Critical PHP RCE (php2shell) CVSS 9.2

[Anthro]

Received this lovely comms from our SOC

Situation​

Two critical remote-code-execution vulnerabilities in PHP (CVE-2026-109618 / CVE-2026-109619, CVSS v4 9.2) affect every PHP installation. PHP's fix is scheduled for today, 16:00 Berlin time or earlier, and mass exploitation is expected within minutes after that release.

The rule for this incident is simple: patch immediately or shut down. Any device running PHP you cannot patch immediately after the fix is released must be taken offline or isolated from the internet until a fix is available. That explicitly includes servers on PHP or older - they are end-of-life and will probably receive no official fix; only a provider backport or a migration helps there.

God Speed, friends.. may the patching be smooth sailing...

What to do before and after the release of the patch?​

The situation is currently very dynamic, as no patch is available yet. We have published a post with the current situation and mitigations which needs to be applied as soon as possible..

Details​

CVE: CVE-2026-109618 / CVE-2026-109619
Severity: Critical
CVSS: 9.2

Summary: Two critical remote-code-execution vulnerabilities in PHP (CVE-2026-109618 / CVE-2026-109619, CVSS v4 9.2) affect every PHP installation.

Impact: Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code, compromising the affected system.

Remediation: Currently, no patch is available. Apply the mitigations mentioned in the post linked above as soon as possible.

 

[Adenoid Hynkel]

The mitigation apparently does not work, according to someone on the official PHP team.

Gina Peter Banyard (@[email protected])

@[email protected] The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

phpc.social

 

[gregmcc]

Button down the hatches it's going to be a bumpy ride.

• Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 mediate this vulnerability. Patches have not been made available for PHP 5 or 7.

Bugger still running a old 7. Time to upgrade

 

[gregmcc]

If you aren't behind a WAF that's going to protect you or haven't patched yet you are going to be in a world of pain.

Cloudflare deploys protections against php2shell vulnerability

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

blog.cloudflare.com

Cloudflare Detects Millions of Exploitation Attempts After Critical PHP Vulnerability Disclosure

https://ua.news/en/technologies/cloudflare-zafiksuvala-milioni-sprob-ekspluatatsiyi-vrazlivostei-php-channel-newsasia

 

[Benedict A55h0le not]

I like this

 

[Anthro]

There are whispers that the patch is also ..vulnerable...

 

[ActivateD]

There are whispers that the patch is also ..vulnerable...

It is vulnerable was able bypass the patch