PHP2Shell (CVE-2026-109618 / CVE-2026-109619): what it is and temporary risk reduction

PHP2Shell refers to two critical flaws in the PHP runtime itself: CVE-2026-109618 and CVE-2026-109619. Under certain conditions they can lead to remote code execution (RCE) on servers running unpatched PHP — a business risk of site compromise, data exposure and lateral movement.

Public research and PoCs already exist. The only complete fix is upgrading PHP to patched builds. Everything else is a short-term shield until the update window.

Patched releases

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

Temporary mitigations (stopgap)

Not a substitute for upgrading to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.

1. Config: session.upload_progress.enabled = Off (php.ini or php_admin_flag in FPM); on 8.5 also fatal_error_backtraces=0; pair CVE-2026-109618 mitigations (memory_limit=-1 + cgroup, low post_max_size; never RLIMIT_AS/RLIMIT_DATA)
2. Cloudflare WAF: multipart / PHP_SESSION_UPLOAD_PROGRESS rules; do not block solely on PHPSESSID
3. FrankenPHP: php_ini session.upload_progress.enabled 0 in the Caddyfile
4. Lighttpd: deny multipart on non-upload routes for POST/PUT/PATCH
5. Apache: ModSecurity rule on PHP_SESSION_UPLOAD_PROGRESS; or rewrite-deny multipart where uploads are unused

SoftTech helps with inventory, hardening and patch windows: information security, infrastructure administration.

Defensive article only — no exploit steps.

Frequently asked questions

Is disabling session.upload_progress enough?

No. It only partially covers a confirmed CVE-2026-109619 path and does nothing for CVE-2026-109618. Patch PHP.

Are Laravel/Bitrix/WordPress sites affected?

Yes if the underlying PHP is vulnerable. Upgrade the runtime (or image), not only the CMS.

Can SoftTech check our servers?

Yes: version inventory, temporary hardening and a controlled patch plan under managed support or a security audit.