php2shell

What it means for your AI agents

Agent backends, MCP servers and webhook receivers are usually built on these runtimes and libraries. A flaw that runs code before authentication hands an attacker the agent's keys and tool access, not just the server.

• Check the services behind your agents and MCP tools, including ones that only call outward.
• Look for the affected component in dependencies too, not just the runtime you installed directly.
• Until patched, treat output from an affected service as untrusted input to your agents.

Updates

• Oct 26, 2026 : CISA added the original CVE-2026-109618 and CVE-2026-109619 vulnerabilities to KEV.
• Oct 23, 2026 : PHP published its session upload progress informational advisory for the related CVE-2026-115560, describing unusual serializer configuration prerequisites and recommending disabling upload progress pending the next regular bugfix release.
• Oct 21, 2026 : PHP published its initial security guidance for CVE-2026-109618 and CVE-2026-109619.

Details

php2shell is the name used for two PHP runtime vulnerabilities disclosed on 21 October: CVE-2026-109618 and CVE-2026-109619. They affect how PHP manages memory when processing an HTTP request fails unexpectedly, including when memory is exhausted.

Normally PHP allocates memory to process a request and safely releases it when work finishes. In these cases, an error can interrupt that process. PHP may then use internal data that was never fully initialized, or later follow references to memory that has already been released.

An attacker can send specially crafted HTTP traffic to trigger those conditions. The result can range from a crashed PHP process to information disclosure or attacker-controlled code execution. Updating website code or a plugin alone does not fix the runtime defect.

Related follow-up: CVE-2026-115560. PHP's 23 October informational advisory describes an additional RCE vector involving session upload progress. It requires upload progress to remain enabled and the application to switch its session serializer from php_binary or php_serialize to php at runtime, using ini_set() before session_start(). The advisory recommends disabling session upload progress pending the next regular bugfix release; applications that never change the serializer at runtime can keep the feature enabled. Patching the original php2shell vulnerabilities does not establish that this follow-up is addressed.

Risk

CISA lists the original two flaws as known exploited. The separate session upload progress flaw was not in CISA's catalog on November 9.

Affected deployments

Review PHP 5.4 or later serving web requests: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the original two flaws, and older branches need a vendor backport. The follow-up affects applications that enable session upload progress and change the serializer at runtime before starting a session.

Recommended action

Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.

1. 1Identify Internet-facing applications running PHP and establish their runtime version.
2. 2Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your vendor's backported fix, including through managed hosting providers. PHP security advisory
3. 3Review the session upload progress advisory for CVE-2026-115560 separately, including application serializer changes and any vendor updates that supersede its interim guidance. PHP session upload progress advisory
4. 4Review logs and incident-response processes for suspicious PHP request activity.
5. 5Keep edge mitigations enabled while the update is being deployed.

Use this prompt with an agent that can inspect your infrastructure.

Check your exposure with an agent

Paste this into an AI agent that can see your infrastructure. It asks for a read-only check of what's affected, including the systems behind your agents, and a table you can act on. Copying it changes nothing.

Assess whether the infrastructure you can access is affected by php2shell (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560). Work read-only within your authorized access: do not run exploits, change configuration, restart services or install anything.

1. Confirm the affected and fixed versions from the vendor advisories and CVE records:
   - https://www.php.net/archive/2026.php#2026-10-21-5
   - https://www.php.net/archive/2026.php#2026-10-23-1
   - https://www.cve.org/CVERecord?id=CVE-2026-109618
   - https://www.cve.org/CVERecord?id=CVE-2026-109619
   - https://www.cve.org/CVERecord?id=CVE-2026-115560
   - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   Cite each source and the date you read it. Say plainly what you could not verify.

2. Inventory the systems that could run the affected software, including the hosts, containers, MCP servers, tool runners and sandboxes behind any AI agents. For each, record the asset, environment, owner if known and the version actually running, from read-only evidence (package metadata, version commands, platform inventory).

3. Note which affected systems are reachable from the internet or from agents and tools, and which credentials (model-provider keys, tool tokens, service accounts) are stored on them.

4. Report one row per asset: asset, running version, affected (yes / no / unknown), reachable from, credentials at risk, evidence, and the next step. List anything you could not access as a gap rather than assuming it is safe.