PHP security advisory: php2shell (CVE-2026-109618, CVE-2026-109619)

On October 21, 2026, PHP publicly disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. Specially crafted HTTP requests may allow an attacker to run code remotely, expose data from other requests, or cause a denial of service.

Working public exploits are already available, and exploitation attempts have been reported across the industry.

Copy link to headingRequired action

Upgrade the PHP runtime to a patched release immediately, regardless of WAF protections or hosting provider. Updating your application code or plugins does not fix these vulnerabilities.

Edgenivo deployed WAF protections before public disclosure. These rules reduce exposure to known exploit patterns, but do not replace patching. See How to upgrade and protect your PHP application for remediation steps.

Copy link to headingWho is affected

The vulnerabilities affect PHP 5.4 and later in default configurations. Frameworks and CMSs built on PHP, including WordPress, Drupal, Laravel, and Magento, are affected when they run on a vulnerable PHP runtime.

The PHP security team advises all PHP installations serving web requests to update, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Exploitability varies by runtime and configuration; do not treat a different web server or framework as a substitute for patching.

Copy link to headingUnderstanding php2shell

The vulnerabilities are in the PHP engine itself:

• CVE-2026-109618: RCE via out-of-memory corruption. Out-of-memory handling can leave internal request data partially initialized. Request cleanup may then use that invalid data.
• CVE-2026-109619: RCE via stale global state. A PHP worker can retain references to freed request memory. A later request handled by the same worker may use that stale state.

Both vulnerabilities are rated critical. See the PHP security advisory and the linked technical advisories for details.

Copy link to headingEdgenivo WAF protection

Edgenivo received advance notice through the coordinated disclosure process. We deployed new rules to the Edgenivo WAF before public disclosure to block known php2shell exploit patterns.

These protections apply automatically to all projects on Edgenivo at no cost, with no configuration needed. They cover:

• PHP functions deployed on Edgenivo.
• Requests Edgenivo rewrites or proxies to external PHP backends.

Blocked requests appear in your project's Firewall dashboard. The Edgenivo Security team is monitoring attack traffic and will update the rules as new variants appear.

WAF protection does not replace patching. Requests that bypass Edgenivo's network, including direct requests to an external PHP backend, are not covered.

Copy link to headingHow to upgrade and protect your PHP application

Copy link to headingUpdate the PHP runtime

Upgrade to a patched release for your PHP branch:

If your distribution or hosting provider manages PHP, check for updated packages that address both CVEs. PHP 8.1 and earlier no longer receive regular updates from the PHP project; upgrade to a supported branch or contact your distribution or LTS vendor about backported fixes.

Copy link to headingUpdate the deployment serving traffic

For container deployments, rebuild with an updated PHP base image and redeploy. For other hosting environments, apply the patched runtime using your provider's upgrade process.

Verify that the deployment serving web requests is running the patched runtime. Updating only your local development environment, application code, or plugins is insufficient.

Copy link to headingProtect external PHP backends

Patch any external PHP servers that receive traffic through Edgenivo. Limit direct access to those servers so requests pass through Edgenivo's network. See Restricting your origin to Edgenivo traffic for guidance.

Copy link to headingNext steps

• Review the official PHP security advisory for affected versions and full remediation guidance.
• Review your project's Firewall dashboard and the Edgenivo Firewall documentation.
• For additional questions, contact [email protected].

We are grateful for the close collaboration with OpenAI and Wiz, who coordinated and contributed to this effort.