PHP2Shell: How to Check, Patch and Mitigate CVE-2026-109618 and CVE-2026-109619

Timeline (dates as published by each source)

Inventory: every PHP on the box and the package behind it

Run it on each host and inside each container. The package revision is what proves a backport, not the version string.

# 1. Which branches are installed (Debian/Ubuntu layout)
ls /etc/php/
php -v                      # CLI only: the binary first on your PATH

# 2. The binaries that serve web requests
php-fpm8.4 -v               # Debian/Ubuntu: one php-fpmX.Y per branch
php-fpm -v                  # RHEL, Alma, Rocky, Remi module streams
apachectl -M 2>/dev/null | grep -i php   # php_module = mod_php (httpd -M on RHEL)

# 3. Package revisions: what matters when the fix is a backport
dpkg -l 'php*' 'libapache2-mod-php*' | awk '/^ii/ {print $2, $3}'
rpm -qa 'php*' | sort

# 4. Containers: what is running, not what the tag points to today
docker exec <container> php -v
docker run --rm --pull=always php:8.4-fpm php -v

# 5. From outside, only if expose_php is on
curl -sI https://example.com | grep -i '^x-powered-by'

What FPM really runs, without publishing a phpinfo() page

Red Hat’s bulletin warns that php -i only shows the CLI configuration. This asks the FPM socket directly, so nothing is exposed through the web server, and then lists processes still mapping an old PHP binary or module after an upgrade.

# cgi-fcgi comes from libfcgi-bin (Debian/Ubuntu) or fcgi (EPEL)
sudo tee /var/www/php2shell-check.php >/dev/null <<'EOF'
<?php
header('Content-Type: text/plain');
echo PHP_VERSION, ' ', PHP_SAPI, PHP_EOL;
foreach (['session.upload_progress.enabled', 'memory_limit',
          'post_max_size', 'fatal_error_backtraces'] as $k) {
    echo $k, ' = ', var_export(ini_get($k), true), PHP_EOL;
}
EOF
sudo env SCRIPT_FILENAME=/var/www/php2shell-check.php REQUEST_METHOD=GET \
  cgi-fcgi -bind -connect /run/php/php8.4-fpm.sock   # RHEL: /run/php-fpm/www.sock
sudo rm /var/www/php2shell-check.php

# After apt/dnf: processes still running a replaced PHP binary or module
sudo grep -l 'php.*(deleted)' /proc/[0-9]*/maps 2>/dev/null

PHP-FPM pool: settings an app can’t override

Straight from the php.net advisory and GHSA-6wmf-4rv5-p3rp. php_admin_value and php_admin_flag can’t be changed later with ini_set().

; /etc/php/8.4/fpm/pool.d/www.conf   (RHEL: /etc/php-fpm.d/www.conf)
php_admin_flag[session.upload_progress.enabled] = off
; -1 only together with a cgroup or container memory cap (below)
php_admin_value[memory_limit] = -1
; 8M if the app takes no uploads, 32M if it does
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 6M
; PHP 8.5 only, older branches don’t know this directive:
; php_admin_flag[fatal_error_backtraces] = off
; Last resort if performance doesn’t matter (GHSA-6wmf-4rv5-p3rp):
; pm.max_requests = 1

# No other pool, conf.d file or vhost may put a finite limit back
grep -rn 'memory_limit\|upload_progress' /etc/php/8.4/
sudo systemctl restart php8.4-fpm

Apache mod_php, plus the cgroup cap memory_limit=-1 needs

php.net wants an external memory boundary that kills only the affected worker. systemd’s MemoryMax= sets the cap; OOMPolicy=continue keeps the service up when the kernel kills one process (the default policy stops the whole unit). Size the cap to your machine.

# /etc/apache2/conf-available/php2shell.conf  (RHEL: /etc/httpd/conf.d/)
<IfModule php_module>
    php_admin_flag  session.upload_progress.enabled off
    php_admin_value memory_limit -1
    php_admin_value post_max_size 8M
    php_admin_value upload_max_filesize 6M
</IfModule>
sudo a2enconf php2shell && sudo systemctl restart apache2

# sudo systemctl edit php8.4-fpm   (or apache2 / httpd)
[Service]
MemoryMax=2G
OOMPolicy=continue

Signals named by the sources

• Wiz: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn.
• Amazon: POST requests with the PHP_SESSION_UPLOAD_PROGRESS string in form uploads. That string lives in the request body, so only a WAF or body logging will see it.
• PHP advisory: ‘Maximum execution time exceeded’, parse, compile and uncaught errors, warnings or deprecations repeated before your scripts run, and diagnostics during cleanup.
• Amazon’s IPs: six addresses on shared anonymization infrastructure. Amazon says to investigate hits rather than just block them.

Read-only log hunting (Debian/Ubuntu paths; adjust for RHEL)

Everything below only reads logs. zgrep and zcat -f read rotated .gz files too.

# 1. Fatal errors that act as triggers
sudo zgrep -hE 'Allowed memory size of [0-9]+ bytes exhausted|Maximum execution time of [0-9]+ seconds? exceeded' \
  /var/log/php*-fpm.log* /var/log/apache2/error.log* /var/log/nginx/error.log* 2>/dev/null | tail -50

# 2. Worker churn: FPM children dying, Apache children crashing
sudo zgrep -hE 'exited on signal|exited with code [1-9]' /var/log/php*-fpm.log* | tail -50
sudo zgrep -h 'exit signal' /var/log/apache2/error.log* | tail -20

# 3. Bursts of 500s on POST, by client IP and minute (combined log format)
sudo zcat -f /var/log/nginx/access.log* | \
  awk '$6=="\"POST" && $9==500 {split($4,t,":"); print $1, t[1]":"t[2]":"t[3]}' | \
  sort | uniq -c | sort -rn | head -20

# 4. The IPs Amazon published (shared infrastructure: investigate, don't just block)
sudo zgrep -hE '^(103\.216\.220\.92|31\.223\.184\.166|37\.19\.200\.5|134\.209\.159\.64|103\.114\.163\.188|95\.217\.98\.37) ' \
  /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null

Log what the default formats miss, for the next few weeks

The combined format records neither Content-Type nor response cookies. These formats add both. Set-Cookie values are live session IDs: restrict access to this log and delete it when you’re done.

# nginx (inside http {})
log_format php2shell '$remote_addr [$time_local] "$request" $status '
                     '$request_length "$content_type" "$sent_http_set_cookie"';
access_log /var/log/nginx/php2shell.log php2shell;

# Apache (needs mod_logio for %I)
LogFormat "%h %t \"%r\" %>s %I \"%{Content-Type}i\" \"%{Set-Cookie}o\"" php2shell
CustomLog ${APACHE_LOG_DIR}/php2shell.log php2shell

# PHPSESSID values far longer than your session.sid_length (default 32)
grep -ohE 'PHPSESSID=[^;" ]+' /var/log/nginx/php2shell.log | awk 'length($0) > 80' | sort | uniq -c | head