The PHP security team has released emergency security patches for two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team recommends installing PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible for PHP 8.x installations. For PHP 7 or earlier, they suggest upgrading to a fixed release. Minimal source backports are available for PHP 7.4, PHP 8.0, and PHP 8.1. Admins should prepare to upgrade as soon as the security updates are available to mitigate the risk of exploitation. Mitigation measures are also provided for those who can't immediately patch their servers, although they do not fully protect against exploitation. Admins should consider setting memory_limit=-1 and a low post_max_size to reduce exposure to some attack paths.
