Critical PHP Flaws Expose Millions of Web Services to Remote Code Execution

brown wooden door in dark room — Roman Denisenko / Unsplash

Two critical vulnerabilities in the PHP scripting language, collectively known as PHP2Shell, have been disclosed, creating urgent security risks for organizations relying on web applications. These defects allow unauthenticated attackers to execute code on affected servers, potentially exposing confidential information or interrupting services. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated critical with a CVSS 4.0 score of 9.2. CVE-2026-109618 involves memory corruption during error handling of memory shortage, while CVE-2026-109619 relates to stale global state where PHP workers access freed memory from previous requests. Both issues can lead to remote code execution, enabling attackers to run malicious commands, compromise applications, or disrupt services.

The scale of potential exposure is significant, with internet scans identifying approximately 36.7 million internet-facing services running potentially vulnerable PHP versions as of October 22, 2026. This figure represents services rather than unique servers or organizations and may include installations already patched via vendor backports. The PHP project has identified that all PHP installations handling web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Researchers have demonstrated attacks that execute before application code, making mod_php the highest risk, as application authentication may not prevent exploitation. Successful code execution runs with the permissions of the affected process, potentially exposing application secrets, credentials, or connected resources.

The PHP project released security updates on October 21, 2026, with fixed upstream versions including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations using distribution or application vendor packages must verify which packages include the fixes, as vendors may backport security changes without adopting upstream version numbers. PHP versions prior to 8.1 no longer receive standard security releases from the PHP project, requiring organizations to check for vendor-supported backports or upgrades. The PHP project also provides limited source backports for selected older branches, though these require specialized build and deployment knowledge.

Remediation requires coordination between security, application, and infrastructure teams, as underlying software updates may necessitate compatibility testing, maintenance windows, and service restarts. Organizations should identify affected deployments using external attack surface management, record active PHP versions and patch status, and include containers, managed hosting, and third-party applications. Testing and deploying updates involves verifying critical workflows, deploying patched runtimes, and restarting affected workers. Temporary mitigations include enabling virtual patches, intrusion prevention systems, and web application firewalls, while moving non-essential systems behind VPNs or SASE. Organizations should also investigate potential breaches by reviewing suspicious web requests, unexpected crashes, and anomalous outbound connections, noting that installing patches does not remove attackers who have already gained access.

FortiGuard Labs has released virtual patches for PHP2Shell through its OT virtual patch feed in package 37.316, followed by IPS signatures for additional detection. These protections use network inspection to block known exploitation techniques before they reach vulnerable systems, reducing exposure without modifying application code. Administrators must update FortiGate signature databases, associate IPS sensors with relevant policies, and ensure block actions and logging are enabled. For the OT virtual patch feed, an active FortiGuard OT security service subscription is required, as it is not included in the standard Unified Threat Protection bundle. These measures support PHP remediation efforts while organizations continue to deploy and verify permanent fixes.