CVE-2026-109618 (PHP2Shell): A Guide for US Business Leaders & CTOs

CVE-2026-109618 and its sibling, CVE-2026-109619, form the pair dubbed PHP2Shell: two core PHP vulnerabilities that allow code execution on the server without any authentication. If your business uses PHP for its website, e-commerce store, Moodle instance, or webhooks, the business question is: how much of your revenue relies on an interpreter that became vulnerable last week? This guide translates the incident for decision-makers.

TL;DR

• CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state between requests) have a CVSS 4.0 score of 9.2 and require no authentication.
• The identifiers leaked on 10/20/2026; the fix was released on 10/21/2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• PHP 7.4 to 8.1 only have minimal source code backports. PHP 5.4 to 7.3 have no official fixes.
• Configuration adjustments (memory_limit=-1, session.upload_progress.enabled=0) reduce risk but do not resolve the issue. Only updating fixes it.
• On 10/23, an additional alert, CVE-2026-115560, was released for an unlikely vector.

What is CVE-2026-109618 and Why It's a C-suite Priority

In management terms: CVE-2026-109618 is a backdoor in the engine that runs your system, not in your system itself. It doesn't matter if your ERP is impeccable or if WordPress and Moodle are up to date. The flaw resides in the PHP interpreter, the layer beneath everything.

According to the official PHP advisory, CVE-2026-109618 occurs when out-of-memory (OOM) handling interrupts PHP while internal request data is still incomplete. During cleanup, PHP treats this garbage as valid. An attacker who intentionally triggers this can corrupt memory and, from there, execute commands.

CVE-2026-109619 is another path to the same destination: an internal request state survives after its memory has been freed (use-after-free), and the next request in the same process uses this leftover data. PHP also confirms memory leakage.

Why the 9.2 Matters More Than Just the Number

High scores appear every month. What elevates PHP2Shell to another level are three factors:

• No Authentication: just an HTTP request, no password or session required.
• Before Your Code Runs: with Apache and mod_php, PHP states there's a demonstrated exploit where the request triggers the attack before any application code executes.
• Massive Installed Base: Tenable cites W3Techs: PHP runs on 69.3% of websites where the server-side language is known.

A point of accuracy: the leaked identifiers initially showed a score of 10.0, later corrected to 9.2 by the PHP Foundation, according to Tenable. Any vendor still referencing a "score of 10" is citing outdated information.

Timeline: From Leak to 10/23 Extra Alert

The dates for CVE-2026-109618 define when your company became exposed and what your vendor should have done each day.

Date	Event	Source
10/17/2026	Amazon Threat Intelligence records attempted exploitation on its MadPot honeypot network, four days before disclosure	Tenable
10/20/2026	Identifiers leak; PHP moves release from 10/22 to 10/21 and publishes pre-advisory	Tenable, watchTowr, Huntress
10/21/2026	8.5.12, 8.4.27, 8.3.36, and 8.2.35 are released; CISA issues alert; watchTowr observes exploitation on its sensors	php.net, CISA, watchTowr
10/23/2026	Unit 42 updates bulletin; PHP publishes informational alert for CVE-2026-115560	Unit 42, php.net

Unit 42, from Palo Alto Networks, reported that Cortex Xpanse identified over 22.6 million potentially vulnerable exposed instances. This is an estimate of exposed surface area, not compromised servers. Other measurements cited by Tenable ranged between 1.3 and 1.9 million hosts. The order of magnitude changes; the conclusion does not.

Regarding actual attacks, sources diverge. Huntress had not observed exploitation among its partners by 10/20. watchTowr reported exploitation on its honeypots since 10/21. As of 10/23, the vulnerabilities were not yet in CISA's KEV catalog. For decision-makers: the exploit exists, has been demonstrated, and is already being tested. Waiting for "confirmed mass attack" is waiting too long.

Who is Affected by CVE-2026-109618 in PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed

PHP was direct: every installation serving web requests is at risk. The official list cites five ways to run PHP, and knowing which one your company uses changes the urgency and type of work required.

Risk Map by Execution Method

Execution Method	Commonly Found In	Risk Assessment
Apache + mod_php	Older servers, legacy cPanel, "hand-built" VPS	Highest risk according to PHP: exploit demonstrated before application code
PHP-FPM	Nginx, modern managed hosting, Moodle and Laravel in production	Affected; PHP confirmed command execution via upload processing
php-cgi	Legacy environments, some Windows control panels	Treat as exposed
FrankenPHP	Modern stacks, persistent workers, containers	Affected; long-running workers require restart after patch
LiteSpeed (LSAPI)	Shared hosting and commercial control panels	Affected; depends on vendor releasing the package

If you don't know your row in this table, that's the first finding of this incident. In over 15 years operating PHP servers, Moodle, and integrations with the official WhatsApp API, I see inventory as the weakest link, not the patch.

