CriticalCVSS 9.2Exploitation in the wild reported
CVE-2026-109618: PHP2Shell – PHP Runtime Vulnerabilities
Published · Updated
Memory-safety flaw in the PHP runtime (upload-progress unserialisation) that can disclose server memory and lead to remote code execution. Part of the 'PHP2Shell' pair of vulnerabilities.
- Product
- php php
- Fixed versions
- 8.2.35, 8.3.36, 8.4.27, 8.5.12
- Affected version ranges
>=5.4.0 <8.2.35>=8.3.0 <8.3.36>=8.4.0 <8.4.27>=8.5.0 <8.5.12
Remediation
Upgrade PHP to a fixed release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12), then restart PHP-FPM / the web server. PHP 7.4, 8.0 and 8.1 have no official fixed release: move to a supported branch or install your distribution's or LTS vendor's backported package. Linux distributions often backport fixes without changing the upstream version number, so confirm with your package changelog.
Commands for Ubuntu, Debian and RHEL: How to update PHP on Linux safely.
References
- https://www.php.net/ChangeLog-8.php
- https://sansec.io/research/php2shell
- https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
- https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
- https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities