php2shell (CVE-2026-109618, CVE-2026-109619): Find Every Exposed PHP App on Your Attack Surface in 24 Hours

php2shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on a PHP server before your application sees the request. The PHP project shipped fixes on October 21, 2026, and Cloudflare is already reporting early exploitation attempts. Patching is the only complete fix, and you can only patch the PHP servers you know about.

That second part is the problem. PHP runs on 69% of websites with a known server-side language, and most security teams can name a fraction of the PHP apps that answer to their organization’s domains. The marketing microsite an agency built in 2019, the acquired subsidiary’s customer portal, the vendor-hosted careers page: each one is a PHP server an attacker can find in minutes with a banner search.

IONIX is offering a free php2shell exposure assessment. Give us your company name and nothing else. Within 24 hours you get your full external attack surface mapped, every internet-facing PHP app identified across your organization, subsidiaries, and digital supply chain, and exploitability data where a safe test exists. No agents, no credentials, no commitment.

Get a Free Exposure Assessment

What php2shell is, in plain terms

The PHP security team rates both flaws critical at CVSS v4.0 9.2. Both are memory-safety bugs in PHP’s request lifecycle, the code that runs before any line of your application executes.

• CVE-2026-109618, RCE via out-of-memory corruption. PHP exits a request early when it runs out of memory. If that happens while request data is still half set up, the cleanup code treats garbage as valid data. An attacker can trigger the out-of-memory condition with a crafted multipart request: no content length, unlimited headers per part, deeply nested field names.
• CVE-2026-109619, RCE via stale global state. Internal state from a finished request can survive in a persistent worker after its memory is freed. The next request on the same worker reads that freed memory before normal setup resets it. PHP’s own advisory confirms the session upload progress feature, which is on by default and needs no session to start, as a working path on PHP-FPM.

The attacker needs no login, no specific URL, and no upload form. PHP’s advisory calls out Apache with mod_php as the highest-risk configuration, with a demonstrated exploit where one unauthenticated request triggers the attack before application code runs. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are all in scope.

This is why “watch your upload endpoints” is the wrong advice for php2shell. Every PHP host that serves web requests is a target, whether or not it has an upload feature.

Which PHP versions php2shell affects

PHP has published fixed versions for every supported branch. Anything below these numbers is vulnerable.

Branch	Fixed version	Support status
PHP 8.5	8.5.12	Active support
PHP 8.4	8.4.27	Active support
PHP 8.3	8.3.36	Security fixes only
PHP 8.2	8.2.35	Security fixes only, end of life December 31, 2026
PHP 8.1, 8.0, 7.4	Minimal source backports only	End of life
PHP 7.3 and older, PHP 5.x	No fix from the PHP project	End of life

The PHP project published minimal source-only backports for 7.4, 8.0, and 8.1. Those are branches you compile yourself, not packages. Some Linux distributions and long-term-support vendors have backported fixes without changing the version string, so a banner that reads “PHP 8.1.2” can be patched or unpatched and you cannot tell from the outside without testing it.

Before PHP shipped the fix, Shodan banner counts showed around 884,000 internet-facing hosts reporting PHP 8.1 or older, plus another 740,000 reporting PHP with no version at all. Tenable puts the potentially vulnerable internet-exposed population between 1.3 million and 1.9 million hosts. Every one of those is a server somebody owns, and most of them are servers nobody is tracking.

php2shell is an inventory problem first

Your vulnerability scanner will find php2shell on the hosts you pointed it at. The breach will come from the host you did not.

Attackers exploit critical CVEs within hours of disclosure, and php2shell gave them a head start: the CVE identifiers leaked on October 20, a day before the fix, and proof-of-concept code was circulating before PHP’s advisory went live. Their playbook is simple. Pull every host with a PHP banner from an internet scan, filter by organization, fire the exploit. They do not care whether the host sits on your main domain, on a subsidiary’s domain, or on a vendor’s infrastructure under your brand.

Three categories of PHP app fall outside most security teams’ line of sight:

• Subsidiary and acquired properties. The company you bought two years ago still runs its old WordPress intranet and its old customer portal. Your scanner has never seen them because nobody added their domains to the scope.
• Digital supply chain. Agencies, marketing platforms, event microsites, and white-labeled SaaS all run PHP under your domains through CNAME records and reverse proxies. Your team did not build them, so your team does not know they are PHP.
• Forgotten and shadow infrastructure. Staging servers, legacy phpMyAdmin consoles, a decade-old survey tool. Still resolving, still answering, still running PHP 7.

IONIX customers see this at scale: organizations are aware of around 62% of their real external attack surface before IONIX maps it. For php2shell, that gap is the list of servers you will patch last, or never.

How IONIX finds and validates your php2shell exposure

IONIX is an External Exposure Management platform. It answers php2shell with the same three-step loop it runs for every critical CVE: Pinpoint, Validate, Fix.

