CVE-2026-109619: the PHP2Shell stale-state flaw

CVE-2026-109619 at a glance

Nickname	PHP2Shell (with CVE-2026-109618)
Component	PHP core runtime — request data and session upload progress handling
Type	Remote code execution via stale (freed) state between requests
Severity	CVSS v4.0 9.2 — Critical
Login required?	No — unauthenticated, remote
Affected	PHP 5.4 through 8.5.11 serving web requests
Fixed in	8.5.12, 8.4.27, 8.3.36, 8.2.35
Advisory	GHSA-6wmf-4rv5-p3rp
Exploited?	Exploitation attempts reported in the wild

What does CVE-2026-109619 do?

A PHP worker process handles many requests one after another. CVE-2026-109619 is a use-after-free style bug: references to a request’s data can persist after that memory has been freed. A later request on the same worker can then reach the stale data.

In practice that means one request can poison the worker for the next one, and researchers showed the condition can be turned into remote code execution. PHP’s session upload progress feature is part of one confirmed attack path, which is why disabling it is one of the interim mitigations.

As with all pages on this site, we cover what defenders need and leave out anything that would help an attacker trigger the bug.

Who should worry most?

Every PHP setup that serves web requests needs the patch. CVE-2026-109619 deserves particular attention where workers live a long time:

• PHP-FPM pools — workers commonly serve hundreds or thousands of requests before being recycled.
• Apache mod_php — the PHP project’s top priority for patching overall.
• Persistent application servers such as FrankenPHP worker mode, Laravel Octane, RoadRunner or Swoole-based setups.
• php-cgi and LiteSpeed (lsphp).

How do I fix CVE-2026-109619?

1. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s patched package — see the patch guides.
2. Restart every PHP process that serves HTTP — PHP-FPM, Apache, LiteSpeed and any long-running worker server. Old workers keep the vulnerable code (and any poisoned state) in memory until they exit.
3. Verify the version that is actually serving traffic. How to check.

Interim mitigations specific to this CVE

If you can’t patch immediately, the PHP advisory and vendor guidance point to measures that reduce exposure. None of them is a fix.

• Disable session upload progress and restart workers:

  ; php.ini (or the FPM/Apache-specific ini file)
  session.upload_progress.enabled = 0

• Recycle PHP-FPM workers after every request — optional and expensive, but it stops state carrying over between requests:

  ; in your PHP-FPM pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf
  pm.max_requests = 1

• Enforce request-size limits at PHP and at the web server or proxy, keep WAF rules enabled, and restrict public access to anything that doesn’t need to be public.

Remember to revert performance-heavy settings such as pm.max_requests = 1 once you’ve patched. More detail on interim mitigations.

How can I tell if I’m vulnerable?

Use the version checker for a quick answer, or run npx php2shell-checker@latest --local --php /path/to/php-fpm on the server for the binary that really serves your site. If PHP comes from Ubuntu, Debian or RHEL packages, check the vendor tracker or package changelog — a backported fix may not change the version number.

Was I already attacked?

Exploitation attempts were seen on 17 October 2026, four days before disclosure. Because this flaw can expose memory belonging to other requests, plan to rotate secrets your PHP application handles (database passwords, API keys, session secrets) even if you find nothing obvious. Work through the compromise checklist.