What is PHP2Shell?

Two vulnerabilities in the runtime

CVE-2026-109618 concerns out-of-memory corruption. CVE-2026-109619 concerns request-owned global state that outlives its memory. The PHP project describes remote code execution risks. Successful exploitation may allow actions with the permissions of the PHP worker, with consequences that depend on the surrounding deployment.

These are PHP engine issues. WordPress, Laravel and other applications depend on a PHP runtime; their presence does not mean each framework has a separate PHP2Shell flaw. An application update alone does not replace the engine.

Why the deployment details matter

PHP’s security announcement calls for reviewing web-serving installations including Apache mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. Demonstrated mod_php paths can run before application code. Other paths depend on application behavior, extensions or configuration.

The stale-state issue involves a later request handled by the same worker. FPM startup failure handling differs from mod_php, but FPM also has validated application-dependent paths. Do not turn those differences into a blanket exemption.

Vulnerable does not mean compromised

Exposure means a vulnerable build or reachable behavior may exist. Compromise means an attacker has actually achieved unauthorized access or execution. A version check cannot bridge that evidentiary gap.

Conversely, a patched installation is not proof of a clean system. Patch the weakness and investigate suspicious evidence as separate tasks.

Your next three steps

• Inventory the exact serving runtime, package source and all deployed instances.
• Match the complete build to the upstream or vendor fix for both CVEs.
• Back up, test, update and restart or redeploy; investigate if evidence warrants it.