PHP Site AuditPHP security
Is PHP2Shell the same as the old PHP-CGI vulnerability?
No. PHP2Shell is the nickname used for two 2026 PHP-core vulnerabilities, CVE-2026-109618 and CVE-2026-109619. CVE-2012-1823 was a separate PHP-CGI query-string argument-injection issue documented in the PHP 5 changelog. The shared PHP name does not make their causes or remediations interchangeable.
Different bugs from different periods
The PHP project describes the 2026 vulnerabilities as memory/state handling flaws in PHP's request lifecycle. Its October 21 notice says one involves out-of-memory handling and partially initialized request data; the other involves stale request-owned state that can remain after its backing memory is freed. The notice lists fixed 2026 PHP releases and vendor backport guidance.
CVE-2012-1823 is associated with PHP-CGI query-string parameter handling. PHP's own PHP 5 changelog records a fix for that older vulnerability. It is not one of the PHP2Shell CVEs and the 2012 fix does not address defects introduced or found in the 2026 runtime. Conversely, applying the 2026 PHP2Shell patch does not automatically establish that a legacy CGI deployment is otherwise correctly configured.
Why the distinction matters operationally
The deployment component and evidence differ. For PHP2Shell, identify the PHP runtime package serving requests and ask for the 2026 CVE fixes or documented vendor backport. For any legacy CGI setup, review its current configuration and supported software status with the administrator. Do not apply a historical mitigation by name without confirming the active issue and the PHP vendor's current advice.
The 2026 notice says all PHP installations serving web requests are in scope for its urgent update guidance, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisory identifies mod_php as its highest-risk case, but does not say that choosing another SAPI removes the need to update. An implementation detail such as CGI versus FPM helps locate the package; it is not a substitute for patch evidence.
Avoid the version-number shortcut
A long-lived server may run multiple PHP versions or configurations, and an operating-system package can include security backports without matching the upstream release number. Conversely, a modern CMS running on an old engine remains dependent on that engine's maintenance. Ask the software vendor for the exact package and advisory that address the relevant CVE instead of assuming an older CVE's remedy applies.
If a site still depends on a legacy unsupported runtime, ask its owner to plan a supported upgrade. PHP says its project no longer updates PHP 8.1 and older, while some distributions and LTS vendors may provide backports. Evaluate both the immediate security fix and a durable migration path; do not expose the service longer merely because a previous PHP-CGI issue was once fixed.
Common questions
Does `php-cgi` mean the site is affected only by CVE-2012-1823?
No. The current PHP advisory expressly includes PHP-CGI among serving installations covered by PHP2Shell guidance.
Can the old query-string fix stand in for the 2026 update?
No. They are separate vulnerabilities with separate fixes.
What should an administrator record?
The deployed SAPI, package/vendor build, advisory-to-CVE mapping, and evidence that the serving processes use the patched package.