A PHP application can pass every functional test and still have a serious security problem running underneath it. This is one reason runtime security updates should never be treated as optional maintenance.
Remote Code Execution (RCE) is among the most serious vulnerabilities a web application can face. It allows an attacker to execute code on a server remotely. Depending on the vulnerability and the permissions of the affected process, an attacker may gain access to application files, environment variables, databases, and other server resources.
In October 2026, the PHP development team released emergency security updates for two critical remote code execution vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities were collectively referred to as PHP2Shell.
The important part is that the issue was not limited to a particular PHP framework or application. PHP installations serving web requests were affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
For developers maintaining existing PHP applications, this raises an important question: how do you identify vulnerable environments, apply the correct security updates, and make sure the application is safe to run again?
This article walks through the process using practical commands, configuration examples, and security checks that development teams can apply to existing PHP applications.
Understanding PHP Remote Code Execution Vulnerabilities
Remote Code Execution occurs when an attacker can cause a vulnerable application or runtime to execute unintended commands or code.
In a typical PHP application, incoming HTTP requests are processed by the PHP runtime. If a vulnerability exists in the runtime itself, an attacker may be able to exploit it before the application's normal business logic gets an opportunity to validate the request.
This is different from a traditional application-level vulnerability, where the problem might exist in an authentication controller, database query, or file upload handler.
The October 2026 PHP2Shell vulnerabilities involved problems with internal memory management.
CVE-2026-109618: Remote Code Execution Through Out-of-Memory Corruption
This vulnerability involved PHP's handling of out-of-memory conditions.
Under certain circumstances, memory allocation failures could interrupt request processing while internal request data was only partially initialized. Subsequent cleanup operations could then treat invalid internal data as valid.
This type of memory corruption can create an opportunity for an attacker to execute unintended code.
CVE-2026-109619: Remote Code Execution Through Stale Global State
The second vulnerability involved request-owned internal state that could remain available after its backing memory had been freed.
When a later request handled by the same worker encountered that stale state, it could potentially interact with invalid memory.
Both vulnerabilities were serious because they could allow unauthenticated remote code execution.
The PHP development team released security fixes on October 21, 2026. The official advisory identifies the affected runtime configurations and recommends immediate updates.
Identifying Affected PHP Versions
The first step is to identify which PHP version your application is actually using.
Do not assume that the PHP version installed on your development machine is the same as the version running on your production server.
Run the following command:
php -v
It displays the installed PHP CLI version.
For example:
PHP 8.4.26 (cli) (built: ...)
This version is below the patched PHP 8.4.27 release and therefore needs to be updated.
The fixed releases for the two October vulnerabilities are:
PHP branch | Vulnerable versions | Fixed version |
|---|
PHP 8.5 | Earlier than 8.5.12 | 8.5.12 |
PHP 8.4 | Earlier than 8.4.27 | 8.4.27 |
PHP 8.3 | Earlier than 8.3.36 | 8.3.36 |
PHP 8.2 | Earlier than 8.2.35 | 8.2.35 |
PHP 8.1 and earlier versions are outside normal PHP security support. Organizations using these versions should check whether their operating system vendor provides backported security fixes or plan a migration to a supported PHP release.
Check the PHP Version Used by the Web Server
Checking php -v is not enough in environments where multiple PHP versions or execution methods are installed.
For example, the command-line interface might use PHP 8.4 while Apache or PHP-FPM is still running an older version.
You can temporarily create a PHP diagnostic file:
<?php
echo "PHP Version: " . PHP_VERSION . PHP_EOL;
echo "SAPI: " . PHP_SAPI . PHP_EOL;
Save it as php-check.php and access it through your application's web server.
This helps identify the runtime version and Server API used for the request.
Remove the diagnostic file immediately after checking it. Never leave publicly accessible PHP information files on a production server.
For additional information, administrators can inspect PHP-FPM and Apache configurations to identify the actual runtime processes serving application traffic.
