On October 21, 2026, Alibaba Cloud Security detected PHP’s official disclosure of two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. The vulnerability incident is also known as php2shell. Under certain conditions, unauthenticated attackers can craft malicious requests to execute arbitrary code with the privileges of the web worker process. Official PHP announcement
PHP is widely used in websites, content management systems, and enterprise applications. Successful exploitation could result in data breaches, website defacement, and service disruptions. Alibaba Cloud Security recommends that affected customers immediately assess their environments, upgrade to a patched version as soon as possible, and keep WAF or Cloud Firewall protection enabled during remediation to reduce business risk.
When PHP handles an out-of-memory (OOM) condition, execution may be interrupted before internal request data has been fully initialized. Subsequent request cleanup may access this invalid data, potentially resulting in remote code execution. PHP has confirmed unauthenticated remote code execution over HTTP in Apache mod_php environments. Exploitation can occur before application code begins executing. Vulnerability details
Some global state in PHP is either not properly reset or is written to again after being reset. When the same worker process handles subsequent requests, it may access freed request memory, triggering a use-after-free condition that can lead to remote code execution. PHP has confirmed unauthenticated remote code execution in Apache mod_php and PHP-FPM environments. The specific exploitation conditions depend on the PHP version, configuration, extensions, and application behavior. Vulnerability details
PHP recommends promptly updating all PHP deployments that handle web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed environments. Apache mod_php environments face particularly elevated risk. Official risk advisory
The affected and patched versions for both vulnerabilities across supported stable branches are listed below:
| PHP Branch | Affected Versions | Patched Version |
|---|---|---|
| PHP 8.2 | 8.2.0 ≤ PHP < 8.2.35 | 8.2.35 or a later version in the same branch |
| PHP 8.3 | 8.3.0 ≤ PHP < 8.3.36 | 8.3.36 or a later version in the same branch |
| PHP 8.4 | 8.4.0 ≤ PHP < 8.4.27 | 8.4.27 or a later version in the same branch |
| PHP 8.5 | 8.5.0 ≤ PHP < 8.5.12 | 8.5.12 or a later version in the same branch |
PHP 8.1 and earlier versions have reached the end of standard official security support. Some distributions and long-term support (LTS) providers may offer backported security patches. Contact your vendor to confirm whether both vulnerabilities have been addressed, or upgrade to a supported, patched version. When using distribution packages, determine patch status based on the vendor’s advisories and package revision numbers. Official upgrade guidance
To address these vulnerabilities, customers can use Security Center to inventory PHP assets and monitor host risks, Web Application Firewall to strengthen protection at application entry points, Cloud Firewall to control network access, and Managed Security Service to support investigation and response. While upgrading, confirm that the relevant business assets and traffic are covered by the appropriate protections to minimize coverage gaps.
Start by identifying which applications use affected PHP runtime environments. Users who have enabled Asset Fingerprints can navigate to Security Center → Assets → Host Assets to collect the latest information about software, processes, and websites. Cross-check this information against application deployment inventories, prioritizing internet-facing systems.
During the assessment, verify the version and patch status of the PHP service that actually handles web requests. Account for multiple PHP environments on the same host, and avoid mistaking the command-line PHP version for the version used by the web service.
Also review security alerts, web access logs, and PHP error logs for abnormal processes, suspicious files, and unusual outbound connections. Promptly investigate and respond to any suspected signs of compromise.
Customers using Alibaba Cloud Web Application Firewall should confirm that their PHP application domains are protected and that application traffic passes through WAF. WAF 3.0 users can navigate to Protection Configuration → Web Core Protection to verify that rules are enabled and effective for their applications, review detection engine update settings and rule actions, and continuously monitor attack logs. Web core protection rule documentation
Depending on application requirements, access controls can also be configured for upload endpoints and abnormal request rates to reduce unnecessary requests reaching PHP. Limits on decoded request body size and input complexity should also be enforced at the web server or reverse proxy layer.
