A security vulnerability in PHP, the world's most widely used web programming language, which unexpectedly became public, has put the global IT industry on high alert on Wednesday. Under the name "PHP2Shell", two vulnerabilities in the core of the PHP interpreter (CVE-2026-109618 and CVE-2026-109619) threaten millions of websites, online shops, and government portals. Because technical details and initial function tests (Proofs-of-Concept) were leaked online in advance, the Federal Office for Information Security (BSI) raised the alert level to the second-highest level, "Orange", and advised operators, when in doubt, to immediately disconnect servers from the network.
Municipalities in blackout, all-clear for LiteSpeed users
In Germany, authorities and public institutions reacted drastically: Several cities such as Mainz, Potsdam, and Halberstadt proactively shut down their web portals completely. Universities and the Berlin University Hospital Charité also temporarily went offline to prevent compromise. The vulnerabilities have a critical severity score of 9.2 out of 10 points on the CVSS scale and allow attackers to execute malicious code remotely (Remote Code Execution) without any authentication.
While administrators of Apache servers (especially when using the outdated mod_php module) and PHP-FPM infrastructures had to apply emergency patches under extreme time pressure, operators of systems based on LiteSpeed web servers breathed a sigh of relief. Industry analyses and security reports on the day after the panic showed that LiteSpeed environments were largely isolated from the immediate threat wave.
Why LiteSpeed servers escaped the panic
Security experts attribute the immunity or minimal risk of LiteSpeed architectures to fundamental differences in the processing of web requests:
- Divergent Request Architecture: The core vulnerabilities in “PHP2Shell” are based on memory cleanup errors when HTTP requests exceed the configured limit, forcing an Out-of-Memory (OOM) crash of the PHP process. LiteSpeed uses its proprietary LSAPI (LiteSpeed Server Application Program Interface) for PHP integration. This processes and filters data streams fundamentally differently than the classic Apache web server. Targeted triggering of the corrupt memory state via the HTTP header failed in test environments.
- No Attack Surface Before Application Code: While the threat is fatal in Apache configurations because the attack occurs even before any WordPress or application code is executed, LiteSpeed encapsulates PHP workers more strictly. Circulating exploits were specifically designed to exploit weaknesses in Apache or FPM process structures but were ineffective with LiteSpeed.
- Strict User Isolation in Shared Hosting: Many modern hosting platforms that rely on LiteSpeed run each website in a highly regulated, isolated system environment (CloudLinux/CageFS) by default. Even in the hypothetical case of exploitation, the attacker would have been trapped in a virtual cage, without access to the main server or adjacent websites.
Only updates offer lasting security
Despite LiteSpeed's structural advantages, security authorities such as the BSI and the US cybersecurity agency (CISA) emphasize that webmasters must not let their guard down. As these are errors directly in the core of the PHP programming language, there are no reliable configuration changes (workarounds) that can permanently block an attack.
The developers of the PHP Foundation have now provided official security updates for all supported versions (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12). Administrators worldwide are urged to install these updates immediately and restart the affected server services.
