PHP 又出事了：两个 9.2 分未授权 RCE，补丁已出，先打补丁
2026 年 10 月 22 日 ｜ 海风诗人
一句话：这次不是某个插件、某个网站出事，是 PHP 解释器本身出了两个严重漏洞。代号 php2shell，不用登录就能让服务器执行攻击者的代码。
出了什么事
两个漏洞，CVE-2026-109618 和 CVE-2026-109619，CVSS v4.0 都是 9.2 分。
第一个是内存耗尽时的问题：PHP 在初始化请求数据时被打断，数据只建了一半，清理时却被当成合法数据，于是能走到代码执行。第二个是请求状态残留：上一个请求的内部状态在内存释放后还没清干净，下一个由同一个 worker 处理的请求可能捡到这份旧状态，造成内存泄露和代码执行。
影响所有对外提供 web 请求的 PHP，包括 PHP-FPM、Apache mod_php、php-cgi、FrankenPHP、LiteSpeed。其中 mod_php 风险最高，已证实能在应用代码运行之前就触发，登录页和 WordPress 安全插件都拦不住。
补丁版本
PHP 已在 2026 年 10 月 21 日发布修复，别等，别观望：
8.5 升到 8.5.12；8.4 升到 8.4.27；8.3 升到 8.3.36；8.2 升到 8.2.35。升完要重启或替换 worker，再核对一次实际运行的版本，才算数。
只升 WordPress、插件或 Composer 没用，这是解释器层的问题。8.1 及以下官方不再出正式补丁，只能找发行版的 LTS 回移植，或者直接升级到受支持的分支。
缓解措施：打不上补丁时怎么办
1. 先盘点：所有服务器、虚拟主机、容器、面板、捆绑 PHP 的软件都算，别只看主站。跑一句 php -v，对照上面的分支先确认自己在不在受影响范围。
2. 能打补丁的，互联网暴露的系统先打。WAF 规则、Cloudflare 的临时防护只能挡一时，不是替代品。
3. 暂时打不上的，先把风险降下来：放到 WAF 后面，或者干脆先下线。下线不丢人，被拿 shell 才丢人。
4. 老版本实在升不动的，在 php.ini 里把 session.upload_progress.enabled = Off 关掉并重启服务，能挡住已知的利用路径，但这只是缓解，不是根治。
5. 打完补丁也要查一遍：看 PHP worker 有没有异常拉起 sh、bash、python、curl、wget 之类的进程，看 web 目录有没有多出 webshell 或陌生文件，看有没有新增 cron 任务和账号，保留好 web 和 PHP 日志。
细节提前泄露后，已经有攻击流量出现的报告。补丁出来之后，利用代码只会越来越多，别侥幸。
作者注
我的技术栈不跑 PHP，这次不直接影响我。写这篇就是提个醒：如果你手里有 PHP 站，今天就去打补丁。
—— 海风诗人
PHP Hit Again: Two 9.2-Severity Unauthenticated RCE Flaws, Patches Are Out — Patch First
October 22, 2026 ｜ Seair
In short: this is not a plugin or a single website. It is PHP itself. Two critical flaws, nicknamed php2shell, allow unauthenticated remote code execution.
What happened
The flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0.
The first is an out-of-memory handling flaw: PHP is interrupted while initializing request data, leaving it only partly initialized, and cleanup then treats that partial data as valid, opening a path to code execution. The second is stale request state: internal state from a previous request survives after its memory is freed, and a later request handled by the same worker may pick it up, leading to memory disclosure and code execution.
All PHP installations serving web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. mod_php carries the highest risk: exploitation has been demonstrated before application code runs, so login pages and WordPress security plugins cannot stop it.
Patched versions
PHP released the fixes on October 21, 2026. Do not wait:
PHP 8.5 to 8.5.12; 8.4 to 8.4.27; 8.3 to 8.3.36; 8.2 to 8.2.35. After updating, restart or replace the workers and verify the version actually running.
Updating WordPress, plugins, or Composer does not fix this. It is a runtime flaw. PHP 8.1 and earlier no longer receive official updates; use a distribution LTS backport or upgrade to a supported branch.
Mitigations if you cannot patch immediately
1. Inventory everything: servers, shared hosting, containers, control panels, and any software bundling PHP. Run php -v and check your branch against the list above.
2. Patch internet-facing systems first. WAF rules and temporary Cloudflare protections are a stopgap only, not a substitute for patching.
3. If you cannot patch yet, reduce exposure: put the site behind a WAF, or take it offline. Taking a site offline is not embarrassing; getting a shell on it is.
4. For old versions that cannot be upgraded, set session.upload_progress.enabled = Off in php.ini and restart the service. This mitigates known abuse paths, but it is not a complete fix.
5. After patching, check for compromise: look for PHP workers spawning shells, interpreters, or download tools such as sh, bash, python, curl, or wget; look for webshells or unfamiliar files in the web root, new cron jobs, and new accounts; preserve web and PHP logs.
Details leaked before the release, and attack traffic has already been reported. Exploit code will only become more widespread after the patch. Do not gamble on it.
Author's note
My stack does not run PHP, so this does not directly affect me. I am writing this as a heads-up: if you run a PHP site, patch it today.
— Seair