PHP2Shell
CVE-2026-109618 and CVE-2026-109619 severity, hidden PHP runtimes, and patch status
SYS.SEC_V3.8 // ACTIVE
White-Label
Last scan: May 27, 1:15 PM
WF
PHP2Shell — CVE-2026-109618 and CVE-2026-109619 are on the CISA KEV list
CVSS v4.0 9.2 · unauthenticated RCE in the PHP runtime · fixed Oct 21, 2026 · KEV since Oct 26, 2026 · Wells Fargo
Open runtimes
4
Below a fixed release
Hidden in images
2
Missed by a normal SCA pass
Internet-facing
3
Patch these first
Remediation
20%
1 of 5 patched
CVE-2026-109618 · KEV
Partial request cleanup after an out-of-memory interrupt
9.2
CVSS v4.0

An out-of-memory failure can interrupt PHP while internal request data is only partly initialized. Request cleanup may then treat that invalid data as valid. Unauthenticated remote code execution against any PHP process serving web traffic.

CVE-2026-109619 · KEV
Stale request state reused by a later worker request
9.2
CVSS v4.0

Request-owned internal state can remain after its backing memory is freed. A later request handled by the same worker may use that stale state before normal initialization resets it. Same impact: unauthenticated remote code execution.

Fixed releases — every web SAPI
PHP 8.5 → 8.5.12PHP 8.4 → 8.4.27PHP 8.3 → 8.3.36PHP 8.2 → 8.2.358.1 and earlier · no binary fix

Affected range is PHP 5.4 through 8.5.11, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. The PHP project rates Apache mod_php as the highest-risk deployment. Restart workers after the upgrade and verify the running worker, not the image tag alone.

Module 13

PHP2Shell Exposure Telemetry

DEMO DATANOMINAL
0%PHP2SHPatched% 20%Hidden% 19%KEV% 18%CLEAR GATESVERSION PINPASSIMAGE SCANPASSWORKER CHECKPASSSYNC NODE5 Repo Connectors Synced
Runtimes Seen Funnel
○ BASELINE
5.8KRuntimes SeenPHP interpreters found in repos, images, and workers
880Below FixVersions older than the Oct 21 patched releases
112Hidden PHPInterpreter bundled inside CMS or marketplace images
4.8KWorkers RecycledLive web request matches a patched binary
Enterprise GRC Checkpoint
Patch the runtimeENTERPRISE
Move every web-serving PHP worker to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart it.
Hunt bundled PHPENTERPRISE
Check CMS, LAMP, and marketplace images whose app repos contain no PHP version file.
Codebase findings
WF-01
payments-portal
deploy/Dockerfile
VulnerablePHP 8.3.11mod_php
Evidence in repo
FROM php:8.3.11-apache
Remediation

Rebuild on php:8.3.36-fpm (or 8.4.27 / 8.5.12), leave mod_php, and recycle every Apache worker before returning the service to the internet.

What the codebase check covers
Version pins
Dockerfiles, composer.json, composer.lock, and CI setup-php versions compared with 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Bundled interpreters
WordPress, Drupal, Magento, and marketplace LAMP images, where the app tree has no PHP manifest.
Tag versus digest
Chart tags such as php-8.2 that still resolve to a digest below the fixed release.
CLI versus worker
Build-agent php -v can look patched while the FPM or Apache worker serving traffic is older.
End-of-life branches
PHP 8.1 and earlier stay open. Those branches do not get a binary fix.
Scan log
[INVENTORY] Loaded connected repositories for Wells Fargo.
[INVENTORY] This check reads version pins, image digests, and worker banners. It does not send exploit traffic.
Severity remediation order
• Upgrade is the only complete fix. Interim settings reduce specific paths and do not replace a patched runtime.
• If a system cannot be upgraded now, take internet-facing PHP offline or place it behind network authentication.
• A web application firewall can reduce exposure. It does not close the flaw, especially on Apache mod_php, where the issue can be hit before application code runs.
• PHP 8.1 and earlier are end of life. The PHP project is not shipping binary fixes for those branches. Move them to 8.2.35 or newer.
• After any upgrade or config change, restart every PHP worker and confirm the version from a live web request, not only the CLI or the image tag.
• Published interim profile, until the binary is patched: memory_limit=-1 where applications cannot override it, session.upload_progress.enabled=0, and on PHP 8.5 fatal_error_backtraces=0.