2 critical flaws in the PHP runtime let attackers run code on your web servers without logging in. Follow 5 steps to find every PHP installation, reduce exposure today, and prove the fix.
Answer 4 questions about a server or server group. The playbook shows its priority, whether its PHP version is fixed, and the fastest stopgap available to you.
Both bugs live in the PHP runtime, so they can fire before your application code runs. Exploitation depends on allocator layout, build and worker scheduling.
Researchers demonstrated RCE for both CVEs, including with default limits and the prefork MPM. The exploit can fire before app code runs.
FPM's startup behavior blocks 1 out-of-memory path, but the PHP security team confirmed RCE through the session lifecycle.
Your configuration and application decide how exploitable these are.
Parallel branches, container images, hosting panels and PHP bundled in appliances.
Attacks are live. Cloudflare has reported attack traffic, including attempts to evade its protections.
Exploit code is public. Proof-of-concept scripts have spread quickly on GitHub.
Secrets can leak. Worker memory can expose passwords, tokens and API keys, without authentication.
Each step starts with its goal and what "done" looks like. Open the details only when you need them.
Build one inventory of every PHP installation, including the hidden and end-of-life ones, and see it in one view. You can't protect PHP you don't know about.
You've tagged every PHP asset, including containers, hosting panels and appliance-bundled PHP.
Save each as a dynamic tag, for example "PHP2Shell – EOL PHP". Matching hosts join automatically, and you can reuse the tag in VMDR, dashboards and patch jobs.
(software: ((name: "php")))
((software: (((name: "PHP") AND (version: (*..8.1))))))
((asset.criticalityScore: [4..*)) AND (software: (((name: "PHP") AND (version: (*..8.1))))))
Matches new vendor advisories (Red Hat, Ubuntu, Debian, Oracle Linux) against inventory you already have, typically within minutes. No new scan needed.
Finds PHP binaries in custom folders and secondary drives, with path, installed version and fixed version. Requires Windows and Cloud Agent 6.2 or later. Included with VMDR.
Find PHP in AMIs, images, Kubernetes and serverless. Runtime Vulnerability Reachability (eBPF) shows which vulnerable packages are actually running.
Flags web apps and APIs that expose a PHP version, including ones missing from host inventories. Treat it as an indicator, not proof.
One place to find every PHP instance in your environment, see which ones are actually at risk, and decide what to fix first.
Download the dashboard from the PHP2Shell blog using the button above.
Import the file into the Unified Dashboard module.
In the Dashboard tab, open the Dashboard Picker and select PHP2Shell Fightback. Its widgets start showing PHP data from your subscription.
Your subscription doesn't include this dashboard by default, so download and import it yourself, or ask your TAM for help. Turn on Trending for the remediation widgets to show leadership how exposure falls as you mitigate and patch.
Qualys keeps tuning and updating the dashboard as new CVEs and patches roll out for each PHP version.
QID 45110 (PHP Server Detected) finds installations but doesn't confirm a vulnerability. Use it as your discovery baseline.
A vulnerable version isn't always an exploitable system. Detect with QIDs, then confirm with ETM TruConfirm so your team works on real risk first.
You have a ranked list of vulnerable systems, each with an owner and a deadline.
| QID | What it detects | Notes |
|---|---|---|
| 45110 | PHP Server Detected | Inventory |
| 48394 | PHP Installation and Configuration Detected | Inventory |
| 389102 | PHP2Shell multiple vulnerabilities | Cloud Agent Container Sensors |
| 39033 | PHP2Shell | Unauthenticated |
| 39036, 389141 | Session upload-progress RCE (CVE-2026-115560) | Coming soon |
| 520310, 533086 | PHP2Shell checks for web apps and APIs | TotalAppSec |
| 520404 | Session upload-progress RCE in web apps | TotalAppSec |
| 533068 | PHP2Shell intrusive check | Can crash unpatched apps |
Run QID 533068 carefully. Use it only in non-production or on verified-patched systems, with approvals, inside a maintenance window.
| QID | Advisory |
|---|
Source: the Qualys blog. Qualys adds QIDs as vendors publish advisories, so also search the KnowledgeBase by CVE.
