PHP php2shell Flaws Put Web Server Workers at Risk of Remote Code Execution

PHP’s php2shell vulnerabilities show how a long-standing engine design can turn ordinary HTTP input into a path to server command execution. The two flaws, CVE-2026-109618 and CVE-2026-109619, affect every maintained PHP release, and researchers have found evidence that attackers were exploiting them before they were disclosed. For teams running PHP, the immediate work is to find exposed application servers, install the available fixes and look for signs of exploitation.

The underlying issue is not limited to one application or framework. PHP can abandon an operation when it encounters a fatal condition, leaving internal data structures only partly updated. An attacker may deliberately trigger such a condition and shape the remaining state so that the worker runs shell commands under its operating system account. The request requires no login or special application endpoint.

Fastly advises treating every PHP application as potentially exposed until its configuration is checked. The company also warns that traffic filtering can provide only partial protection for a pre-authentication remote code execution flaw, and some filtering approaches may block substantial amounts of legitimate traffic.

Patch status and exposure

The PHP Foundation assigned the vulnerabilities CVE-2026-109618 and CVE-2026-109619. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP has also published patches for versions 7.4, 8.0 and 8.1 for package distributors to integrate. Versions earlier than 7.4 will not receive a patch directly from PHP; availability depends on individual distributors. Every maintained PHP version is affected.

The oldest demonstrated exploit path dates to 2012. That history matters because systems can retain older PHP installations even when teams believe they have upgraded other parts of their web stack. Fastly recommends inventorying application servers for both Apache’s mod_php module and php-fpm, then applying the relevant fixed release with urgency.

Proofs of concept demonstrated so far need information about the running PHP binary and the server’s memory layout to achieve code execution on x86_64 systems. That requirement may prevent some attempts from succeeding, but it is not a reliable basis for considering a server safe. Fastly says operators of 32-bit PHP applications should assume compromise is possible.

Why fatal errors can leave an opening

PHP handles many fatal conditions through zend_bailout, which uses longjmp() to jump directly to a recovery point. Instead of allowing each active function to finish or clean up, the engine can interrupt a chain of operations midway. The request then proceeds toward teardown with some internal work left incomplete.

This recovery path is used when PHP reaches a memory limit, an execution timeout or an aborted client connection, and for other fatal conditions. If an interruption occurs while PHP is modifying a data structure, that structure can be left inconsistent. Later cleanup code may treat it as valid and act on stale or unfinished data.

Researchers have shown that a single unauthenticated HTTP request can trigger exploitable conditions. By influencing the state left behind, an attacker can make PHP execute arbitrary shell commands as the web server’s operating system user. The worker can continue handling requests afterward, which means code execution may not cause an obvious interruption to service.

The public proofs of concept demonstrate particular paths through this design, not every possible way an operation might be interrupted. The mechanism appears throughout PHP’s source code, and each interruption point can affect different data structures and cleanup assumptions. Fixing the specific paths already identified therefore does not make the broader error-handling mechanism safe. Further bugs may be found as attackers examine other paths.

One complication for defenders is that the visible trace can be slight. The article reports that an exploit may leave only a routine out-of-memory error in the logs. That signal can be difficult to distinguish from ordinary operational noise unless teams examine its context and frequency.

What successful exploitation could enable

Remote code execution gives an attacker the privileges of the affected web server process. The immediate consequences can range from disrupting a PHP site with a request to running commands without an obvious service outage. From that foothold, an attacker may be able to read credentials the application uses for databases, APIs, cloud services or encryption.

Those credentials can open access to connected systems such as databases, caches, message queues and internal services. A compromised web worker may also provide a route to cloud infrastructure, Kubernetes service account tokens, Envoy, SSH keys stored on disk or other systems reachable from the server’s trusted environment.

Attackers may try to preserve access through changes to PHP files or scheduled tasks, so a restart or redeployment may not by itself remove an intrusion. For an online store, for example, a compromised server could be used to install payment skimming code that continues collecting customer data. The same basic risk applies wherever a PHP application handles sensitive records or connects to valuable internal services.

Fastly says denial-of-service variants affect a wider range of configurations, including php-fpm. These variants can crash processes without achieving code execution. The distinction matters for triage: a burst of worker crashes may still signal exploitation activity, even if there is no evidence yet of a successful command execution.

Where to look first

Exposure depends on the PHP setup and the request paths it allows. Fastly highlights Apache with mod_php in prefork mode, as well as configurations where the relationship between memory_limit and post_max_size lets a single POST request trigger memory exhaustion. The broader denial-of-service issues also make it important to review PHP-FPM systems rather than focusing solely on Apache.

