PHP2Shell: patch critical PHP flaws now

On October 21, 2026, Germany's Federal Office for Information Security (BSI) warned about two critical vulnerabilities in PHP and rated the situation at criticality 3 of 4 ("orange"): measures must be taken without delay. According to current information, all known PHP versions are affected, going back to at least PHP 5. Attackers could execute malicious code on web servers without logging in and without any user interaction. The patches were released the same day at 16:00 German time, and the BSI expects widespread exploitation within a few hours. Patching is now the top priority.

But the patch cannot be installed everywhere right away. For exactly this window, Cloudflare rolled out emergency rules for its web application firewall on the same day. Wherever the managed rules are active for a web application, they reduce the risk right away, without touching the server.

What is known about PHP2Shell

The two flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10 under CVSS 4.0 (CVE and CVSS explained simply). In a nod to Log4Shell, reports also call them "PHP2Shell". According to the PHP project, the first flaw concerns out-of-memory handling: if PHP is interrupted while internal request data is only partially initialized, the later cleanup can treat that data as valid. With the second, request-owned internal state survives even though its memory has already been freed. A later request handled by the same worker can then use it.

All PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the risk highest for mod_php, where an exploit has been demonstrated in which an unauthenticated request triggers the attack before any application code runs. At the time of the warning, the BSI knew of no confirmed attacks, only unconfirmed reports of existing exploits.

Effective immediately: Cloudflare WAF rules

Cloudflare has published emergency releases for the Cloudflare Managed Ruleset and the free Cloudflare Free Ruleset. Both receive new rules in the group "Generic Rules - Anomalous Execution" that detect anomalous request patterns and ship with the action "Block". Because the WAF inspects traffic at the edge of Cloudflare's network, the rules take effect before a request reaches the web server. Nothing needs to change on the PHP system itself.

That matters right now, because for many systems there is no patch that can be installed yet. PHP 8.1 and older no longer receive official updates from the PHP project. Packages from distributions and third-party sources partly follow later; the widely used repository rpms.remirepo.net, for example, provided no updates on release day. Appliances such as pfSense or OPNsense need new firmware from the vendor, and container images have to be rebuilt. The WAF can bridge this gap between the patch and its installation.

It is still no substitute for the update. Cloudflare does not list any CVE numbers in the changelogs, and the BSI also notes that a WAF can only prevent exploitation if suitable detections are available and active. Three things should therefore be in place:

1. The managed rulesets are active for all affected zones, and the new rules are not weakened by exceptions or changed actions.
2. The origin server can only be reached through Cloudflare, for example via Cloudflare Tunnel or a firewall that only admits Cloudflare addresses. Otherwise attackers bypass the WAF via the direct address.
3. Firewall events are monitored so that hits on the new rules and possible false positives stand out early.

How a WAF can catch a flaw until the patch is in is something we already described using the WordPress flaw wp2shell.

How KAEMI helps right away

As a Cloudflare Authorized Service Delivery Partner, we can help immediately, including where the update will still take days. Web applications that are not yet behind Cloudflare we move there at short notice: set up the zone, route traffic through Cloudflare, enable the managed ruleset and lock down the origin server. For existing Cloudflare environments, we review rules, exceptions and how the servers can be reached. In parallel, we plan the updates with you so that the WAF stays a bridge and does not become a permanent state.

You can find more about our services on the application security page. For quick coordination, reach us via the contact form; existing customers can reach us around the clock via support.

Why hours count

PHP powers a large part of the web, so critical PHP flaws have a broad impact. The BSI names WordPress, Drupal, TYPO3, Joomla, Magento and Nextcloud, as well as firewall products such as pfSense and OPNsense and components of proprietary software. Then there is the speed. AI-assisted tools now make it possible to analyze patches quickly and turn them into exploits. The gap between release and the first wave of attacks is therefore measured in hours rather than days. How much AI shortens this window is the subject of our post When AI takes over the attack chain.

What to do now

Our recommendation for everyone running PHP systems:

1. Identify affected systems: inventory web servers, container images and appliances that use PHP, including systems that only ship PHP as a component.
2. Enable or review WAF protection right away so that the time until the update is covered.
3. Install the security updates as soon as they are available for the system in question: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you get PHP from your Linux distribution's package manager, check the backported versions it provides, and rebuild Docker images. Then compare the result with php -v against the advisory.
4. Treat old versions separately: minimal source backports exist for PHP 7.4, 8.0 and 8.1; otherwise only LTS vendors or an upgrade will help.
5. Monitor exposed web servers closely, especially for unusual processes, crashing workers and suspicious requests.

If a system cannot be updated at short notice, the PHP project also lists interim measures on the server, such as a low post_max_size or disabling session.upload_progress.enabled. They narrow individual attack paths but do not make an installation safe. As a last resort, the BSI suggests disconnecting the web server from the internet until the patch is in place.

Sources: BSI, press release "PHP: BSI warnt vor kritischen Schwachstellen" and cybersecurity warning BITS-H 2026-297981-1032 (October 21, 2026); PHP project, security advisory on CVE-2026-109618 and CVE-2026-109619 (October 21, 2026); Cloudflare changelog, "WAF Release 2026-10-21 Emergency" for the Managed and the Free Ruleset.