Security alert · PHP2Shell
PHP2Shell emergency check, offered by PCYBOX.
Two critical PHP flaws allow unauthenticated remote code execution. PCYBOX is helping 4 startups, SMEs or nonprofits check and fix their servers for free. This form gives us no access to your systems and asks for no password.
What you need to know
Two critical flaws in PHP itself.
They affect the PHP engine, not a specific application: a site can be vulnerable even if its own code is flawless.
- Flaws
- CVE-2026-109618 (memory corruption on out-of-memory) and CVE-2026-109619 (internal state reused across requests)
- Severity
- Critical: 9.2 (CVSS v4.0). Unauthenticated remote code execution.
- Affected
- Any PHP installation serving web requests: PHP-FPM, Apache with mod_php (highest risk), php-cgi, FrankenPHP, LiteSpeed.
- Fixed versions
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026.
- PHP 8.1 and older
- No official release. Minimal patches for 7.4, 8.0 and 8.1, or your distribution's packages. For 7.3 and older: upgrade required.
- Exploitation
- A first attempt was observed as early as October 17, four days before disclosure. Attempts multiplied from October 21. Look for traces from the 17th onward.
What to do now
The measures to apply, in order.
Updating PHP is the only complete fix. Temporary settings reduce the risk but are not enough.
Take inventory
List every server and hosting plan running PHP, starting with Internet-facing ones and those using Apache mod_php.
Update PHP
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's patched package. Then restart every PHP process (PHP-FPM, Apache).
If you cannot update right away
Limit the server's exposure to the Internet and apply the temporary settings below, each of which targets a different flaw. Set them in php.ini or in the FPM pool or Apache configuration (php_admin_value), never with ini_set or .user.ini, then restart every PHP process. If the site accepts no file uploads, also block multipart/form-data posts at the proxy.
Check for compromise
Look for unknown PHP files, added scheduled tasks or accounts, and unusual outbound connections. Make sure you have a clean backup before restoring anything.
Temporary settings recommended by the official php.net advisory:
; CVE-2026-109619 (stale internal state)
session.upload_progress.enabled = 0
fatal_error_backtraces = 0 ; PHP 8.5 only
; CVE-2026-109618 (out of memory)
memory_limit = -1
post_max_size = 8M ; 32M if the site accepts file uploads
upload_max_filesize = 6M ; always below post_max_sizeWarning: memory_limit = -1 removes PHP's memory limit. Pair it with a container or cgroup memory limit that only stops the affected process, otherwise a single process can exhaust the server. Do not use RLIMIT_AS or RLIMIT_DATA. These settings reduce the risk but do not replace the update.
On shared hosting? The update depends on your provider: ask them which PHP version is running and when they patched.
Our offer
A free check for 4 organizations.
For startups, SMEs and nonprofits without an in-house security team.
What the check includes
- Review of the PHP version and exposed configuration
- Update or patch, together with your team
- Search for signs of compromise
- Hardening recommendations for your hosting setup
- A written report
How it works
- You fill in the form: it gives us no access and asks for no password.
- We check that the request really comes from the organization concerned.
- We contact the selected organizations to sign a written authorization before any intervention.
- Organizations not selected receive the measures to apply themselves.
Form
Request the check.
Reply within two business days. Questions: contact@pcybox.com
The information you send is used only to process this offer. It is not saved on the website: it is sent to us by email, through our business email service, at contact@pcybox.com. It is neither sold nor shared. You can request access, correction or deletion at contact@pcybox.com, in line with Senegalese Law No. 2008-12 on personal data.