PHP2Shell: Patch Two Critical PHP RCE Vulnerabilities Now

Two critical PHP vulnerabilities can let an unauthenticated attacker execute code on a web-facing PHP server. The PHP project disclosed fixes on October 21, and Microsoft published Azure Web Application Firewall guidance the same day. If your company operates a PHP website, API, or business application—or pays a provider to host one—confirm the runtime patch now.

What PHP2Shell changes for operators

The two issues are CVE-2026-109618 and CVE-2026-109619. The PHP security team describes one path involving out-of-memory request handling and another involving stale request state. The PHP project says all PHP installations that serve web requests are in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It identifies Apache mod_php as the highest-risk configuration and says it has a demonstrated unauthenticated exploit that can run before application code.

This is a runtime issue, so changing application code or updating a website plug-in alone does not prove the underlying PHP service is fixed. A host may also run separate PHP versions for command-line jobs and web requests; verify the web-serving version and the processes that load it.

Install the fixed release for your branch

For Linux distribution packages and long-term-support builds, check the operating-system or hosting vendor's security advisory. Vendors may backport the fix without changing the upstream-looking PHP version to one of the releases above. PHP 8.1 and older no longer receive security updates from the PHP project; some vendors may provide backports, but confirm that in writing and plan a move to a supported branch. PHP 8.2 receives this fix, but its published security-support end date is December 31, 2026, so include a branch upgrade in the follow-up plan.

A practical patch and verification sequence

1. Find the runtime owner. Check server and container inventories, hosting control panels, cloud application plans, deployment manifests, and software vendor records. Include websites, customer portals, APIs, and internal applications reachable from the internet.
2. Record the serving configuration. Ask whether the application uses PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed, and which exact package or container image is running. Do not rely on the PHP version installed for command-line tasks if web traffic uses a different runtime.
3. Patch through the supported channel. Install the fixed PHP release or the hosting vendor's documented backport. For containers, rebuild and redeploy the image; updating the host does not update PHP inside an image.
4. Restart and verify. Restart or replace the PHP workers that serve requests. Record the package advisory, deployed image or package version, restart time, and a post-change health check. Confirm that each production node and region has moved to the fixed runtime.
5. Check exposure and ownership. If a provider runs the application, ask for the SAPI, fixed package or backport reference, completion time, and interim WAF controls. Keep a named owner and a short follow-up date for any application that could not be patched during the first window.

Use Azure WAF as a short-term backstop

Microsoft has published PHP2Shell-specific protections for Azure WAF. Its current guidance uses request-side custom rules and, where available, additional response-side controls. Microsoft warns that custom rules can match legitimate traffic and that these measures cover selected exploitation patterns only. Test the configuration against normal application flows—especially sign-in, uploads, and sessions—before expanding it.

The Front Door response-side rule uses response evidence to remove potentially malicious elements; Microsoft says it does not block or challenge traffic and does not generate WAF log entries or hit counts. Do not treat an empty WAF hit-count view as proof that PHP is patched or that the response-side protection is active. See Microsoft's current product-specific instructions before changing a production profile.

Questions for a hosting provider

• Which PHP branch, exact package or image, and request-serving mode are used for each production application?
• Has the fixed release or a documented vendor backport been installed on every web node and region?
• Were PHP-FPM, Apache, or other long-running workers restarted after the update, and how was the live runtime verified?
• If patching is delayed, which Azure WAF product-specific controls are active, who owns false-positive review, and when will the patch be complete?

Frequently asked questions

Which PHP versions contain the fixes? The PHP project lists PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For distribution or long-term-support packages, verify the vendor advisory because a backport may not use those upstream version numbers.

Does this affect only PHP-CGI? No. PHP says web-facing installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are in scope. The project identifies mod_php as the highest-risk configuration.

Will Azure WAF replace the PHP update? No. Microsoft says its WAF protections address selected attack patterns and are temporary. Availability and configuration vary by WAF product. Updating PHP is the complete remediation.

What if our PHP application is hosted by a provider? Ask for the serving mode, fixed package or documented vendor backport, worker or container restart time, and any temporary WAF controls. Keep the provider's written response with the change record.

What about PHP 8.1 and older? The PHP project no longer publishes security fixes for those branches. Some distributions and long-term-support vendors may backport this fix; verify the advisory and plan an upgrade to a supported branch.