PHP2Shell (CVE-2026-109618): A UK Executive Briefing

CVE-2026-109618 and its sibling, CVE-2026-109619, form the pair dubbed PHP2Shell: two critical flaws in the PHP core that allow code execution on your server without any authentication. If your UK business operates a website, e-commerce store, Moodle instance, or webhook using PHP, the core business question is: how much of your revenue relies on an interpreter that became vulnerable last week? This guide translates the incident for decision-makers.

TL;DR

• CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state between requests) have a CVSS 4.0 score of 9.2 and require no authentication.
• The identifiers were leaked on 20 October 2026; the patch was released on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• PHP 7.4 to 8.1 only have minimal source code backports. PHP 5.4 to 7.3 have no patch at all.
• Configuration adjustments (memory_limit=-1, session.upload_progress.enabled=0) reduce risk, but do not resolve it. Only updating resolves it.
• On 23 October, an additional alert, CVE-2026-115560, was issued for an unlikely vector.

What is CVE-2026-109618 and Why It's a Boardroom Issue for UK Businesses

In management terms: CVE-2026-109618 is a backdoor in the engine that runs your system, not in your system itself. It doesn't matter if your ERP is impeccable or if WordPress and Moodle are up to date. The flaw resides in the PHP interpreter, the layer beneath everything.

According to the official PHP advisory, CVE-2026-109618 occurs when out-of-memory (OOM) handling interrupts PHP while internal request data is still incomplete. During cleanup, PHP treats this garbage as valid. An attacker who deliberately triggers this can corrupt memory and, from there, execute commands.

CVE-2026-109619 is another path to the same outcome: an internal request state survives after its memory has been freed (use-after-free), and the next request in the same process uses this leftover data. PHP also confirms memory leakage.

Why the 9.2 Score Matters More Than Just the Number

High scores appear every month. What puts PHP2Shell on a different level are three factors:

• No authentication required: Just an HTTP request, no password or session needed.
• Before your code runs: With Apache and mod_php, PHP states there's a demonstrated exploit where the request triggers the attack before any application code executes.
• Massive installed base: Tenable cites W3Techs: PHP runs on 69.3% of websites where the server-side language is known.

A point of rigour: the leaked identifiers initially carried a score of 10.0, later corrected to 9.2 by the PHP Foundation, according to Tenable. Any vendor still referring to a 'score of 10' is relying on outdated information.

Timeline: From Leak to the 23 October Additional Alert

The dates for CVE-2026-109618 define how long your business has been exposed and what your supplier should have done on each given day.

Date	What happened	Source
17 October 2026	Amazon Threat Intelligence records attempted exploitation on its MadPot honeypot network, four days before disclosure	Tenable
20 October 2026	Identifiers leaked; PHP brought forward the release from 22 to 21 October and published a pre-advisory	Tenable, watchTowr, Huntress
21 October 2026	8.5.12, 8.4.27, 8.3.36, and 8.2.35 released; CISA issues alert; watchTowr observes exploitation on its sensors	php.net, CISA, watchTowr
23 October 2026	Unit 42 updates its bulletin; PHP publishes an informational alert for CVE-2026-115560	Unit 42, php.net

Unit 42, from Palo Alto Networks, reported that Cortex Xpanse identified over 22.6 million potentially vulnerable exposed instances. This is an estimate of exposed surface area, not compromised servers. Other measurements cited by Tenable ranged between 1.3 and 1.9 million hosts. The order of magnitude changes; the conclusion does not.

Regarding actual attacks, sources differ. Huntress had not observed exploitation among its partners by 20 October. watchTowr reported exploitation on its honeypots since 21 October. By 23 October, the flaws were not yet in CISA's KEV catalogue. For decision-makers: the exploit exists, has been demonstrated, and is already being tested. Waiting for 'confirmed mass attack' is waiting too late.

Who is Affected by CVE-2026-109618 in PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed

PHP was direct: every installation serving web requests is at risk. The official list cites five ways to run PHP, and knowing which your business uses changes the urgency and type of work required.

Risk Map by Execution Method

Execution Method	Commonly found in	Risk Assessment
Apache + mod_php	Older servers, legacy cPanel, 'hand-built' VPS	Highest risk according to PHP: exploit demonstrated before application code runs
PHP-FPM	Nginx, modern managed hosting, Moodle and Laravel in production	Affected; PHP confirmed command execution via upload processing
php-cgi	Legacy environments, some Windows panels	Treat as exposed
FrankenPHP	Modern stacks, persistent workers, containers	Affected; long-running workers require a restart after patching
LiteSpeed (LSAPI)	Shared hosting and commercial panels	Affected; depends on the vendor releasing the package

If you don't know your line in this table, that's the first finding of this incident. In over 15 years of operating PHP servers, Moodle instances, and integrations with the official WhatsApp API, I see inventory as the weakest link, not the patch.