Teams can start by inventorying PHP versions, server modules, process managers and relevant settings across production. The source identifies ecommerce systems as an area to examine because upload workflows can lead teams to raise post_max_size. Media and publishing sites may have many Apache installations with near-default settings. Education, hospitality, financial services, SaaS, hosting and healthcare systems also commonly run PHP applications or accept large document and image uploads.

These categories are starting points for an inventory, not proof that a particular organization is vulnerable. The practical question is how each application is configured and whether its endpoints expose the conditions needed for an exploit. Shared hosting deserves particular attention: a vulnerable configuration on a multi-tenant server can affect more than one customer environment.

Mitigations and signals to investigate

Fastly customers using NGWAF can enable its signal for both CVEs. The company says the associated templated rule looks for request bodies and parameters whose structure differs from legitimate traffic and may indicate exploitation. Fastly’s security research team developed and tested the detection content with OpenAI and other ecosystem contributors. The company says it will update the virtual patch as needed, with later updates delivered automatically to customers who have opted in.

That filtering can add a layer of defense, but it does not replace upgrading PHP. Fastly cautions that active mitigation may be incomplete and could require blocking legitimate requests, depending on the method. The company says it is continuing to examine additional ways to detect and block related traffic and plans to refine its NGWAF content as it observes attempts.

For a simpler upload-progress issue, the source recommends setting session.upload_progress.enabled = Off in php.ini. It also describes several configuration changes that can reduce exposure to known exploit paths:

• Set post_max_size = 8M to keep POST bodies below the threshold used in the described single-request memory exhaustion path. PHP uses this as its default, but production systems may have raised it to accommodate large forms or file uploads. Check those workflows before changing the value.

• Set max_input_nesting_level = 4 to limit deeply nested variable names used in the hash-table exploit payload. Applications that depend on more complex nested form structures may need a higher value, such as 6, and should test those forms after the change.

• Disable upload progress with session.upload_progress.enabled = 0 to remove the session-related trigger described in the source. This affects applications using PHP’s built-in session mechanism for upload progress; many use JavaScript-based progress handling instead.

Traffic inspection can help identify suspicious requests. Review unusually large application/x-www-form-urlencoded POST bodies, especially those above 1–2 MB; the source says legitimate form submissions are almost always below 100 KB. Also look for an empty field name followed by a deeply nested name containing repeated square brackets, a shape associated with the hash-table payload.

Multipart uploads containing a field named PHP_SESSION_UPLOAD_PROGRESS merit review on endpoints that do not use upload-progress tracking. The field belongs to a legitimate PHP feature, so its presence alone does not establish an attack. Context matters: check whether the application expects it and whether other unusual request characteristics appear alongside it.

Application and web-server logs can provide further clues. Look for PHP memory exhaustion errors that identify Unknown on line 0, which may indicate the failure occurred during PHP request parsing before an application script ran. A cluster of Apache AH00052 entries reporting segmentation faults is another signal to examine. The source distinguishes isolated crashes from dozens occurring within minutes, particularly when followed by a slow HTTP 200 response, a pattern associated with address-recovery attempts.

At the host level, monitor Apache or PHP workers for unexpected shell processes. A mod_php worker launching /bin/sh -c should be investigated unless the application explicitly uses command-execution functions such as exec, system or shell_exec. In the exploit paths described, application code does not run before the command executes, making an unexpected child shell a particularly useful signal.

For PHP-FPM, Fastly suggests setting pm.max_requests = 50 so workers recycle after a limited number of requests. This may narrow the time available for cross-request corruption paths involving sessions or data conversion. It does not address the hash-table issue, which can exploit corruption within one request. A setting of 1 would prevent cross-request attacks entirely, but the source warns of a severe performance cost.

Patch first, then keep watching

The immediate priority is to locate PHP servers and upgrade to a fixed release appropriate to each version branch. Where a direct patch is unavailable, configuration changes, traffic inspection and process monitoring can reduce some exposure while teams work through their options. Those measures cover specific paths and signals; they do not remove the underlying risk in an unpatched runtime.

Fastly expects more attempts and new variants as attackers investigate the many points where zend_bailout can interrupt PHP operations. Its continuing work includes monitoring its network for php2shell activity and updating detection content. For operators, the useful next step is to combine patch status with a review of request limits, error logs and worker behavior, then repeat that review as new exploit paths become known.

Fastly’s continuing coverage describes its investigation and mitigation updates. Customers seeking assistance can contact Fastly.