PHP2Shell: Find hidden PHP exposure and reduce application risk

Look beyond web servers to applications and appliances, then combine prioritized patching with appropriate WAF controls.

Key takeaways

• Patching PHP is the only complete fix for PHP2Shell. Other measures can reduce exposure, but they don’t replace the fix.
• Look beyond obvious web servers. The exposure is wider because many appliances and applications embed PHP without making it visible.
• Prioritize by exposure, not by customer. For IT teams and MSPs, start with internet-facing PHP systems, then work through internal systems and appliances as vendor updates become available.

Three vulnerabilities in PHP have turned a routine software inventory question into an urgent security priority: Where exactly does PHP run in your environment? On October 21, 2026, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Two days later, on October 23, the project disclosed a related session deserialization issue, CVE-2026-115560, which uses the same attack surface and is covered for Barracuda customers by the controls described later in this post. The vulnerabilities can allow unauthenticated remote code execution, and the PHP security advisory makes the response clear: Updating is the only safe choice.

Attackers are already moving. Amazon Threat Intelligence reported exploitation attempts against its MadPot honeypots dating to October 17, four days before public disclosure. Amazon noted that it was unclear whether those early attempts would have succeeded against real-world systems. The practical takeaway is to prioritize remediation and investigate suspicious activity without assuming exposure began on the day the patches arrived.

What PHP2Shell is and why it matters

PHP2Shell covers two separate flaws, both rated 9.2 (Critical) on the Common Vulnerability Scoring System (CVSS) v4.0 scale. A related session deserialization flaw, CVE-2026-115560, was disclosed on October 23, 2026 in the same session upload progress path and will be addressed in the next regular PHP bugfix release. The three flaws are:

• CVE-2026-109618, remote code execution through out-of-memory corruption. When PHP runs out of memory, it can be interrupted while internal request data is only partially initialized. The cleanup that follows may then treat that invalid data as valid.
• CVE-2026-109619, remote code execution through stale global state. An internal state that belongs to one request can survive after its memory has been freed. A later request handled by the same worker process may use that stale state before PHP resets it.
• CVE-2026-115560, remote code execution through session deserialization attack. During a file upload, PHP's session upload progress feature writes attacker-supplied values into the session without validating them. If the application changes the session serialization format at runtime, PHP may decode those values as live objects on the next read.

In plain terms, an attacker who sends the right sequence of requests can corrupt the memory of the PHP process and run code as the web server account, without logging in. Exploitability varies by deployment. The PHP project rates the risk highest for Apache with mod_php, where a demonstrated exploit shows that a single unauthenticated request can trigger the attack before any application code runs. That detail matters: A well-written, fully patched application offers no protection if the PHP runtime underneath it is vulnerable.

Unlike the first two vulnerabilities, CVE-2026-115560 was not included in the October 21 emergency fixes. PHP plans to address it in the next regular bugfix release. Until that release is available and deployed, PHP recommends keeping session.upload_progress.enabled=0.

What leaders should take from this: PHP2Shell is a runtime problem, not an application problem. Application security reviews and code quality do not reduce the exposure; only the PHP version does.

Which systems are exposed

The PHP project lists every PHP installation that serves web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project. Some Linux distributions and long-term support (LTS) vendors provide backported fixes, and the PHP security team published minimal source backports for PHP 7.4, 8.0, and 8.1 for organizations that build from source.

The harder question is where PHP runs. CERT-EU points out that many commercial and open-source products use PHP as a backend and "could be also affected, even if they do not directly expose a PHP installation." Content management systems, customer portals, web-based admin consoles, and network or storage appliances can all carry PHP inside them. The UK's National Cyber Security Centre (NCSC) advises organizations not to limit discovery to outdated PHP versions, and to monitor third-party vendors "including for appliances and services that may bundle PHP as a component." CERT-EU and the NCSC both refer to an inventory of affected software products published by NCSC-NL.

What leaders should take from this: The first deliverable is a list. Internet-facing systems that run PHP directly, plus every product that embeds it, in that order.

Patch first, then use interim measures as a bridge

Prioritize internet-facing systems, especially Apache with mod_php, then work through other exposed PHP services and internal installations. The fastest safe route for most organizations is the distribution package. Linux distributions and LTS vendors received the patches in advance, so updated packages are often available before a team could build PHP from source. After updating, every PHP worker needs a restart. A server that still runs old worker processes is still vulnerable. The October 21 releases cover CVE-2026-109618 and CVE-2026-109619; the PHP project is addressing CVE-2026-115560 in its next regular bugfix release, so the interim setting for that one stays in place alongside the update.

