PHP2Shell: two zero-day flaws in the PHP runtime enable unauthenticated remote code execution.
Attackers are actively exploiting CVE-2026-109618 and CVE-2026-109619 to bypass application-level firewalls and compromise servers completely — no user credentials required. The flaw sits inside the PHP interpreter itself: even a flawlessly written website is exposed if the server runtime is unpatched.
What exactly is broken
Out-of-Memory Corruption
An out-of-memory error can prematurely interrupt PHP while initial request data is only partially built. The engine's subsequent request cleanup mistakenly treats this corrupted data as valid — enabling memory manipulation by an attacker.
Stale Global State Use-After-Free
Request-owned internal state can persist inside a server worker thread even after its memory has been formally freed. A subsequent web request handled by that same worker can interact with this stale state before regular variables are reinitialized.
Why patching at the application level is not enough: the flaw lives inside the underlying PHP interpreter runtime — not your website code. WordPress, Magento, Laravel and Drupal sites are all equally exposed until the server runtime itself is patched and its worker processes are flushed.
Is your infrastructure affected?
Platforms
- WordPress & WooCommerce
- Magento / Adobe Commerce
- Laravel applications
- Drupal sites
- Any custom PHP application
Server Runtimes
- PHP-FPM
- Apache mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
Versions
- PHP 8.5 → patch to 8.5.12
- PHP 8.4 → patch to 8.4.27
- PHP 8.3 → patch to 8.3.36
- PHP 8.2 → patch to 8.2.35
- PHP 8.1 & older (EOL) → migrate
How ThinkSmiths closes the exposure
An end-to-end service delivery lifecycle — from discovery to a monitored, self-defending state.
Rapid Infrastructure Audit & Discovery
- Scan and map your entire server array to locate hidden dependencies, outdated versions and structural exposures
- Runtime verification across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed to catalogue vulnerable binaries
- Dependency mapping for CloudPanel setups, Docker containers and headless microservices
- Legacy threat assessment for End-of-Life branches (PHP 8.1 or older) needing vendor patching or structural migration
Zero-Downtime Patching & Server Hardening
- Targeted upgrades to verified production-stable releases — PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- Process flush: restart php-fpm / web workers and rebuild containers to clear vulnerable memory structures
- Executed without disrupting live production traffic
- If upgrading is blocked by legacy code: disable session.upload_progress, manage memory limits, set strict WAF ingestion boundaries
Continuous Monitoring & Proactive Threat Intel
- Automated monitors cross-reference your server inventory against live global CVE/NVD threat registries 24/7
- Log aggregation flags patterns resembling active RCE memory-probing or zero-day reconnaissance
- Executive alerts, compliance logs and structured remediation pathways for every future disclosure
Not sure if you're exposed? We'll tell you — fast.
Share your details and our security team will contact you to schedule a rapid infrastructure audit. Every enquiry is verified by a one-time email code, so our team only spends time on real businesses.
Rapid response from the advisory desk
Zero-downtime patching & hardening by certified engineers
24/7 monitoring against future disclosures
Advisory issued by Praveen Kumar, Director — Technical, ThinkSmiths Software Services Pvt. Ltd. References: PHP security advisories (github.com/php/php-src), CISA alert (21 Oct 2026), php.net release changelogs.
Request a remediation assessment
All fields are mandatory. A verification code will be emailed to you before submission.
Looking for our other services?
Explore all ThinkSmiths services