Affected Systems
All PHP installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Highest risk for mod_php deployments. Affects PHP 8.x (fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35) and all PHP 7.x and earlier (minimal backports available for 7.4, 8.0, 8.1). Powers 75-80% of all websites including WordPress, Joomla, Drupal. Approximately 5.1 million PHP hosts exposed online.
Exploitation Status
Early active exploitation observed by Cloudflare prior to patch release. Attackers targeting both vulnerabilities with known exploitation methods. No public PoC details disclosed yet, but exploitation confirmed in the wild.
Business Impact
Unauthenticated remote code execution as web worker account before application code runs. Both CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (heap use-after-free) allow full compromise of PHP-based web servers. Given PHP's 75-80% market share in web hosting, exposure is massive. UK NCSC issued emergency guidance to patch or take systems offline. Temporary mitigations available but do not fully block attacks.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your current branch. Prioritize mod_php deployments first.
- For PHP 7.4, 8.0, or 8.1 systems without vendor LTS support, apply minimal source backports provided by PHP security team or migrate to supported versions.
- If immediate patching is not possible, apply temporary mitigations: set memory_limit=-1 and post_max_size to 8M or 32M; disable session.upload_progress.enabled=0 and restart all workers.
- Deploy WAF rules to block known PHP2Shell exploitation patterns as an interim layer (Cloudflare and other vendors have released rulesets), but do not rely on these as permanent protection.
- Monitor web server logs and PHP error logs for unusual fatal errors, out-of-memory conditions, or unexpected worker crashes that may indicate exploitation attempts.