Verify the target runs PHP.
Send a benign probe: an upload request that mimics an attacker's first move, with no files, no code and no memory pressure.
Confirm exposure: PHP startup warnings show the entry point is reachable and session.upload_progress.enabled=0 is missing.
ETM TruConfirm raises the TruRisk score of each confirmed exposure and moves it up the queue with evidence attached.
Internet-facing Apache mod_php
Other publicly reachable PHP services
Business-critical apps, using the CSAM criticality score
End-of-life branches that need an upgrade or backport plan
98.4% fewer assets to act on first. Start mitigation with the confirmed 25, then work through the rest. A negative result doesn't prove every path is closed, so keep patching.
Run PoCs only on a snapshot clone in an isolated lab. To your WAF and SIEM, PoC traffic looks like a real attack.
Turn off session upload progress and harden the related session-handling configuration on every host that's waiting for a patch. You change configuration only, not application code.
Every PHP worker runs the new config, Qualys confirms the effective configuration, and you've tested apps that use upload progress.
In TruRisk Eliminate, go to Home › Overview › PHP2Shell Remediation.
On the Agent-Based Remediation widget, select View Risk Elimination to open the affected assets.
Apply the Qualys mitigation via Mitigate Now, or deploy the vendor patch when one is available, such as Ubuntu's PHP security updates.
Mitigate Now also appears for vulnerable detections on your Qualys dashboards, including the PHP2Shell Fightback dashboard. Requires the Qualys Cloud Agent.
In TruRisk Eliminate, go to Home › Overview › PHP2Shell Remediation.
On the Agentless Remediation widget, select View Risk Elimination to open your scanner-based assets, such as appliances and network devices.
Run the PHP2Shell mitigation script from the Custom Assessment and Remediation (CAR) library directly on those assets.
Both routes disable the PHP session upload-progress feature, restart the PHP service automatically, and verify that the setting is active and not overridden. Review the execution logs and restart PHP manually if a restart is still required. The mitigation works on end-of-life PHP too, but it's temporary: updating PHP is the only complete fix.
The PHP2Shell Remediation section on the TruRisk Eliminate Home page shows your exposure as soon as you log in, with no query to build. It's marked Critical and lists the CVEs it tracks. Counts come from open VMDR detections for the QIDs tied to CVE-2026-109618 and CVE-2026-109619.
| Widget | Covers | Shows | View Risk Elimination opens |
|---|---|---|---|
| Agent-Based Remediation | Assets with the Qualys Cloud Agent | Detections: open PHP2Shell detections | The affected assets, ready for Mitigate Now or the vendor patch |
| Agentless Remediation | Scanner-based assets without the agent, such as appliances and network devices | Assets Affected: assets with at least 1 open PHP2Shell detection | The scanner-based assets, ready for the CAR mitigation script |
Source: TruRisk Eliminate Release 4.2.1.1 release notes. VMDR customers can start a 15-day free trial of TruRisk Eliminate from the PHP2Shell prompt in VMDR, or ask their TAM.
