Updates:
- 2026-10-23, 22:42 CET: We have improved the detection for our vulnerability test for PHP2Shell (HID-2-1-5412933). For the best detection, we recommend running an authenticated scan. We recommend running a rescan for the best possible detection and scan results.
- 2026-10-23, 09:57 CET: We have merged the two vulnerability tests (HID-2-1-5412933, and HID-2-1-5412942) into one with HID HID-2-1-5412933.
- 2026-10-22, 11:31 CET: Two tests are now available that can be used for unauthenticated and authenticated scanning (HID-2-1-5412933, and HID-2-1-5412942). Further down in this article, you will find instructions for how to scan for this vulnerability.
- 2026-10-21, 22:25 CET: We're working on vulnerability tests for this vulnerability. More updates will follow during the day.
- 2026-10-21, 22:25 CET: We're working on vulnerability tests for this vulnerability.
About the PHP2Shell vulnerability
PHP, the scripting language many websites and web applications are built on, contains two critical vulnerabilities that can give unauthenticated attackers remote code execution on servers handling web requests. CVE-2026-109618 exploits out-of-memory handling that leaves request data partially initialized, and CVE-2026-109619 exploits request state that survives after its memory has been freed. Both carry a 9.2 out of 10 (critical) CVSS v4.0 score, and the PHP project has released updates.
PHP’s security advisory (external link) | Holm Security's product security notice
How the vulnerabilities work
CVE-2026-109618
Remote code execution via OOM corruption.
Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. Exploitation requires crafted multipart requests and precise memory manipulation, and is confirmed only on Apache mod_php.
CVE-2026-109619
Remote code execution via stale global state.
Request-owned internal state can survive after its backing memory has been freed. A later request may use that stale state before normal initialization resets it, but only if handled by the same worker.
Why is this dangerous
Both vulnerabilities can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The PHP project considers the risk highest for mod_php. It has demonstrated an exploit where an unauthenticated request triggers the attack before any application code runs.
Affected software
The following versions are affected (earlier releases are likely also affected):- PHP 8.1 and older, which no longer receive updates from the PHP project
- PHP 8.2 releases earlier than 8.2.35
- PHP 8.3 releases earlier than 8.3.36
- PHP 8.4 releases earlier than 8.4.27
- PHP 8.5 releases earlier than 8.5.12
Mitigation & next steps
The PHP project urges users to upgrade to:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12, or later
There’s no complete workaround, and updating is the only safe choice. If you can’t update immediately, the vendor has provided measures in its advisory that reduce exposure to specific attack paths. Keep in mind that these measures don’t make an installation safe.
CRA incident report
Holm Security has sent an early incident notice to ENISA about this vulnerability, according to the new incident reporting requirements as of September 2026.
Holm Security’s response to PHP2Shell
Vulnerability test
Holm Security has released a vulnerability test for PHP2Shell (previously two vulnerability tests are now merged into one test):
- HID-2-1-5412933
Scan for PHP2Shell
Below, you will find information about how to scan for these vulnerabilities.
Identify your vulnerable PHP applications
Below, you will find information about how to understand if you have vulnerable PHP versions.
Information for customers using on-prem deployment
Read our information for customers using on-prem deployment.
Am I using on-prem?
On-prem deployment is when the customer has a self-hosted version of our platform, with a core machine installed from which our portals (Security Center, Organizer, and Back Office) are delivered. Customers using cloud deployment and possibly locally installed Scanner Appliances are not concerned by the information regarding on-prem.
Scan for PHP2Shell
Follow these steps to set up a specific scan profile for these vulnerabilities. After you have created the profile, you create a network scan based on the profile.- Log in to Security Center.
- In the main navigation bar, hover over Assessments.
- From the dropdown menu that appears, select Profiles.
- Click +Create scan profile > Network vulnerability.
- Recommended for better detection: Under Authentication, create an authentication record for the target.
- Under Include in the input Vulnerability, select the following HID:
HID-2-1-5412933 - Once you have done your selection, click Submit.
- The profile is now ready to be used in your network scan.
- Done!
Find vulnerable PHP applications
Follow these steps to understand which vulnerable PHP applications are running in your environment.
Option 1: Search your applications
- Login to Security Center.
- Click Assets > Applications.
- Type “php” in the Search field.
- Open the vulnerability to see more information.
Option 2: Search for the PHP Consolidation finding
- Login to Security Center.
- Go to All vulnerabilities.
- Filter on Severity and select Info.
- Click HID and search for "HID-2-1-305289 (PHP Consolidation)".
This way, you can see now which systems might be affected and decide which ones to fix first. PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.