PHP2Shell: Two Unauthenticated PHP RCEs at CVSS 9.2 Need a Runtime Fix, Not a CLI Upgrade
An unauthenticated request can execute code on any public PHP deployment below the fixed versions, with more than a million exposed servers already counted. The trap is that upgrading the CLI binary changes nothing for the FPM or mod_php process actually serving traffic, so incident response has to start by identifying the real web SAPI and version.
On 2026-10-21, PHP patched and disclosed two high-severity remote code execution vulnerabilities under the name php2shell. CVE-2026-109619 is a use-after-free in request-owned internal state; CVE-2026-109618 is memory corruption triggered when an out-of-memory interruption leaves request data half-initialized. Both allow unauthenticated access before application code runs, and a PoC is already circulating, pushing the CVSS v4.0 score to 9.2. Apache mod_php deployments face the highest verified risk, but PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are all in scope, which puts WordPress, Drupal, Laravel, Symfony, and similar stacks on the list purely because their PHP runtime is exposed.
Patching the CLI binary does not patch the web process. Teams must check the actual SAPI with php -i and php-fpm -v, and verify which PHP version answers web requests. The only complete fix is moving to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; for EOL PHP 8.1 and earlier, PHP provides minimal source backport patches for self-compilation. Temporary mitigations exist: php_admin_value[memory_limit] = -1 removes the OOM interruption path for CVE-2026-109618, and disabling session.upload_progress.enabled (plus fatal_error_backtraces on 8.5) closes the known use-after-free trigger. Those are explicitly partial, and application-level ini_set cannot be trusted as a mitigation because the correct settings must exist before SAPI startup.
At scale, the recommended loop is detect, prioritize, fix, mitigate, isolate, monitor, and harden. ManageEngine's Vulnerability Manager Plus, Endpoint Central, Log360, and PAM360 appear as one orchestration layer; priorities run public-facing over internal, mod_php over FPM/cgi, and EOL over near-fixed versions. The scale workflow also covers version confirmation, SAPI discovery, smoke tests, request-size limits that apply to chunked transfer, and credential rotation to block lateral movement.
The same-day patch-and-disclose schedule is what makes this urgent: defenders and attackers get the technical details at the same moment, so the window before weaponized exploitation is measured in days, not months.
Checking php -v is a false assurance in many shops; operations teams routinely patch a CLI binary while FPM or mod_php keeps running the old runtime.
The OOM mitigation turns an anti-pattern into a targeted control: memory_limit=-1 removes the vulnerable interruption path, but only works when paired with request-size limits and cgroup boundaries, otherwise it becomes a DoS amplifier.
The seven-step scale framework works at the process level independent of tooling; ManageEngine's products are one possible orchestration layer, and the same loop can run on any patch management, monitoring, and PAM stack.