Hey everyone,
The PHP security team has dropped emergency security releases (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address two critical Remote Code Execution (RCE) vulnerabilities nicknamed PHP2Shell.
If you manage web servers running PHP, you'll want to check this immediately. Here is a quick breakdown of what's happening:
The Core Details
The Flaws: CVE-2026-109618 (out-of-memory corruption during request initialization) and CVE-2026-109619 (stale global state survival).
Severity: 9.2 (CVSS v4.0) for both.
Impact: Unauthenticated attackers can potentially achieve remote code execution, leading to complete server/site takeovers.
How it went down: Technical details and an exploit tool screenshot leaked ahead of the official drop via security firms like watchTowr and Sansec, prompting an accelerated emergency rollout.
Fixed Versions
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
What You Need to Do Right Now
Update immediately: Grab the latest patched version through your package manager or directly from PHP's official downloads.
Restart workers: Don't forget to restart your PHP-FPM, Apache/mod_php, or other worker processes after updating.
The PHP 8.1 & Older Problem: Since PHP 8.1 and earlier are past their active support lifecycle, they won't get standard official updates. If you're stuck on older versions, check with your OS vendor/LTS provider for backported fixes or consider minimal source backports if you build from source—or better yet, plan an immediate upgrade.
Temporary Mitigations (If you can't patch instantly): While not a fix, PHP recommends setting session.upload_progress.enabled=0 in php.ini (not via ini_set) and configuring rigid memory limits (memory_limit=-1 via admin value) to help mitigate known attack vectors.
Full details on the breakdown, exploit vectors, and checklists can be found in this write-up.
Has anyone run into any upgrade hiccups yet? Check your servers and stay safe out there!
Top comments (0)