PHP resets it, the worker could attempt to use freed memory. The advisory outlines confirmed exploitation paths related to fatal errors, error-reporting data, and session upload-progress handling. The specific exposure of a server to this vulnerability depends on its PHP setup, configuration, application code, and installed extensions.

This second flaw is significant because web workers often handle multiple requests sequentially. An improperly cleaned state from one request can inadvertently influence a later request processed by the same worker. The PHP advisory confirms scenarios involving mod_php and describes a PHP-FPM path that requires a specific application operation followed by a subsequent request to the same worker. While these details highlight the importance of server configuration, they do not diminish the urgency of applying the patches.

The fix for CVE-2026-109618 modifies PHP’s response to out-of-memory errors. Instead of abruptly terminating an operation and potentially exposing an incomplete request state, PHP now delays memory error handling until a safe point. A separate, stricter limit addresses more severe memory pressure. The corresponding fix for CVE-2026-109619 enhances the resetting of various request-related global states, reducing the likelihood of a worker carrying invalid memory references between requests.

These vulnerabilities impact diverse PHP web deployments, including those using Apache with mod_php and PHP-FPM. The scale of potential exposure underscores the severity: BleepingComputer reported that VirusTotal estimated over 5.1 million PHP hosts are publicly accessible online. This figure provides an estimate of potentially exposed systems, not a definitive count of vulnerable or compromised servers.

PHP Team Recommends Immediate Updates

The PHP project says updating to the patched releases is the only complete mitigation for these vulnerabilities. After upgrading, administrators must restart all PHP workers and verify that all web-facing pools and services are actively using the updated PHP version. It is crucial to note that updating only the command-line PHP package might not automatically update a separate PHP-FPM service or an Apache module.

If immediate patching is not feasible, temporary measures can reduce some risk, though they do not eliminate it. For CVE-2026-109618, the advisory suggests setting memory_limit=-1 as a primary configuration step, while cautioning that it doesn’t provide full protection. It also recommends limiting request sizes and multipart inputs at the frontend web server level. Administrators should avoid using RLIMIT_AS and RLIMIT_DATA, as these can trigger allocation failures on the vulnerable code path.

For the stale-state flaw (CVE-2026-109619), the advisory states there is no comprehensive general configuration workaround. On PHP 8.5, disabling fatal_error_backtraces can remove a producer of stale state in one confirmed scenario. Disabling session upload progress can also reduce exposure to a demonstrated session-related path. However, neither of these settings addresses all potential producers and consumers of stale state, so they should be considered only temporary risk reduction steps.

Reports of a public PHP2Shell testing tool and early exploitation attempts highlight the urgency of these upgrades. While these reports serve as a critical reminder, they are not a substitute for verifying your system’s actual PHP version and consulting official vendor guidance. The primary authoritative sources are the PHP advisory for CVE-2026-109618 and the related advisory for CVE-2026-109619.

What You Should Do

• Immediately Update PHP: Upgrade all affected PHP installations to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
• Restart Services: After updating, ensure all PHP workers, web-facing pools, and services (e.g., PHP-FPM, Apache mod_php) are properly restarted and are using the new, patched PHP binaries.
• Verify Installation: Confirm that the correct PHP version is active on your web servers. Updating the command-line PHP package alone may not update other services.
• Review Vendor Guidance: For unsupported PHP versions (8.1 and older), consult your Linux distribution or LTS provider for backported fixes or plan a migration to a supported version.
• Implement Temporary Mitigations (if immediate patching is impossible):
  • For CVE-2026-109618: Consider setting memory_limit=-1 (with caution), limit request sizes and multipart inputs at the frontend, and avoid RLIMIT_AS and RLIMIT_DATA.
  • For CVE-2026-109619: On PHP 8.5, disabling fatal_error_backtraces and session upload progress can reduce exposure, but these are not complete solutions.
• Reduce Exposure: Limit public exposure of vulnerable systems where patching cannot occur immediately.
• Monitor Logs: Review PHP and web server logs for any unusual activity or errors, though clean logs do not guarantee safety.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.