Applying PHP Security Updates
Once you have identified an affected PHP installation, the next step is to install the appropriate security release.
The exact update command depends on your operating system, PHP installation method, and package repository.
Updating PHP on Ubuntu and Debian
For PHP installations managed through APT, start by refreshing the package information.
sudo apt update
Check the available PHP packages:
apt-cache policy php8.4
If the repository provides the patched version, install the updated PHP packages.
sudo apt install --only-upgrade \
php8.4 \
php8.4-cli \
php8.4-common \
php8.4-fpm
If your application uses additional PHP extensions, check and update those packages as well.
For example:
sudo apt install --only-upgrade \
php8.4-mysql \
php8.4-curl \
php8.4-mbstring \
php8.4-xml
After installation, verify the CLI version:
php -v
Make sure the output shows PHP 8.4.27 or a later security-patched release.
One important point: the package manager may use vendor-specific version numbering or backported security patches. Check your operating system vendor's security advisory rather than assuming that an older-looking package version is necessarily unpatched.
Updating PHP-FPM
Applications using PHP-FPM need their PHP-FPM service restarted or reloaded after the update.
For PHP 8.4, you can use:
sudo systemctl restart php8.4-fpm
Check the service status:
sudo systemctl status php8.4-fpm
If Apache or Nginx communicates with PHP-FPM, verify that the web server can still connect to the PHP-FPM socket or configured network endpoint.
For example, check the Nginx configuration:
sudo nginx -t
If the configuration is valid, reload Nginx:
sudo systemctl reload nginx
Use the actual PHP-FPM service name installed on your server. It may differ depending on the PHP branch.
Updating PHP in Docker Containers
Many applications run PHP inside Docker containers. In this setup, updating PHP on the host machine does not update the PHP runtime inside the container.
Consider an existing Dockerfile:
FROM php:8.4.26-fpm
WORKDIR /var/www/html
COPY . .
EXPOSE 9000
Update the base image to the patched release:
FROM php:8.4.27-fpm
WORKDIR /var/www/html
COPY . .
EXPOSE 9000
Rebuild the image:
docker build -t my-php-app:patched .
Start a new container using the updated image and verify its runtime:
docker run --rm my-php-app:patched php -v
For an application deployed through Docker Compose:
docker compose build --pull
docker compose up -d
Do not assume that restarting an existing container updates its underlying PHP version. Containers must use an image containing the patched runtime.
For production systems, use controlled image builds, retain the previous deployment for rollback, and verify the PHP version running inside the newly deployed container.
Checking PHP Dependencies and Application Compatibility
Updating the PHP runtime is only one part of the security update process.
Existing applications may depend on extensions, Composer packages, framework versions, and custom integrations.
After updating PHP, verify that these components continue to work.
Check Composer Dependencies
For applications using Composer, inspect the dependency configuration:
composer show
You can also check for known security advisories affecting installed packages:
composer audit
This command identifies reported security vulnerabilities in Composer dependencies.
It is important to understand that Composer audit checks application dependencies. It does not replace updating the PHP runtime itself.
If your application uses Laravel, Symfony, or another PHP framework, verify that the installed framework version supports the updated PHP branch.
Validate Required PHP Extensions
Run:
php -m
This lists the PHP extensions enabled for the CLI runtime.
Common application dependencies include:
Extension | Purpose |
|---|
pdo_mysql | MySQL database connectivity |
mysqli | MySQL database operations |
curl | External HTTP requests |
mbstring | Multibyte string handling |
openssl | Cryptographic operations |
xml | XML processing |
intl | Internationalization functionality |
gd | Image processing |
Check the extensions required by your application rather than installing every available PHP extension.
Also verify the extensions enabled in PHP-FPM or Apache because CLI and web-server configurations can differ.
Testing the Application After Applying Security Patches
A security update should not be considered complete simply because the PHP version command displays the expected release.