What Almost Nobody Remembers to Check

Datadog warns that command-line PHP and web-serving PHP might have different versions. The team runs php -v, sees a new version, and concludes everything is fine, while FPM continues to use the old binary.

Also consider equipment you might not even know runs PHP: network appliance manufacturers have published their own advisories about PHP2Shell. Firewall panels, NAS, and camera systems should be included in your inventory.

Fixed Versions of CVE-2026-109618 and the Real Problem: Legacy PHP

The most costly decision lies here. Official fixes are available for four branches:

Branch	Fixed Version	Status
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Supported
8.2	8.2.35	Security only; End-of-Life on 12/31/2026
7.4, 8.0, 8.1	No official release	Only minimal source code backport or distribution/LTS vendor package
5.4 to 7.3	None	No fix from PHP project

Note 8.2: upgrading to 8.2.35 resolves CVE-2026-109618 today, but the branch reaches End-of-Life on 12/31/2026, according to php.net. This is a correct emergency measure, not a long-term plan.

The PHP 7.x Dilemma

Systems stuck on PHP 7.x are common: a ten-year-old custom ERP, Moodle never migrated, an e-commerce store with a plugin that "breaks if you touch it." The PHP project published minimal backports for 7.4, 8.0, and 8.1 on GitHub for those who compile from source. Linux distributions and extended support vendors also released patched packages, sometimes without changing the version number, which can confuse scanners and audits.

In practice, managers have three paths for legacy PHP:

1. Distribution's patched package, when available: the fastest and safest.
2. Compile with the backport: requires expertise in compiling and maintaining PHP. This creates new technical debt.
3. Migrate to a newer version: the correct path, which rarely fits into a single week.

For PHP 5.4 to 7.3, neither path 1 nor 2 is available. The remaining options are to isolate the system from the internet or migrate.

Mitigations: What Reduces Risk and What Provides a False Sense of Security

PHP published configuration adjustments against CVE-2026-109618 and CVE-2026-109619 for those unable to update immediately, and emphasized that these do not replace the update. Use them as a bridge, never as a destination.

For CVE-2026-109618

• memory_limit = -1 so the application cannot overwrite. In PHP-FPM, this is done with php_admin_value[memory_limit] = -1 in the pool.
• Low post_max_size: 8M without upload, 32M with upload, with upload_max_filesize below it.
• Limits on size, number of fields, parts, and depth in the web server or proxy.
• Memory limits per container or cgroup that only terminate the affected process.

For CVE-2026-109619

• session.upload_progress.enabled = 0 in php.ini or the FPM pool, and restart all workers. PHP warns: do not rely on ini_set() or .user.ini.
• In PHP 8.5, also fatal_error_backtraces = 0.
• Hiding errors with @ does not help.

Pitfalls That Crash Servers

memory_limit=-1 without a container limit exchanges one risk for another: a poorly written script consumes all RAM and crashes the database along with it. And PHP advises against RLIMIT_AS and RLIMIT_DATA, which can precisely trigger the allocation failure that the exploit uses.

WAFs help, but they have limits. Cloudflare published rules for known vectors and called them a palliative, and they only protect traffic passing through Cloudflare: the server's direct IP remains open if the firewall doesn't close it. Finally, disabling session.upload_progress breaks upload progress bars. Notify the product team beforehand.

CVE-2026-115560: The 10/23 Alert and Why It Doesn't Change Priority

Two days after the patch, PHP published an informational advisory about CVE-2026-115560, another vulnerability related to session and upload progress, which even affects already patched versions. The good news: the vector is unlikely. According to php.net, it only applies if the application configures session.serialize_handler as php_binary or php_serialize, switches to php at runtime with ini_set() before session_start(), and keeps upload progress enabled.

The fix will come in the next regular release. Until then, the same mitigation applies: session.upload_progress.enabled=0. The Hacker News covered the alert.

CVE-2026-115560 is not a reason to postpone the CVE-2026-109618 patch, and anyone who has already disabled upload progress as a mitigation has gained protection for both.

Business Decisions: What to Ask Your Team or Vendor This Week

A manager's role isn't to compile PHP; it's to ask the right questions and demand timelines. Here's the list I'd bring to the meeting.