What Almost No One Remembers to Check

Datadog warns that the command-line PHP and the web-serving PHP might have different versions. The team runs php -v, sees a new version, and concludes everything is fine, while FPM continues to use the old binary.

Also consider equipment you might not even realise runs PHP: network appliance manufacturers have published their own advisories about PHP2Shell. Firewall panels, NAS devices, and camera systems should all be included in your inventory.

Patched Versions of CVE-2026-109618 and the Real Problem: Legacy PHP

The most costly decision lies here. Official patches are available for four branches:

Branch	Patched version	Status
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Supported
8.2	8.2.35	Security only; end-of-life on 31 December 2026
7.4, 8.0, 8.1	No official release	Only minimal source code backport or distribution/LTS vendor package
5.4 to 7.3	None	No patch from the PHP project

Note PHP 8.2: upgrading to 8.2.35 resolves CVE-2026-109618 today, but this branch reaches end-of-life on 31 December 2026, according to php.net. It's a correct emergency measure, but not a long-term plan.

The PHP 7.x Dilemma

Systems stuck on PHP 7.x are common: a bespoke ERP from ten years ago, a Moodle instance never migrated, or an e-commerce store with a plugin that 'breaks if you touch it'. The PHP project has published minimal backports for 7.4, 8.0, and 8.1 on GitHub for those who compile from source code. Linux distributions and extended support vendors have also released patched packages, sometimes without changing the version number, which can confuse scanners and auditors.

In practice, managers have three paths for legacy PHP:

1. Patched distribution package, where available: the quickest and safest option.
2. Compile with the backport: requires expertise in compiling and maintaining PHP. This creates new technical debt.
3. Migrate to a newer version: the correct path, but rarely achievable within a week.

For PHP 5.4 to 7.3, neither option 1 nor 2 is available. The only remaining choices are to isolate the system from the internet or migrate.

Mitigations: What Reduces Risk and What Provides a False Sense of Security

PHP has published configuration adjustments against CVE-2026-109618 and CVE-2026-109619 for those unable to update immediately, and explicitly stated that these do not replace updating. Use them as a bridge, never as a destination.

For CVE-2026-109618

• memory_limit = -1 so that the application cannot overwrite it. In PHP-FPM, this is done with php_admin_value[memory_limit] = -1 in the pool.
• post_max_size low: 8M without upload, 32M with upload, with upload_max_filesize below it.
• Limits on size, number of fields, parts, and depth on the web server or proxy.
• Memory limit per container or cgroup that only terminates the affected process.

For CVE-2026-109619

• session.upload_progress.enabled = 0 in php.ini or the FPM pool, and restart all workers. PHP warns: do not rely on ini_set() or .user.ini.
• In PHP 8.5, also set fatal_error_backtraces = 0.
• Hiding errors with @ does not help.

Pitfalls That Bring Down Servers

Setting memory_limit=-1 without a container limit exchanges one risk for another: a poorly written script can consume all RAM and bring down the database with it. PHP also advises against RLIMIT_AS and RLIMIT_DATA, which can precisely trigger the allocation failure that the exploit uses.

A WAF helps, but it has limitations. Cloudflare published rules for known vectors and called them a palliative, and they only protect traffic passing through it: the server's direct IP remains open if the firewall isn't closed. Finally, disabling session.upload_progress breaks upload progress bars. Inform your product team beforehand.

CVE-2026-115560: The 23 October Alert and Why It Doesn't Change Priority

Two days after the patch, PHP published an informational advisory about CVE-2026-115560, another flaw related to session and upload progress, which even affects already patched versions. The good news: the vector is unlikely. According to php.net, it only applies if the application configures session.serialize_handler as php_binary or php_serialize, switches to php at runtime with ini_set() before session_start(), and keeps upload progress enabled.

The fix will come in the next regular release. Until then, the same mitigation applies: session.upload_progress.enabled=0. The Hacker News covered the alert.

CVE-2026-115560 is not a reason to delay patching CVE-2026-109618, and those who have already disabled upload progress as a mitigation have gained protection for both.

Business Decisions: What to Ask Your Team or Supplier This Week

A manager's role isn't to compile PHP; it's to ask the right questions and demand deadlines. This is the list I would take to the meeting.

