PHP2Shell Explained: CVE-2026-109618 and CVE-2026-109619

PHP2Shell Incident Snapshot

PHP2Shell is a convenient industry label, not a separate product or malware family. It refers to CVE-2026-109618 and CVE-2026-109619.

What PHP Is and Why the Exposure Is Broad

PHP is a server-side scripting language used to generate dynamic websites, APIs, content-management systems, e-commerce services, and internal business applications. A web server hands a request to a PHP runtime, which executes application code and returns the response.

That placement makes a runtime vulnerability unusually important. The affected PHP process can sit beneath WordPress, Drupal, Joomla, Laravel, custom applications, and hosting control panels. Updating the application alone does not repair a flaw in the PHP engine that executes it.

How the Two Vulnerabilities Differ

Both issues can produce remote code execution, but they arise from different failures in PHP's internal request lifecycle.

Defensive Attack Path

1. Reach a PHP web endpointAn attacker sends a crafted HTTP request to an internet-facing service using a vulnerable PHP runtime.
2. Trigger vulnerable request handlingThe request exercises an affected out-of-memory or stale-state path inside the PHP engine.
3. Cross the application boundaryBecause the flaw is in the runtime, exploitation may occur before normal application controls can help.
4. Execute code in the worker contextSuccessful exploitation can provide server-side code execution with the privileges of the PHP or web-server process.
5. Expand impactAn intruder may access application secrets and data, establish persistence, move laterally, or alter hosted content.

This intentionally stays at a defensive level. Detection and remediation do not require reproducing the exploit on production systems.

Affected and Fixed PHP Versions

All PHP installations serving web requests should be treated as in scope until the installed package is confirmed to contain the fix. For currently supported upstream branches, use these minimum versions.

Exploitation Status and Timeline

How watchTowr says it is helping customers

In its dated PHP2Shell briefing, watchTowr says its Adversary Sight capability identified PHP instances and assessed exposure, Rapid Reaction highlighted affected customer assets, and Active Defense supplied network-level mitigations while permanent fixes were being applied. These are vendor claims and temporary protective services; they do not replace PHP or Plesk updates.

There is no public attribution in the supplied reporting. Do not wait for a named threat actor or a CISA KEV entry before patching a critical, remotely reachable RCE.

Immediate Response Priorities

• Inventory all PHP web runtimes: include PHP-FPM pools, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, containers, appliances, and control panels.
• Prioritize public Apache modules: PHP describes mod_php as the highest demonstrated risk, but do not exclude other SAPIs.
• Install a trusted fixed build: use upstream PHP, your Linux distribution, Plesk, or an accountable lifecycle-support vendor.
• Restart affected workers: make sure long-lived workers actually load the new binary and clear vulnerable in-memory state.
• Validate from the running environment: record version, package/build provenance, handler, restart time, and application health.
• Hunt for compromise: review web, PHP, WAF, EDR, process, authentication, and outbound-network telemetry for anomalies.
• Isolate suspicious hosts: preserve evidence and investigate rather than assuming the patch removes an existing foothold.

Authoritative and Dated Sources

• PHP security advisory and fixed releases — technical mechanisms, affected runtimes, update versions, and temporary exposure-reduction guidance.
• Plesk vulnerability advisory — Plesk package and sw-engine build status.
• watchTowr PHP2Shell briefing — third-party active-exploitation reporting and disclosure timeline.
• CISA KEV catalog — live government catalog status; verify it again during every response cycle.

Next: continue to Part 2: the Plesk patching and verification runbook.

PHP2Shell Frequently Asked Questions