Customers using Alibaba Cloud Firewall can review protection coverage for their application assets and navigate to Protection Configuration → IPS Configuration to check the threat engine’s operating mode and rule actions. Evaluate enabling blocking mode based on application requirements. Monitor mode only logs events and generates alerts; it does not block traffic. IPS configuration documentation
Also review access control policies, close unnecessary service entry points, restrict the permitted access sources for management interfaces and nonpublic applications, and continuously monitor intrusion prevention events and unusual outbound connections to reduce exposure.
Customers who have purchased Alibaba Cloud Managed Security Service can contact their service team for asset assessments, remediation plan evaluations, and upgrade verification within the scope of their purchased services. If a compromise is suspected, security experts can assist with incident assessment, malware removal, service recovery, and recommendations for further hardening. Emergency response service documentation
Upgrading PHP or installing the corresponding security patches is the key to remediating these vulnerabilities. Upgrade as soon as possible to a patched version listed above or a later version in the same branch, or install the corresponding security patches provided by your distribution or LTS provider.
Back up your environment and verify compatibility before upgrading. After upgrading, restart all PHP worker processes and confirm that the processes actually serving web requests have loaded the patched version. For containerized deployments, update container images and replace old instances to prevent affected versions from being reintroduced during scaling or redeployment.
If an immediate upgrade is not possible, consider the following measures based on your deployment environment. Temporary configuration changes and WAF or Cloud Firewall protection cannot replace PHP security updates. Continue working toward an upgrade and permanent remediation.
● Have an administrator enforce memory_limit=-1, restart all PHP worker processes, and confirm that process pool, directory, or application configurations do not reinstate a finite memory limit. Assess the risk of resource exhaustion and denial of service before removing the limit. This setting also does not address failures in underlying memory allocation.
● At the web server or reverse proxy layer, limit decoded request body size, input count, and input complexity, including the number of multipart sections and headers, the number of uploads, and nesting depth. These limits should also cover requests without a valid Content-Length.
● For applications that do not use multipart forms, block such requests before they reach PHP.
Do not use RLIMIT_AS or RLIMIT_DATA as substitute protections. See the official mitigation guidance for configuration details.
● Have an administrator enforce session.upload_progress.enabled=0. For PHP 8.5, also consider setting fatal_error_backtraces=0. These settings must take effect before request parsing, and all PHP worker processes must be restarted. Do not rely on application-level ini_set() calls or PHP-FPM .user.ini files.
● PHP-FPM users can set pm.max_requests=1 after evaluating the performance impact to reduce state reuse across requests.
These settings mitigate only some confirmed attack paths and do not address all stale global state issues. Hiding or disabling error output does not fix the vulnerability either. See the official mitigation guidance for additional investigation and configuration requirements.
1. Official PHP Security Announcements and Release Notes
2. CVE-2026-109618: RCE via OOM Corruption
3. CVE-2026-109619: RCE via Stale Global State
4. Official PHP Downloads
5. https://www.php.net/supported-versions.php
43 posts | 4 followers
FollowESA Big Fan - October 22, 2026
Alibaba Cloud Native Community - April 21, 2025
CloudSecurity - July 24, 2026
CloudSecurity - December 8, 2025
Alibaba Clouder - July 12, 2019
CloudSecurity - December 23, 2025
43 posts | 4 followers
Follow
WAF(Web Application Firewall)
A cloud firewall service utilizing big data capabilities to protect against web-based attacks
Learn More
Security Center
A unified security management system that identifies, analyzes, and notifies you of security threats in real time
Learn More
Data Security Center (Original SDDP)
An all-in-one data security solution that provides various features, such as sensitive data detection, classification, grading, and de-identification, to help you meet compliance requirements specified in General Data Protection Regulation (GDPR) and personal information protection
Learn More
Web Hosting Solution
Explore Web Hosting solutions that can power your personal website or empower your online business.
Learn MoreMore Posts by CloudSecurity
