TL;DR
Cybrary has patched the PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619) across production. We assessed our exposure on October 21, 2026, the same day patched PHP releases were published, and deployed fixes to production immediately.
This post explains what the vulnerability is, how it affected Cybrary, and the steps we took to protect our customers and their data.
What is PHP2Shell?
PHP2Shell is the name researchers gave to two critical remote code execution (RCE) vulnerabilities in the PHP interpreter itself, not in any framework or application built on it. The PHP security team rates both 9.2 (Critical) under CVSS v4.0. Details leaked on October 20, 2026, ahead of the planned disclosure, and PHP released fixes on October 21.
- CVE-2026-109618, RCE via out-of-memory corruption. When PHP aborts a request after running out of memory, it can leave request memory in a broken, partly initialized state. Specially crafted multipart requests can trigger this and lead to code execution.
- CVE-2026-109619, RCE via stale global state. A fatal error can leave a long-running PHP worker holding references to memory from a finished request. A later request on the same worker can then reach that stale memory, including through PHP's session upload progress feature.
In both cases, an unauthenticated attacker could run code with the permissions of the PHP worker. Attack attempts against PHP sites were reported before the patches shipped. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Was Cybrary affected?
Yes. Cybrary uses PHP in a subset of our backend API services. On October 21, 2026, the day the patched PHP releases were published, we assessed our exposure and confirmed that affected PHP versions were in use in production.
We treated this as a priority incident and began remediation immediately.
Steps we have taken
Patching is complete for all production PHP services. Here is what we did:
- Upgraded to the patched release. All production PHP-FPM services were upgraded to PHP 8.4.27 and deployed to production on October 21, 2026, within hours of the advisory.
- Added defense-in-depth hardening. We disabled PHP session upload progress tracking and enabled strict session mode. This blocks the CVE-2026-109619 attack path independently of the version upgrade.
- Isolated a legacy service. One legacy, read-only API service runs on a separate application runtime. Its web tier now rejects all non-read HTTP methods and all multipart requests, so the request types used by both exploits cannot reach PHP.
- Scheduled a follow-up. A full runtime upgrade for that legacy service is scheduled as a follow-up. Until then, the controls above remain in place.
Questions?
Protecting our customers' data and platform access is our top priority. If you have questions about PHP2Shell or need further detail for your security or compliance records, please contact your Cybrary sales representative.
Sources
- PHP security advisory: RCE via OOM corruption (CVE-2026-109618)
- PHP security advisory: RCE via stale global state (CVE-2026-109619)
- PHP 8 changelog
- TuxCare: php2shell CVE breakdown
