PHP2Shell: unauthenticated remote code execution in PHP web stacks

What happened

CVE-2026-109618, nicknamed PHP2Shell by the research team that documented it, is a flaw in the PHP engine itself: on a remotely triggered out-of-memory condition, PHP abandons request handling while memory is left in an invalid state that the shutdown procedure then reads. Chained with a correlated second bug (CVE-2026-109619), it yields unauthenticated remote code execution, validated by the vendor against Apache mod_php with default configuration, before any application code runs. Emergency fixes shipped on October 21; CISA added both flaws to the KEV catalog on October 26 citing real-world exploitation.

Why it matters for a hotel

• PHP powers a large share of hospitality web: marketing sites, custom booking portals, payment modules, operator back offices. A compromised server exposes reservation data in transit and becomes a foothold toward the internal network.
• Exploitation needs no account and no interaction: on vulnerable configurations a plain HTTP request is enough, which makes in-the-wild scanning automatic and fast.
• Managed instances are not automatically covered: many hosting providers had not yet deployed the October 21 builds at disclosure time.

Who is affected

• Any web application on unpatched PHP 8.2 through 8.5; Apache mod_php is the confirmed scenario, while FPM, FrankenPHP and LSAPI are judged likely susceptible based on the vendor's source analysis.
• PHP 8.1 and older, which no longer receive fixes, must migrate to a supported branch.
• Note: a third variant, CVE-2026-115560, remains open after the October 21 fixes in rare configurations; the workaround below closes it too.

How to fix

1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on every web server, including test environments and provider-managed instances.
2. Set session.upload_progress.enabled=0 in php.ini or the FPM pool configuration (never via ini_set()) until the next regular bugfix release.
3. Remove internet exposure from any instance that cannot be patched immediately.
4. Hunt for compromise traces predating the fix: recently added files in web roots, new administrator accounts, unusual outbound connections from the web worker.
5. Require every hosting provider and integrator to report the exact PHP builds deployed, property by property.

Context

PHP2Shell echoes the node2shell campaigns: when a bug lands in the web's execution substrate, the most exposed sector is not the one making headlines, it is the one whose critical sites run on quietly unaudited building blocks. French and US response teams publish the same guidance: patch exposure first, then verify what came in.