The Seven Questions

1. Inventory: Which servers, containers, and appliances run PHP? Does this include the institutional website your agency built in 2019?
2. Actual Web Version: Which PHP version serves web requests, not the one in the terminal?
3. Patch Status: Are we on 8.5.12, 8.4.27, 8.3.36, or 8.2.35? Have the workers been restarted?
4. Docker Images: Have images been rebuilt and redeployed, or is the old container still running?
5. Legacy: What is on PHP 8.1 or below, and which of the three paths will we follow for each system?
6. Indicators: Has anyone checked error logs for "Unknown on line 0", Apache segmentation faults, and shells spawned by the web process since 10/17?
7. Owner and Deadline: Who is responsible for each item and by when?

When to Update Now and When Not to Rush Updates

Immediately update everything on 8.2 to 8.5 exposed to the internet: these are patch versions with low regression risk.

Do not jump from PHP 7.4 to 8.4 on a Friday night out of panic: branch changes can break plugins and legacy code. First, isolate (VPN or IP whitelist), apply the vendor's patched package if available, and plan the migration with testing.

Do not trust "my hosting has already fixed CVE-2026-109618" without proof. Request the version and restart date in writing.

Where the Incident Might Be Hiding

Webhooks are a classic blind spot: the endpoint that receives events from the official WhatsApp API or payment gateway is public by definition. If it runs on PHP, it goes to the top of the list.

Staging environments are also often overlooked: many companies protect production but forget staging, which often has the same copied database and old PHP. To close these doors, the Linux Server Hardening Checklist covers what comes after the patch.

Costs: Acting Now Versus Later

I won't invent an average incident cost; it varies too much by size and sector. But we can compare the types of costs associated with CVE-2026-109618, which is what matters for prioritization.

Acting now costs technical team hours: inventory, updates, restarts, log review. For 8.2+, this is typically a matter of days. For 7.x, it adds isolation and a migration project.

Acting later costs what any remote code execution costs: an invaded server with web process privileges, exposed database and credentials, potential ransomware, and, if personal data is involved, obligations under privacy laws like CCPA or other US state privacy laws. The post on data breach response plan shows who notifies whom and within what timeframe.

There's also a hidden cost: version technical debt. A company on PHP 8.3 resolves CVE-2026-109618 during a maintenance window. A company on PHP 7.2 discovers there's no patch and needs a project. For small businesses without a security team, prioritization follows the logic of ransomware in small businesses: what to secure first.

If your team lacks the bandwidth to separate the urgent from the important, that's where an independent technical consultancy pays off: an external expert maps, prioritizes, and delivers a plan of attack.

How Agathas Web Solves This

Agathas Web has operated PHP servers since 2008: managed hosting, Moodle in production, PHP and Laravel systems, and the official WhatsApp API. Through Agathas Web's consultancy, the work begins where advisories leave off: by examining your specific environment.

What's Included

• Exposure Inventory: servers, containers, staging environments, webhooks, and appliances running PHP, and the actual version serving the web.
• System-Specific Decision Matrix: update immediately, apply vendor-patched package, compile backport, isolate, or migrate, with cost and risk for each option.
• Secure Mitigation While Patch Awaits, without crashing the server due to insufficient RAM.
• Indicator Search in logs and processes since 10/17.
• Migration Plan for systems on PHP 8.2 or below, before the 12/31/2026 End-of-Life.

How It Works in Practice

The engagement is led by a partner/CTO, not a junior. For CVE-2026-109618, the scope is concise: diagnosis, priorities, and urgent execution. If it makes sense to go further, it evolves into a comprehensive 4-to-6-week technical diagnostic, with an executive report and action plan, or fractional technical leadership (CTO on-demand).

How to Engage

Through our technology and security consulting page, describe your scenario (how many systems, what hosting, what PHP), and we will respond with a path and scope. Recommendations stem from the diagnosis, not from a pre-packaged solution.

Conclusion: CVE-2026-109618 is a Governance Test, Not Just a Patch

CVE-2026-109618 will be patched on most servers in the coming weeks. The question remains: how long did it take your company to determine where PHP runs, which version, and who is responsible for it?

Summary to bring to the board:

• Update everything on 8.2 to 8.5 today and restart workers.
• Treat mitigations as a bridge, never a solution.
• For PHP 8.1 or earlier, isolate first and decide the path system by system.
• Plan to move off 8.2 before 12/31/2026.
• Review logs since 10/17 for indicators.

If you need an external perspective to conduct this inventory and formulate an attack plan, Agathas Web's consulting services address exactly this scenario.