The Seven Questions

1. Inventory: Which servers, containers, and appliances run PHP? Does this include the corporate website your agency built in 2019?
2. Actual web version: Which PHP version serves web requests, not the one in the terminal?
3. Patch status: Are we already on 8.5.12, 8.4.27, 8.3.36, or 8.2.35? Have the workers been restarted?
4. Docker images: Have the images been rebuilt and redeployed, or is the old container still running?
5. Legacy: What is on PHP 8.1 or below, and which of the three paths will we follow for each system?
6. Indicators: Has anyone checked error logs for "Unknown on line 0", Apache segmentation faults, and shells spawned by the web process since 17 October?
7. Responsibility and deadline: Who is accountable for each item and by when?

When to Update Now and When Not to Rush Updates

Update everything on PHP 8.2 to 8.5 exposed to the internet on the same day: these are patch versions, with a low risk of regression.

Do not jump from PHP 7.4 to 8.4 on a Friday night out of panic: a branch change can break plugins and legacy code. First, isolate (VPN or IP whitelist), apply a patched vendor package if available, and plan the migration with testing.

Do not trust 'my hosting has already patched CVE-2026-109618' without proof. Request the version and restart date in writing.

Where the Incident Might Be Hiding

Webhooks are a classic blind spot: the endpoint that receives events from the official WhatsApp API or payment gateway is public by definition. If it runs on PHP, it goes to the top of the list.

Staging environments are also often overlooked: many businesses protect production but forget about staging with the same copied database and old PHP. To close all doors, our Linux server hardening checklist covers what comes after the patch.

Costs: Acting Now Versus Acting Later

I won't invent an average incident cost; it varies too much by size and sector. But we can compare the types of costs associated with CVE-2026-109618, which is what matters for prioritisation.

Acting now costs technical team hours: inventory, updating, restarting, log review. For PHP 8.2+, this is typically a matter of days. For 7.x, isolation and a migration project are added.

Acting later costs what any remote code execution costs: a compromised server with web process privileges, exposed database and credentials, potential ransomware, and, if personal data is involved, obligations under UK GDPR and the Data Protection Act 2018. Our post on data breach response plans shows who to notify and within what timeframe.

There's also a hidden cost: version technical debt. A business on PHP 8.3 resolves CVE-2026-109618 within a maintenance window. A business on PHP 7.2 discovers there's no patch and requires a project. For small businesses without a security team, prioritisation follows the logic of our ransomware for small businesses: what to secure first guide.

If your team lacks the capacity to separate the urgent from the important, that's where an independent technical consultancy pays for itself: an external expert maps, prioritises, and delivers a plan of attack.

How Agathas Web Can Help UK Businesses

Agathas Web has been operating PHP servers since 2008, including managed hosting, Moodle in production, PHP and Laravel systems, and the official WhatsApp API. Through Agathas Web's consultancy services, the work begins where advisories leave off: by examining your specific environment.

What's Included

• Exposure inventory: servers, containers, staging environments, webhooks, and appliances running PHP, including the actual version serving the web.
• System-by-system decision matrix: immediate update, apply vendor-patched package, compile backport, isolate, or migrate, with the cost and risk of each option.
• Secure mitigation while the patch is pending, without crashing the server due to insufficient RAM.
• Search for indicators in logs and processes since 17 October.
• Migration plan for anything on PHP 8.2 or below, before the end-of-life on 31 December 2026.

How It Works in Practice

The work is led by a partner/CTO, not a junior. For CVE-2026-109618, the scope is concise: diagnosis, priorities, and urgent execution. If it makes sense to go further, it expands into a full technical diagnosis over 4 to 6 weeks, with an executive report and action plan, or fractional technical leadership (CTO on demand).

How to Engage Our Services

Through our technology and security consultancy page, describe your scenario (how many systems, what hosting, which PHP versions), and we will respond with a proposed approach and scope. Recommendations are derived from the diagnosis, not from a pre-packaged solution.

Conclusion: CVE-2026-109618 is a Governance Test, Not Just a Patch

CVE-2026-109618 will be patched on most servers in the coming weeks. The question remains: how long did it take your business to ascertain where PHP runs, which version, and who is responsible for it?

Summary for the board:

• Update everything on PHP 8.2 to 8.5 today and restart workers.
• Treat mitigations as a bridge, never a solution.
• For PHP 8.1 or earlier, isolate first and decide the path system by system.
• Plan to move off PHP 8.2 before 31 December 2026.
• Review logs for indicators since 17 October.

If you require an external perspective to conduct this inventory and formulate a plan of attack, Agathas Web's consultancy services are designed for exactly this scenario.