What is PHP 2Shell (CVE - 2026 - 109618 & CVE - 2026 - 109619) and how can you protect your site?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• PHP 2Shell consists of two out - of - memory use - after - free bugs (CVE - 2026 - 109618, CVE - 2026 - 109619) that allow unauthenticated RCE on affected PHP 8.2 - 8.5 releases.
• The only reliable fix is to upgrade to the patched PHP versions (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later).
• Temporary mitigations: disable memory_limit checks and the session.upload_progress feature, but these do not remove the underlying vulnerability.
• Scan your site with Decloak’s free scan to verify that the PHP version header is not exposed and that no vulnerable third - party scripts are present; the scan does not replace patching the PHP interpreter.

Which PHP versions are affected by PHP 2Shell?

All PHP releases before the October 2026 security patch are vulnerable: PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12, and earlier 5.4+ branches that contain the same interpreter logic.

The bugs exist in the core interpreter and in SAPI modules such as mod_php and PHP - FPM, so any web server that runs these modules is at risk.

How does the memory - limit bug lead to remote code execution?

When PHP hits memory_limit it aborts the request with longjmp(). In certain code paths the abort leaves request - local structures (hash tables, session globals, unserialize state) in an un - initialized or dangling state. During request shutdown those structures are read or freed, giving an attacker control over a pointer.

An attacker can trigger the condition with a specially - crafted multipart/form - data request that forces an out - of - memory condition while PHP parses request variables (e.g., nested $_FILES). A second request re - uses the freed heap through the session upload - progress extension or the generic unserializer, resulting in arbitrary native - code execution without authentication.

What is the second bug affecting session.upload_progress?

The session upload - progress extension creates session globals before the normal module activation flag is set. If a fatal OOM occurs while the extension has allocated state, the shutdown hook is skipped, leaving those globals pointing into freed request memory. A later multipart request reads the stale pointers and executes attacker - controlled data, again achieving RCE.

Both CVEs share the same impact: critical remote code execution (CVSS 9.2).

What immediate mitigations can I apply before patching?

These mitigations reduce the attack window but are not a substitute for the official security patch.

How do I permanently fix PHP 2Shell?

1. Identify the PHP version running on each server. You can check php -v on the host or look for the X-Powered-By header (if exposed).
2. Upgrade to a patched release:

• PHP 8.2.35 or later
• PHP 8.3.36 or later
• PHP 8.4.27 or later
• PHP 8.5.12 or later
• For older branches, upgrade to the latest maintenance release that includes the October 2026 patch.

1. Restart the web server or PHP - FPM pool to load the new binary.
2. Verify the version after restart (php -v or a protected endpoint that returns the version).
3. Remove any memory_limit = -1 or session.upload_progress.enabled = 0 overrides unless you need them for other reasons.

How can I confirm my site is no longer vulnerable?

• Run a version check: Ensure the server reports a patched version. If the X-Powered-By header is hidden, use a local shell or an authenticated health - check endpoint.
• Use Decloak’s free scan: While Decloak does not directly detect these PHP CVEs, the free scan can verify that your site does not expose the PHP version header and that no vulnerable third - party JavaScript libraries are present. A clean report adds confidence that no obvious auxiliary attack vectors exist.
• Perform a manual test: Send a harmless multipart request that attempts to trigger an OOM condition (e.g., a large nested file upload) and confirm that the server returns a normal error instead of a crash.

Should I worry about related third - party libraries?

Layer 4 of Decloak’s free scan checks JavaScript libraries against the Retire.js database. If you use a PHP - based CMS (WordPress, Drupal, Joomla, etc.) that bundles outdated JS libraries, Decloak will flag those separately. This does not replace patching PHP itself but helps you harden the overall attack surface.

Where can I find more information?

• NVD entries for CVE - 2026 - 109618 and CVE - 2026 - 109619 provide official descriptions and CVSS scores.
• The PHP security advisory (October 2026 release) contains the patch download links.
• Detailed technical analysis is available in the public “PHP2Shell” write - up, which explains the exploit flow and affected applications.

Summary

PHP 2Shell is a critical, unauthenticated RCE bug that stems from use - after - free errors triggered by out - of - memory conditions. The only safe long - term remedy is to upgrade to the patched PHP releases. Temporary mitigations can buy you time but do not eliminate the vulnerability. After patching, use tools like Decloak’s free scan to verify that no version information is leaked and that your site’s ancillary assets are also secure.