Interim guidance from the PHP project also applies, either as a bridge while updates roll out (CVE-2026-109618 and CVE-2026-109619) or as the standing measure until the next bugfix release (CVE-2026-115560). Those measures address specific attack paths; they do not make an installation safe. They include:

• For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override, set a low post_max_size (8M for applications without file uploads, 32M where uploads are needed), and keep upload_max_filesize below it.
• For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. These settings must apply before request parsing, so ini_set() and FPM .user.ini files do not help.
• For CVE-2026-115560: set session.upload_progress.enabled=0 and restart every worker. Keep it enforced at a layer the application cannot override (ini_set() and FPM .user.ini files do not help), and leave it in place until the next PHP bugfix release.

Each of these settings can affect legitimate use, particularly file uploads, so they need testing. They should come with a date by which the real update will be in place. The NCSC goes further: If neither the update nor the mitigations can be applied quickly, organizations should consider taking the system offline, and should check for signs of compromise and backdoors before upgrading.

How Barracuda helps mitigate PHP2Shell

The PHP advisory recommends enforcing limits at the web server or proxy for decoded request size, input fields, multipart parts, headers, and nesting depth, including requests without a usable Content-Length. A web application firewall (WAF) or reverse proxy can help enforce these boundaries before requests reach the vulnerable runtime.

Barracuda Web Application Firewall and Barracuda WAF-as-a-Service, which are not affected by PHP2Shell, both provide request-size controls that can help reduce exposure to oversized-request attack paths when appropriately configured and enforced in blocking mode. (This will mitigate CVE-2026-109618.) Teams should verify the limits protecting each PHP-backed application and test their effect on legitimate traffic. These controls should not be treated as complete mitigation for both vulnerabilities.  

• For CVE-2026-109618 (oversized-request path): Barracuda has validated that the default request-handling policy blocks oversized-request exploitation for CVE-2026-109618 when the service runs in blocking mode.
• For CVE-2026-109619 (session upload progress path): Barracuda has released protections designed to reduce exposure to attacks targeting the session upload progress path. These protections are automatically applied to all Barracuda WAF-as-a-Service applications, while Barracuda Web Application Firewall customers can enable them through additional configuration guidance provided by Barracuda. Additional validation and coverage testing are ongoing.
• For CVE-2026-115560 (session deserialization path): The existing PHP_SESSION_UPLOAD_PROGRESS protections for CVE-2026-109619 also apply to this vulnerability. Barracuda has tested available proof-of-concept exploits and confirmed that they are blocked using the same approach, so no separate WAF mitigation is currently required. Customers should continue to follow PHP’s guidance and apply the future bugfix release when available.

Mode matters: A WAF in monitoring or passive mode records traffic but does not block it. Confirm enforcement rather than assuming a configured rule is actively protecting an application. Keep the PHP update at the center of the response. 

For CVE-2026-109619 and CVE-2026-115560 (session upload progress paths): Barracuda WAF-as-a-Service automatically applies protection against known exploit patterns involving PHP_SESSION_UPLOAD_PROGRESS. Barracuda Web Application Firewall customers and partners must apply the additional policy described in this Barracuda Campus article. Barracuda has tested currently available CVE-2026-115560 proof-of-concept patterns and confirmed that the same protection applies. No separate WAF mitigation is currently required for CVE-2026-115560.

The Barracuda team is keeping an active watch, and the research to find any additional attack vectors or mutations that can exploit these vulnerabilities is ongoing. 

Why lean teams and MSPs face added pressure

For organizations without a dedicated vulnerability management team, PHP2Shell arrives as one more urgent task on top of normal work. The inventory step is often the hardest part because PHP inside a third-party product does not show up in a list of installed packages. MSPs face the same problem multiplied across customer environments, often with different hosting setups, PHP versions, and change windows for each.

A practical approach is to triage by exposure rather than by customer: internet-facing systems on mod_php first, then other internet-facing PHP, then internal systems and appliances as vendor updates arrive. A short, consistent message to customers about what has been patched, what is waiting on a vendor, and what is protected by interim measures can prevent much of the follow-up work.

Your php2shell response checklist 

PHP2Shell is a short-window event: the fixes exist, and the details are public. The priorities for this week are:

1. Build the inventory. List every system that runs PHP, starting with internet-facing ones, and include appliances and products that embed PHP.
2. Patch to a fixed version. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 using distribution or LTS packages where possible, and restart every worker. For CVE -2026-115560, monitor for the next regular PHP bugfix release.
3. Plan for end-of-life versions. For PHP 8.1 and older, use a vendor backport or the PHP source backports as a stopgap, and schedule the move to a supported branch.
4. Apply interim measures where patching must wait. Disable session.upload_progress.enabled for CVE-2026-109619 and CVE-2026-115560. Use the PHP project's settings, test their impact on uploads, and set a deadline for the real update.
5. Check the web tier. Confirm that the WAF or proxy in front of each PHP application runs in blocking mode and enforces request-size limits.
6. Look for signs of compromise. For systems that stayed exposed after October 21, review web server and PHP worker logs for crashes and unexpected processes before closing the ticket.