Pinpoint: every PHP app across the organization you own

Before IONIX discovers a single asset, it builds an organizational entity map: legal entities, subsidiaries, acquisitions, brand names, and domain registrations connected to your company. Discovery starts from that map, so a PHP server on an acquired subsidiary’s domain shows up without anyone remembering to add it to a seed list.

From there, Connective Intelligence follows DNS, hosting, CDN, and reverse-proxy relationships outward into your digital supply chain, so a vendor-hosted PHP application serving traffic under your brand is attributed to you, with the vendor named as the owner.

For php2shell specifically, IONIX has already added a php2shell entry to the Live Exposure Defense section of the portal and mapped every asset it fingerprints as PHP from server and application response signatures. The list is broad by design. It includes every PHP-detected asset, whatever version it reports, because a stripped version header does not make a server safe.

Validate: confirmed exploitable, not “potentially affected”

A list of PHP hosts is where most tools stop. IONIX narrows it in two passes.

First, version-based narrowing against PHP’s confirmed affected and fixed releases, delivered within hours of the official advisory. Second, where a safe exploitability test exists, IONIX runs it against each candidate host and returns confirmed-exploitable findings in the portal within 12 hours. The output is a short list of servers an attacker can compromise today, with evidence, instead of a long list of servers that happen to say “PHP” in a header.

This is the difference between EASM and External Exposure Management. Discovery tells you what is there. Validation tells you what is exploitable. IONIX customers report a 97% drop in false-positive alerts and a 90% reduction in mean time to resolve external exposures for this reason: the team works a list it can finish.

Fix: a prioritized plan and a WAF rule while you patch

Live Exposure Defense customers click “What should I fix first” in the portal and get a prioritized remediation plan: patch order by exploitability and exposure, owner per asset, and a specific WAF rule to deploy through Cloudflare or Akamai while the patch rolls out.

IONIX Research has published tested detection rules for Cloudflare and Akamai that match the session upload progress key in multipart POST requests. Run them in alert mode first. Blocking mode can break legitimate upload-progress functionality, and a CDN rule inspects only part of each request, so treat it as a tripwire that raises the attacker’s cost. The host stays exposed until you patch it.

Every finding, with its evidence and its recommended rule, routes into your existing Jira or ServiceNow workflow so the team that owns the server sees the action and the proof together.

The php2shell mitigation checklist

Patching to a fixed version is the only complete fix. PHP’s own advisory says so in those words. Everything below reduces exposure while you get there, and none of it makes an unpatched host safe.

1. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On a distribution package, check the changelog for the CVE identifiers, since the version string may not change.
2. Disable session upload progress on every host that does not use it: session.upload_progress.enabled = 0 in php.ini, the FPM pool, or server config, then restart every worker. PHP recommends leaving this off after patching too. This blocks the confirmed session path for CVE-2026-109619 and does nothing for CVE-2026-109618.
3. Remove the memory ceiling that CVE-2026-109618 abuses: memory_limit = -1 enforced with php_admin_value so no application can set a finite limit. Pair it with a conservative post_max_size (8M with no uploads, 32M with) and request-size limits at the web server or proxy.
4. On PHP 8.5, set fatal_error_backtraces = 0 and restart workers.
5. Verify on every host, pool, and container image, one by one. A single missed worker leaves the host exposed. A virtual-host override can re-enable the feature you disabled in the main config without any warning.
6. Isolate what you cannot patch. End-of-life hosts with no vendor backport go behind a VPN or an allowlist, or they go offline.
7. Hunt for compromise on any host that was internet-facing before you patched: php-fpm, php-cgi, httpd, or apache2 spawning shells, interpreters, or download tools; new files in the web root; new cron jobs; new accounts.

Step one is the fix. Steps two through seven buy time. None of them help with the PHP server you have not found yet, which brings us back to the inventory.

Get your free php2shell exposure assessment

IONIX is offering a free, no-strings php2shell assessment to any organization that wants a second opinion on its PHP footprint.

All we need from you is your company name.

Within 24 hours you receive:

• Your full external attack surface mapped, including subsidiaries, acquisitions, and digital supply chain dependencies
• Every internet-facing PHP application identified and attributed to the entity that owns it
• Exploitability data for php2shell where a safe test exists
• A prioritized list of what to patch first

Get a Free Exposure Assessment

Existing IONIX customers: your php2shell view is live in the Live Exposure Defense section of the portal now. Live Exposure Defense customers get live updates and push notifications as IONIX narrows the list by version and adds validated findings. Other customers see the updated affected-asset list in the portal after the next scan, and can filter the Discovery view for PHP assets today. Contact support or your account manager for the Cloudflare and Akamai rule packages.

php2shell FAQs