PHP Project issues mitigation guidance following critical PHP2Shell vulnerabilities

The PHP Project has released instructions to prevent a remote code execution vector linked to PHP2Shell attacks, ZDNet AI reported. The guidance follows a global effort by organizations to patch vulnerable websites after the discovery of two critical security flaws in the programming language. [1]

PHP2Shell involves two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, according to ZDNet AI. Both issues impact most PHP builds and have been assigned critical severity scores of 9.2 under version 4.0 of the Common Vulnerability Scoring System, Grokipedia noted. Official patches to address both security flaws were released on Wednesday. [1][6]

Technical documentation on Grokipedia indicates that CVE-2026-109618 involves an out-of-memory handling failure. PHP relies on longjmp calls to terminate a request. If an abort occurs while internal request data is only partially initialized, subsequent cleanup operations can process invalid data as valid. [6]

Exposed server interfaces identified for the flaws include PHP-FPM, the Apache HTTP Server module mod_php, php-cgi, FrankenPHP, and LiteSpeed, Grokipedia noted. The risk is highest for mod_php, where a demonstrated exploit can execute prior to any application code. [6]