The application must also be tested using the updated runtime.
Consider a simple PHP application that connects to a database and returns a health status.
<?php
header('Content-Type: application/json');
try {
$pdo = new PDO(
'mysql:host=localhost;dbname=app_database',
getenv('DB_USERNAME'),
getenv('DB_PASSWORD'),
[
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]
);
$pdo->query('SELECT 1');
echo json_encode([
'status' => 'healthy',
'php_version' => PHP_VERSION,
'database' => 'connected'
]);
} catch (Throwable $exception) {
http_response_code(503);
echo json_encode([
'status' => 'unhealthy',
'message' => 'Database connection failed'
]);
}
This example checks whether PHP can establish a database connection and execute a simple query.
In production, avoid returning exception details or internal configuration information to public clients. Log diagnostic details securely on the server instead.
What Should Be Tested?
After updating PHP, validate the application workflows that matter most.
Test area | What to verify |
|---|
Application startup | PHP-FPM and web server start correctly. |
Authentication | Login, logout, and session handling work. |
Database | Queries, transactions, and connections work. |
File uploads | Upload validation and storage work. |
External APIs | Requests, authentication, and responses work. |
Background jobs | Queue workers and scheduled tasks execute correctly. |
Error handling | Exceptions are logged without exposing sensitive details. |
Performance | CPU, memory, and request latency remain within expected limits. |
For larger applications, execute the existing automated regression suite against the patched runtime before completing the deployment.
Investigating Possible Exploitation
Applying a security patch protects the application against the known vulnerability, but it does not establish that the server was never compromised.
If a PHP application was publicly accessible while running a vulnerable version, review its logs and runtime activity.
The PHP2Shell vulnerabilities are particularly important because they can affect request processing before normal application code executes.
Check for unusual activity such as:
PHP worker processes launching shell commands unexpectedly.
Unknown processes running under the web server account.
Unexpected files appearing in application directories.
Unusual outbound network connections.
Unexpected changes to application configuration files.
New or modified scheduled tasks.
Suspicious authentication or administrative activity.
Review web server and PHP-FPM logs.
For example:
sudo journalctl -u php8.4-fpm --since "24 hours ago"
You can also inspect running processes:
ps aux | grep -E 'php-fpm|php-cgi'
These commands help identify running PHP processes and review recent service activity. However, they are not a complete compromise detection solution.
If you find evidence of unauthorized code execution, treat the system as potentially compromised. Isolate the affected server, preserve relevant logs, investigate the intrusion, and rebuild from a trusted source where necessary.
Also rotate credentials that may have been exposed, including database passwords, API keys, deployment credentials, and other secrets accessible to the compromised PHP process.
Best Practices for Preventing PHP Security Issues
Fixing the current vulnerability is important, but maintaining a secure PHP application requires a regular process.
Maintain Supported PHP Versions
Avoid running applications on PHP versions that have reached end of life.
PHP provides separate active support and security-only support periods. Once a branch reaches end of life, it no longer receives normal security fixes.
Maintain an upgrade schedule so that runtime migration does not become an emergency activity.
Automate Runtime Version Checks
Add a PHP version verification step to your CI/CD pipeline.
For example:
php -r '
$required = "8.4.27";
if (version_compare(PHP_VERSION, $required, "<")) {
fwrite(STDERR, "PHP security update required.\n");
exit(1);
}
echo "PHP runtime version check passed.\n";
'
This example prevents the pipeline from continuing when the installed PHP version is below the configured minimum.
For multiple supported PHP branches, maintain the appropriate minimum version for each deployment environment.
Keep Production Permissions Restricted
Run PHP workers with the minimum operating system permissions required by the application.
Avoid running PHP-FPM or Apache worker processes as root.
Separate application code from writable directories such as file uploads, cache storage, and temporary files.
This does not eliminate runtime vulnerabilities, but it can reduce the damage an attacker can cause after compromising a PHP process.
