Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

ServerPilot has updated PHP on all servers for the two critical PHP vulnerabilities known as PHP2Shell. These vulnerabilities allow unauthenticated remote code execution and affect all PHP versions, including end-of-life PHP versions that no longer receive official updates.

The PHP project rated both vulnerabilities as critical (CVSS 9.2), gave one day advance notice of today’s security release, and published a security advisory with the release. Details of the vulnerabilities leaked online the day before the release.

About the vulnerabilities

CVE-2026-109618 is caused by how PHP handles running out of memory. When a request reaches PHP’s memory limit at certain points during the request, PHP can leave the request’s memory in an invalid state. An attacker can cause a request to run out of memory with a specially crafted HTTP request, such as a large or complex form submission or file upload.

CVE-2026-109619 is caused by PHP keeping data from one request that is then used by a later request. When a request ends with a fatal error, PHP can keep references to memory that has already been freed. One way an attacker can trigger this is through PHP’s session upload progress feature, which is enabled by default.

Both vulnerabilities can be exploited remotely by an attacker who can make HTTP requests to an app. The attacker does not need to be logged in to the app.

Affected PHP versions

The vulnerabilities affect all PHP versions.

The PHP project has released updated versions of PHP 8.2 and later that fix the vulnerabilities.

PHP 8.1 and earlier are end-of-life and no longer receive official PHP releases. For PHP 7.4, PHP 8.0, and PHP 8.1, the PHP project has published official patches but has not released new versions. For PHP 7.3 and earlier, the PHP project has not published patches.

What we have done

ServerPilot has updated the PHP packages for PHP 5.6 and later on all servers.

• PHP 8.2 and later: We have installed the latest PHP releases that fix the vulnerabilities.
• PHP 7.4, PHP 8.0, and PHP 8.1: We have updated PHP to versions that include the official patches published by the PHP project (PHP 7.4, PHP 8.0, PHP 8.1).
• PHP 7.0 through PHP 7.3: We have backported the official patches.
• PHP 5.6: We have changed PHP 5.6’s default settings to the partial mitigations recommended by the PHP project:
  • session.upload_progress.enabled is now 0 (disabled).
  • max_input_nesting_level is now 16.
  • post_max_size is now 32M.

Changes to PHP 7.0 through PHP 8.1

The official patches for PHP 7.4, PHP 8.0, and PHP 8.1, as well as our backported patches for PHP 7.0 through PHP 7.3, change what happens when a PHP request runs out of memory.

When a request reaches PHP’s memory_limit, the PHP process now exits immediately instead of ending the request with a PHP fatal error. The Allowed memory size exhausted error is written to the PHP-FPM service log rather than the app’s PHP error log, and PHP shutdown functions do not run.

These patches also disable PHP’s session upload progress feature.

What you should do

Confirm the PHP packages were updated

To determine the versions of the PHP packages installed on a server, SSH into the server and run the following command:

dpkg --list 'sp-php*'

Next, check if the version of each installed PHP package is equal to or greater than the patched version.

If a package has not been updated, SSH into your server as root and run the following command to update the PHP packages:

sudo apt update && sudo apt install --only-upgrade 'sp-php*'

Move apps off of PHP 5.6

PHP 5.6 has only received partial mitigations for these vulnerabilities.

Apps that use PHP 5.6 can no longer accept requests, including file uploads, larger than 32 MB by default. If an app needs to accept larger requests, you can increase post_max_size with a .user.ini file. Increasing post_max_size reduces the protection the new default provides.

Move apps to a supported PHP version

PHP 8.1 and earlier no longer receive official PHP releases. Although we have updated these PHP versions for these vulnerabilities, future vulnerabilities may not be fixed in these PHP versions.

Contact support

If you have questions about your server, please contact support.