thoralox

PHP2Shell

Last verified 2h ago

PHP-CGI argument injection to remote code execution

Exploited in the wild?
YES · Active in KEV
Public exploit?
YES · 14 PoCs
Patch available?
YES · Upstream & distros
Severity
9.8 CRITICAL
Check if you're affected Jump to fix commands

Fix it

Package
php8.2
Affected
< 8.2.20-1~deb12u1
Fixed in
8.2.20-1~deb12u1
Advisory: DSA-6574-1
1 · Upgrade
$ sudo apt update && sudo apt install --only-upgrade php8.2 php8.2-cgi
2 · Verify
$ php -v && dpkg -l php8.2-cgi | tail -1

Then reload your web server: sudo systemctl reload apache2 or php-fpm.

No patch yet? Workaround

If you can't upgrade today, stop php-cgi from parsing query-string arguments. These are temporary — upgrade as soon as possible.

php.ini
; Refuse direct CGI invocation
cgi.force_redirect = 1
cgi.fix_pathinfo = 0
apache2.conf
# Block argument-style query strings to php-cgi
RewriteEngine On
RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
RewriteRule ^ - [F]

Risk signals

Known exploited
CISA KEV2026-10-24
Added Oct 24, 2026
94.2%
EPSS probability
99.8th percentile
PoC repos
14
CVSS
9.8

How the attack works

When PHP runs as php-cgi, the web server passes the query string to the binary. RFC 3875 says a query string without = becomes command-line arguments. PHP's guard against this can be bypassed with encoded or best-fit-mapped hyphens.

An attacker sends ?-d+allow_url_include=1+-d+auto_prepend_file=php://input and puts PHP code in the request body. It runs as the web server user before your script loads. No authentication, no user interaction.

You're exposed if: php-cgi is reachable over HTTP (Apache mod_cgi/ScriptAlias, XAMPP-style setups, some shared hosting). Pure PHP-FPM behind nginx with no php-cgi binary is not directly exploitable, but should still be upgraded.

Identifiers

TypeIdentifierAuthorityLink
CVECVE-2026-109618MITRE / NVDcanonical
CVECVE-2026-109619MITRE / NVDcanonical
GHSAGHSA-78vj-982hGitHub Advisory DBcanonical
DSADSA-6574-1Debian Securitycanonical
DLADLA-4848-1Debian LTScanonical
USNUSN-8948-1Ubuntu Securitycanonical

Timeline

  1. Upstream fix committed

    php-src commit 4f1c9a2 hardens php-cgi argv parsing on all supported branches.

  2. Public disclosure

    CVE-2026-109618 and CVE-2026-109619 published; GHSA-78vj-982h issued.

  3. Distro patches released

    Debian DSA-6574-1, DLA-4848-1 and Ubuntu USN-8948-1 published. RHEL errata same day.

  4. Added to CISA KEV

    Federal remediation deadline set to Nov 14, 2026.

  5. Mass exploitation detected

    Honeypots record >40k exploitation attempts/hour dropping cryptominers and webshells.

Related incidents

Log4Shell
10.0 Critical
CVE-2021-44228

Still the most-scanned bug on the internet. Embedded Log4j in vendor appliances keeps it alive.

CISA KEVPatch available
Apache Traversal
9.8 Critical
CVE-2021-41773

Encoded dot segments escape DocumentRoot; with mod_cgi enabled, leads to RCE.

CISA KEVPatch available
CVE-2019-11043
9.8 Critical
CVE-2019-11043

Specific nginx fastcgi_split_path_info configs allow RCE in PHP-FPM.

CISA KEVPatch available