Turn off the memory limit
This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.
What
memory_limit = -1
Why
CVE-2026-109618 happens when PHP runs out of memory at its limit in the middle of handling a request. With no limit, that trigger is gone.
Set it where your app can't override it: the PHP-FPM pool or Apache config (php_admin_value). Then check that nothing puts a limit back. php php2shell.php scans your project for ini_set('memory_limit', ...), .htaccess and .user.ini.
Watch out
- One request can now use all the server's memory. Put a memory limit outside PHP.
- Don't use
ulimit -v(RLIMIT_AS/RLIMIT_DATA) for that. It can trigger the bug. - After updating PHP, set it back to a normal value (like
128M).
Set it by hand
| Your setup | Where | Add this |
|---|---|---|
| Any (php.ini) | php.ini, or a new file in its conf.d folder | memory_limit = -1 |
| PHP-FPM | pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf | php_admin_value[memory_limit] = -1 |
| Apache mod_php | server or VirtualHost config | php_admin_value memory_limit -1 |
| Docker (official image) | your Dockerfile | RUN echo "memory_limit = -1" >> /usr/local/etc/php/conf.d/99-php2shell.ini |
| Windows / XAMPP / IIS | php.ini in your PHP folder | memory_limit = -1 |
| Shared hosting | Ask your provider. .user.ini and .htaccess are not reliable for this (why). | |
Then restart PHP. Nothing changes until you do.
Undo
Run php php2shell.php --undo and pick the change. Or remove the line by hand and restart PHP.
Source: php.net