| CVE | Setting | What is disabled |
|---|---|---|
| CVE-2026-109619 | session.upload_progress.enabled = Off | The confirmed session attack paths |
| fatal_error_backtraces = Off | The mod_php backtrace path (PHP 8.5 only) | |
| Remove per-request INI settings | Diagnostics raised before initialization, from Apache php_value, .htaccess or a front end's PHP_VALUE | |
| pm.max_requests = 1 | State carried between requests (optional FPM pool directive, costs performance) | |
| CVE-2026-109618 | memory_limit = -1 | The memory-limit failure an attacker can trigger (temporary) |
| post_max_size = 8M / 32M | Smaller request body for out-of-memory attempts (32M only if you accept uploads) | |
| Lower nesting and upload counts, limit at the proxy | The documented multipart out-of-memory triggers | |
| Per-worker cgroup memory limit | An availability boundary. Never use RLIMIT_AS or RLIMIT_DATA, which can trigger the bug |
; CVE-2026-109619 php_admin_value[session.upload_progress.enabled] = 0 php_admin_value[fatal_error_backtraces] = 0 ; PHP 8.5 only pm.max_requests = 1 ; optional, FPM only ; CVE-2026-109618 (temporary) php_admin_value[memory_limit] = -1 ; restore a finite limit after patching php_admin_value[post_max_size] = 8M ; 32M if you accept uploads ; keep upload_max_filesize below post_max_size
memory_limit = -1 removes PHP's per-request cap, so watch for resource exhaustion while it's in place.Set these administratively. ini_set() and .user.ini can't hold them, and hiding errors with error_reporting, display_errors or @ doesn't stop the underlying access.
Use your WAF, IPS and EDR to shrink exposure while patches roll out. Each layer catches what the one before it misses.
You've enabled the vendor rules, confirmed their IDs in your console, and verified each EDR policy fires for your PHP workers.
Select the WAF, IPS, and EDR you run to see the exact signatures and policies each vendor has released for CVE-2026-109618 and CVE-2026-109619, ready to copy into your console.
The WAF stops requests at the edge, the IPS on the network, and EDR catches what an attacker does next on the host.
Each vendor published these IDs in October 2026. Confirm them in your console. EDR policies target follow-on behavior, not the CVEs, so check each one fires for your PHP workers.
Treat signatures as one of several layers. Cloudflare has reported attack traffic that includes evasion attempts.
2 servers on the same unpatched build can carry very different risk depending on what protects them. Qualys is extending ETM to show that.
Recommendations on every finding: which third-party controls reduce exposure, and where to enable them.
Controls reflected in the score: active controls lower the finding's QVSS Environmental score.
Action from one platform: apply third-party mitigations through TruRisk Eliminate.
Add the PHP2Shell QIDs from your ranked list to a TruRisk Eliminate patch job. Qualys maps each one to the patch that fixes it. Start with confirmed-exploitable, internet-facing assets.
Rescans come back clean, ETM TruConfirm can't reach the entry point, running services use the patched runtime, and the PHP2Shell Fightback dashboard shows the detections as fixed.
Check the full package version against the vendor advisory.
Restart every service that loads PHP. Running workers keep vulnerable code in memory, which matters most for CVE-2026-109619.
For containers, rebuild the image with patched dependencies and redeploy.
Check installed package versions and running workers.
Re-run ETM TruConfirm and the effective-configuration check.
Restore a finite memory_limit and review temporary upload limits.
PHP offers only limited source backports. Get a fixed build from your distribution or support vendor, apply the source backport, or upgrade to a supported branch. Keep the Step 3 mitigation in place until then. It works on end-of-life PHP versions.
| Packages | php8.1, php8.3, php8.5 |
| Patch reliability | High |
| OS reboot | Not required |
| Service restart | Required |
Vendors are still rolling out many patches, and you can already deploy Ubuntu's through TruRisk Eliminate. Can't patch or mitigate in time? Restrict public access or isolate the service.
Installing a package is one step. Confirm each application actually runs the patched runtime. Your progress is saved in this browser only.
Whether or not you already use Qualys, you can get PHP2Shell detection, validation and remediation at no cost.
Qualys scans your internet-facing assets from the cloud with InstaScan, uses ETM TruConfirm to show which servers attackers can actually exploit, and gives you a patch or mitigation path for each, including PHP versions that will never get a fix.
In VMDR, the PHP2Shell prompt shows how many PHP installations and PHP2Shell vulnerabilities you have. Select Enable CSAM and TRE to start a 15-day free trial of prioritization and remediation.
Enable the external scanner for ETM TruConfirm.
Launch the perimeter assessment.
Set up the consolidated PHP2Shell view in ETM.
Contact your TAM to schedule it.