PHP2Shell (CVE-2026-109618, CVE-2026-109619): is my PHP server affected, and how do I patch or mitigate it right now?

Two critical (CVSS 9.2) unauthenticated remote code execution flaws in PHP itself, leaked on 2026-10-20 before patches; exploitation attempts have been reported. Every PHP install that serves web requests is at risk: PHP-FPM, Apache mod_php (highest risk: can be triggered before any application code runs), php-cgi, FrankenPHP and LiteSpeed. The PHP CLI is not listed as affected. 1. Check your version: php -v (and phpinfo() for the web SAPI, which can differ from the CLI). 2. Upgrade to a fixed release (out 2026-10-21): 8.5 -> 8.5.12, 8.4 -> 8.4.27, 8.3 -> 8.3.36, 8.2 -> 8.2.35. - Distro packages (Debian/Ubuntu/RHEL etc.): vendors got patches early; install your distro's security update. - Docker: rebuild from the updated official php image tag (docker pull php:<version>) and redeploy; don't just restart old containers. - 8.1 and older get no official release (7.4-8.1 have source-only backports from the PHP project; 5.4-7.3 are end of life). Plan an upgrade to a supported branch. 3. Restart every PHP worker (php-fpm, Apache, LiteSpeed, FrankenPHP) after patching; running workers keep the old code. 4. If you can't patch yet, interim mitigations from the advisory (each followed by restarting all workers): - CVE-2026-109619: session.upload_progress.enabled = Off in php.ini; on PHP 8.5 also fatal_error_backtraces = 0. - CVE-2026-109618: memory_limit = -1, set so applications can't override it (weigh the memory risk; container/cgroup memory limits help but aren't a complete mitigation). - Put the site behind a WAF with rules for these CVEs (Cloudflare published rules, including on the free tier), or take internet-facing apps off the public network until patched. 5. After patching, look for signs of compromise: PHP worker processes spawning shells (bash, sh), interpreters (python, perl) or network tools (curl, wget); unexpected new PHP files in web roots; new cron entries or users. No official indicators of compromise had been published as of 2026-10-21. If you find anything, treat the host as compromised and rotate its secrets. Sources: PHP security advisory; Tenable FAQ https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote ; Huntress https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities ; watchTowr https://watchtowr.com/intelligence/php-cve-2026-109618-faq/