PHP2Shell Security Update: Patch PHP and Disable Upload Progress

The PHP security team has fixed two critical vulnerabilities that can let attackers execute code on a web server without logging in, but the emergency response now has another complication. On October 23, 2026, the team disclosed a third remote-code-execution issue affecting an unusual combination of session settings and application behavior, recommending that administrators disable session upload progress until the next regular bug-fix release. The PHP2Shell security update therefore requires more than installing a patched version: teams must also check their running workers and apply the additional mitigation.

Why the PHP2Shell security update needs immediate attention

The original vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21. Both received a Common Vulnerability Scoring System (CVSS) score of 9.2 out of 10, placing them in the critical severity category. They affect PHP itself, the server-side language runtime that processes requests for websites and applications, rather than a particular content management system or plugin.

The exposure is broader than a single hosting setup. The PHP team identifies PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed among the affected ways of serving web requests. Its advisory identifies Apache's mod_php configuration as particularly risky because a demonstrated attack can trigger the vulnerability before application code runs. That means an application-level login check cannot be assumed to protect a vulnerable runtime.

Independent guidance from the European Union Agency for Cybersecurity's CERT-EU also warns that proof-of-concept exploits are circulating. A proof of concept demonstrates how a vulnerability can be exploited; it does not, by itself, establish that every vulnerable server has been attacked. Administrators should nevertheless prioritize internet-facing PHP services because successful exploitation could give an attacker code execution under the privileges available to the affected process.

Which PHP versions contain the original fixes

The PHP project released patched versions across its supported stable branches on October 21. Administrators should select the fixed release corresponding to their existing branch rather than assuming that installing the newest major version is the only option. The following versions address the original two vulnerabilities.

PHP 8.1 and older branches no longer receive routine upstream security updates. The PHP team has provided minimal source patches for PHP 7.4, 8.0 and 8.1 to help organizations that build from source or lack access to a vendor-maintained long-term-support package. Those patches are not a substitute for planning a move to a supported version, and administrators should check whether their operating-system or hosting vendor has supplied a maintained fix for their particular installation.

How the two original vulnerabilities work

CVE-2026-109618 involves memory corruption during an out-of-memory condition. PHP can interrupt request processing when a request exceeds its configured memory limit, but the interruption can happen while internal request data is only partly initialized. During cleanup, the runtime may then treat invalid data as valid and mishandle memory, potentially allowing an attacker to execute code.

CVE-2026-109619 involves stale internal state. Memory associated with one request can be released while information referring to it remains available to a worker that handles later requests. If the worker uses that information before it is properly reset, the resulting memory error can create another route to remote code execution. These are runtime-level failures, not simply mistakes in a website's own PHP code, which is why reviewing application permissions or adding a login screen does not replace the security update.

The October 23 advisory adds a third issue

The additional vulnerability, CVE-2026-115560, is different from the original pair because PHP says exploitation requires an unusual combination of configuration and application behavior. An application must configure the session serialization handler as php_binary or php_serialize, change it to php at runtime using ini_set() before calling session_start(), and leave session upload progress enabled. Applications that never change the serialization handler at runtime do not need to disable this feature specifically because of CVE-2026-115560.

The PHP project has not issued a separate emergency release for this third vulnerability. Its October 23 informational advisory says the issue will receive a full advisory with the next regular release because the required configuration is considered unlikely in practice. That does not mean the vulnerability is already fixed: administrators who need full protection should apply the recommended configuration change now and keep it in place until the project provides further guidance.

Disable session upload progress and restart PHP workers

The PHP team's immediate recommendation is to set session.upload_progress.enabled=0. This disables PHP's session upload-progress tracking, a feature that can expose the progress of file uploads through session data. The setting also addresses a confirmed attack path associated with CVE-2026-109619, so administrators who applied it as an earlier precaution should leave it enabled as a mitigation.

Apply the setting in a configuration source that takes effect before request parsing, such as php.ini, a PHP-FPM pool configuration or the relevant server configuration. Do not rely on calling ini_set() from application code or placing the setting in an FPM .user.ini file for this mitigation. After changing the configuration, restart the affected PHP workers so that already-running processes use the new setting.

session.upload_progress.enabled=0

This setting is a mitigation, not a replacement for installing the October 21 security fixes. It blocks the confirmed session-related paths described in the advisories, but it does not guarantee protection against every possible variant of the original vulnerabilities. The third issue also requires administrators to keep track of the next regular PHP release and review its full advisory when available.

Verify the patch is running, not merely installed

Updating a package on disk does not always update the PHP executable or shared library already loaded by a running web server. Google Cloud's security guidance specifically tells administrators to restart the actual web-serving processes, including PHP-FPM, Apache or HTTP Server, FrankenPHP and LiteSpeed where applicable. A server can therefore appear patched in its package manager while existing workers continue to execute vulnerable code.

After upgrading, verify the runtime version through the same execution path used by the website, not just by running php -v in a shell. Command-line PHP and the PHP runtime serving web requests can use different installations or configurations. For containerized deployments, rebuild images that contain PHP and redeploy the affected services; for managed hosting, confirm whether the provider has applied the update to the runtime actually serving requests.

Finally, review the configuration for session upload progress and restart all relevant workers after changing it. Check that the deployment is using a fixed version, that the temporary mitigation is active, and that the application does not rely on the unusual runtime serialization-handler change described in the third advisory. If immediate patching is impossible, CERT-EU recommends considering isolation of internet-facing applications until the fix has been applied and verified.

What PHP administrators should do next

Patch the affected PHP branch, restart the processes that serve requests, and disable session upload progress while the additional vulnerability remains unpatched. Then inventory the less obvious places PHP may be bundled, including application containers, hosting control panels and third-party appliances. A web application can remain exposed even when its main server appears current if a separate component still embeds an outdated runtime.

Teams should also review logs for unexpected processes, suspicious requests and other signs of compromise, particularly on internet-facing systems that remained vulnerable after the fixes became available. Patching closes the known vulnerabilities but cannot establish whether an attacker already used them. The next regular PHP bug-fix release and its full advisory will determine when administrators can reassess the temporary mitigation for CVE-2026-115560.