Protect Application Secrets
Do not store database passwords, API tokens, or private keys directly in source code.
Use environment variables or a dedicated secrets management solution.
Ensure that application logs, diagnostic endpoints, and error responses do not expose these values.
Monitor Security Advisories
Include PHP security advisories in your regular maintenance process.
When a critical vulnerability is announced, identify affected servers, prioritize internet-facing systems, and apply the recommended updates without waiting for the next routine maintenance window.
Common Mistakes When Fixing PHP RCE Vulnerabilities
Mistake | Why it is a problem | Correct approach |
|---|
Updating only the CLI version | The web server may still use an older PHP runtime. | Verify PHP-FPM, Apache, and other web execution environments. |
Updating the host but not Docker | Containers continue running the vulnerable image. | Rebuild and redeploy patched container images. |
Ignoring unsupported PHP versions | Older branches may not receive official security updates. | Upgrade or obtain verified vendor backports. |
Assuming a WAF fixes the issue | A WAF cannot reliably replace a runtime security patch. | Apply the official PHP update. |
Skipping regression testing | Application functionality may break after the update. | Test important workflows in staging. |
Ignoring possible compromise | An attacker may already have accessed the server. | Investigate logs and rotate exposed credentials. |
Troubleshooting PHP Security Update Problems
PHP Version Has Not Changed After Updating
Sometimes the package manager updates one PHP installation while the application continues using another.
Check the CLI version:
php -v
Check the PHP-FPM version:
php-fpm8.4 -v
The executable name may differ depending on the installation.
Also verify the web server's configured PHP-FPM socket and the version behind that socket.
PHP-FPM Fails to Start
Check the service logs:
sudo journalctl -u php8.4-fpm -n 100
Look for missing extensions, invalid configuration directives, permission problems, or incompatible configuration files.
Validate the PHP configuration:
php-fpm8.4 -t
Resolve the reported configuration issue before restarting the service.
Application Reports Missing Extensions
After upgrading PHP, some extensions may need to be installed or enabled separately.
For example:
sudo apt install php8.4-mysql php8.4-curl
Check the installed extensions:
php -m
Remember to verify the corresponding PHP-FPM configuration as well.
Application Still Uses an Older PHP Version
If you use multiple PHP branches, check the active web server configuration.
For Apache, inspect the enabled PHP modules and handler configuration. For Nginx, verify the configured PHP-FPM socket.
Restart the appropriate services after correcting the configuration.
Advantages and Disadvantages
Advantages
Protects against known remote code execution vulnerabilities.
Reduces the risk of unauthorized server access.
Keeps the PHP runtime within a supported security release.
Helps maintain application and infrastructure security.
Makes future runtime maintenance easier when updates are applied regularly.
Disadvantages
Requires deployment and compatibility testing.
May require rebuilding Docker images and restarting services.
Older applications may need framework or extension updates.
Unsupported PHP versions may require a larger migration.
Emergency patching can require additional coordination between development and infrastructure teams.
These disadvantages are mainly operational challenges. They should not be a reason to postpone critical security updates.
Summary
PHP remote code execution vulnerabilities require immediate attention because they can allow attackers to execute code on a server without normal application authentication.
The October 2026 PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, demonstrate why runtime security is just as important as application-level security.
The correct approach is to identify every PHP installation, determine which environments are affected, install the appropriate patched release, and verify the runtime used by the actual web server.
For applications running inside Docker, rebuild and redeploy the images. For PHP-FPM installations, verify the updated service and its configuration. After deployment, run regression tests and investigate suspicious activity if the server was previously exposed.
Most importantly, do not stop at checking the PHP version. A secure application also needs supported dependencies, restricted permissions, protected credentials, and continuous security monitoring.
A properly maintained PHP runtime is an important part of keeping existing applications reliable and secure.
Join the conversation! Your thoughts help the community grow.