21 October 2026 was a patch day for nearly every server that runs PHP. The PHP project shipped emergency fixes for two critical flaws now known as PHP2Shell, Node.js published its own security release a few hours apart, and EasyApache 4 packages with backported fixes reached cPanel and CloudLinux servers the same afternoon. This is the runbook we used, written for anyone who operates the stack rather than writes the application.<\/p>\n
TL;DR<\/p>\n
session.upload_progress.enabled = 0<\/code> and WAF rules buy time; only the update fixes it.<\/li>\n<\/ul>\n<\/div>\nWhy PHP2Shell is different<\/h2>\n
CVE-2026-109618 and CVE-2026-109619 are both rated 9.2 on CVSS v4.0, and the details explain the score. The first is an out-of-memory bug: PHP can be interrupted while request data is only half initialized, and the cleanup that follows treats the broken data as valid. The second is stale global state, where request-owned data survives after its memory is freed and the next request on the same worker uses it before initialization resets it.<\/p>\n
Three properties make this a hosting problem rather than an application problem. No login is needed. The attack runs during request parsing, before any application code executes, so a hardened WordPress or a strict framework does not help. And every web SAPI is affected: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP, with mod_php rated the highest risk. Details leaked before the planned disclosure date, a working exploit has been demonstrated, and Cloudflare deployed WAF rules for the known vectors on all plans. The UK NCSC advises taking any system that cannot be patched offline. Treat it as actively exploited.<\/p>\n