PHP2Shell — PHP Memory Tracking Vulnerability Patch Guide

Patching PHP Memory Tracking Flaws (CVE-2026-109618 / CVE-2026-109619) on Debian

This guide covers updating your PHP 8.x environment against the “php2shell” zero-day vulnerabilities. These flaws exploit out-of-memory (OOM) tracking failures inside the Zend Engine to execute arbitrary code across requests.

“php2shell” is the name for two independent zero-days in PHP’s core, disclosed under one emergency release — and both let an unauthenticated attacker execute code on your server by shaping an ordinary HTTP request.

CVE-2026-109618 (“rawkey”) works in one step: send a multi-megabyte application/x-www-form-urlencoded POST request body with an oversized field name, force the Zend Engine to lose track of an out-of-memory condition during $_POST request variable parsing, and attacker-controlled data ends up corrupting server memory where it can be executed.

CVE-2026-109619 works in two: a first request poisons a PHP-FPM worker’s state, and a later request to that same worker triggers it — via timeouts or client disconnects, nothing you’d notice. That planted state lives in worker memory until the worker restarts.

Official security patches are available directly through Debian’s security updates repositories for both Bookworm (OldStable) and Trixie (Stable), as well as Debian PHP Maintainer Ondřej Surý’s repository.

Note on Temporary Mitigations: If you cannot restart or patch your binaries immediately, short-term mitigations involve setting pm.max_requests = 1 and enforcing strict execution/upload memory limits in PHP-FPM, paired with Apache request body caps (LimitRequestBody, LimitRequestFieldSize). Upgrading the binary directly remains the primary solution.

Step 1 — Apply Official System Updates

Option A: Official Debian Repositories (Recommended)

The patched packages are available in Debian’s official security suites:

Debian Release	Patched PHP Package
Debian 12 (Bookworm / OldStable)	php8.2
Debian 13 (Trixie / Stable)	php8.4

Upgrade your branch’s PHP packages — --only-upgrade never adds extensions you don’t already use:

					# Debian 12 Bookworm (OldStable)
sudo apt update && sudo apt install --only-upgrade -y 'php8.2*'
				

					# Debian 13 Trixie (Stable)
sudo apt update && sudo apt install --only-upgrade -y 'php8.4*'
				

Option B: Ondřej Surý’s Repository (`packages.sury.org`)

If you require custom version tracking or want to maintain non-standard PHP builds, add Surý’s repository:

					# Download and register the keyring
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://sury.org
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb

# Add repository source mapped to your system codename
echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://sury.org $(. /etc/os-release && echo "$VERSION_CODENAME") main" | sudo tee /etc/apt/sources.list.d/php.list

sudo apt update && sudo apt install --only-upgrade -y 'php*'

# --only-upgrade never pulls in new packages, only patched versions of what you already have
				

Step 2 — Verify the Patch Level

Ensure your active PHP binary reflects a patched release:

php -v

Target Baseline Versions

PHP Version	Release Channel	Target Baseline Version
PHP 8.2	Bookworm / OldStable	`8.2.35`
PHP 8.4	Trixie / Stable	`8.4.27`

Step 3 — Flush Active Worker Memory

Installing updated binaries on disk does not immediately purge vulnerable parent or worker process memory loaded in RAM. Restart your web application stack to force workers to start from clean memory states:

					# Debian 12 Bookworm (OldStable)
sudo systemctl restart php8.2-fpm && sudo systemctl restart apache2

# Debian 13 Trixie (Stable)
sudo systemctl restart php8.4-fpm && sudo systemctl restart apache2
				