Susanna Riva The National Cybersecurity Agency has issued a national alert indicating that 81,9% of PHP services detected in the country are potentially exposed to the new PHP2Shell vulnerability . The analysis comes from Csirt Italia , which monitored more than 741.523 PHP instances, identifying 285.149 vulnerable versions. This is an unprecedented situation for the Italian digital landscape, given that PHP powers the vast majority of websites globally.
The two critical flaws behind PHP2Shell
The vulnerabilities, identified with CVE-2026-109618 and CVE-2026-109619 , are classified as critical with a CVSS v4.0 score of 9,2 . Both are Use After Free vulnerabilities and occur during out-of-memory scenarios . An unauthenticated remote attacker can exploit specially crafted HTTP requests (e.g., multipart) to force memory exhaustion, corrupt internal structures, and ultimately execute arbitrary code with the privileges of the PHP process.
Technical details of the two CVEs
The first vulnerability (CVE-2026-109618) arises from improper management of the function longjmp() When PHP stops processing due to lack of memory, this leaves internal structures in an inconsistent state, opening the door to memory manipulation.
The second (CVE-2026-109619) concerns retaining references to already freed memory in timeout or critical error situations, especially when monitoring session uploads or generating backtraces in PHP 8.5.
A third vulnerability is currently unpatched
The agency also reported the CVE-2026-115560, which allows remote code execution if the parameter session.serialize_handler is modified to php before starting the session and session.upload_progress.enabled remains active. There is currently no fix available; the recommended mitigation is to disable this feature by setting session.upload_progress.enabled=0.
Operational instructions for managers
Authorities are calling for immediate action, prioritizing systems directly exposed to the Internet. Recommendations include:
- Update all PHP components to the correct versions (8.5.12, 8.4.27, 8.3.36, 8.2.35).
- Disable the parameter
session.upload_progress.enabledsetting it to 0. - Configure Web Application Firewalls (WAFs) in block mode with specific rules for the vulnerabilities in question.
- If updating is not possible, consider temporarily disconnecting vulnerable services.
- Perform retrospective log analysis to identify anomalous HTTP requests, memory errors, or unexpected PHP process crashes.
Finally, it is essential to check the PHP version you are using both at the command line level (php -v) both within the web server (for example apachectl -M | grep php for mod_php or ps -eo pid,ppid,args | grep '[p]hp-fpm' (for PHP-FPM). Only in this way can we ensure that the fixes are actually effective.