PHP — Emergency Patches Released for Two Critical PHP2Shell Remote Code Execution Flaws (CVE-2026-109618)

Publication date: October 21, 2026
Category: Vulnerability / Web Security

Introduction

The PHP development team has released unexpected emergency updates to resolve two critical Remote Code Execution (RCE) vulnerabilities embedded directly within the language runtime. Jointly referred to as PHP2Shell, these flaws impact virtually all PHP deployments dating back to branch 5.4. The vulnerabilities were discovered and reported collaboratively by researchers from Wiz, Calif, and OpenAI’s security team, working alongside the PHP security group and Google Gemini. In response to emerging exploit attempts in the wild and premature disclosure leaks, PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, alongside source backports for older branches.

What is PHP2Shell? (General Analysis)

PHP2Shell is not an application-level vulnerability tied to a specific framework (such as WordPress or Laravel), but a deep structural flaw residing within the PHP execution engine itself. Consequently, any website hosted on a vulnerable PHP installation remains exposed to arbitrary code execution risks, even if the underlying web application source code is entirely secure.

The threat surface spikes dramatically on servers utilizing Apache’s mod_php, where an unauthenticated attacker can trigger the exploitation vector prior to the execution of any application-level code.

CVE Technical Summary (Official NVD Data)

  • CVE-2026-109618
    • CVSS v4.0 Score: 9.2 (CRITICAL)
    • Official CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    • Official CWE Classification: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Improperly Controlled Resource Consumption).
    • CISA KEV Catalog: Not listed.
  • CVE-2026-109619
    • CVSS v4.0 Score: 9.2 (CRITICAL)
    • Official CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    • Official CWE Classification: CWE-416, CWE-755, CWE-824, CWE-1325.
    • CISA KEV Catalog: Not listed.

How Does It Work? (Technical Analysis)

Technical insights published by research groups and core developers break down the complex runtime memory management mechanics involved in these exploits:

  • Initial Infection Flow and CVE-2026-109618: PHP relies on longjmp() during out-of-memory (OOM) conditions to abruptly exit the current execution context and abort request handling. Certain contexts fail to properly account for this scenario, leaving request memory in an uninitialized state prior to performing subsequent allocations. The subsequent request cleanup procedure may read or branch on this stale memory, allowing multiple OOM strategies to consistently trigger remote code execution.
  • Global State Mechanism and CVE-2026-109619: PHP maintains various global variables that temporarily point into request memory buffers. In specific scenarios, this global state is not correctly reset, or gets repopulated after resetting. As a result, global state references request memory even after it has been freed (Use-After-Free). Subsequent requests can read or branch on this stale state before full re-initialization, seizing control of execution flow.
  • Worker Memory Exfiltration: Beyond RCE, researchers demonstrated that attackers can read live worker process memory—potentially containing passwords, tokens, API keys, and certificates belonging to concurrent requests—without needing prior code execution.

Affected Systems / Environments

Every PHP deployment handling web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-109618 CWE-416, CWE-755, CWE-824, CWE-1325 Remote Code Execution / Memory Disclosure 9.2 (Critical) AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-109619 CWE-416, CWE-755, CWE-824, CWE-1325 Remote Code Execution / Memory Disclosure 9.2 (Critical) AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H
  • Vulnerable Branches and Patched Versions:
    • PHP 8.5 branch: Vulnerable below 8.5.12 (Fixed in: 8.5.12)
    • PHP 8.4 branch: Vulnerable below 8.4.27 (Fixed in: 8.4.27)
    • PHP 8.3 branch: Vulnerable below 8.3.36 (Fixed in: 8.3.36)
    • PHP 8.2 branch: Vulnerable below 8.2.35 (Fixed in: 8.2.35)

Mitigation and Detection

Remediation

The only complete and secure resolution is updating the PHP runtime to the patched versions listed above and restarting web services (Apache, PHP-FPM, and long-running workers). Linux distributions and long-term support vendors have packaged these fixes; administrators should verify package changelogs for CVE references rather than relying strictly on version strings.

If immediate updating is impossible, temporary configuration workarounds reduce exposure to specific attack paths:

  • For CVE-2026-109618: Set memory_limit=-1 to prevent applications from overriding it, keep post_max_size low, and enforce strict request size limits at the web server or reverse proxy layer.
  • For CVE-2026-109619: Set session.upload_progress.enabled=0 and restart workers; on PHP 8.5, additionally configure fatal_error_backtraces=0.

“The only mitigation is patching/upgrading PHP. I sadly know too much.” — Gina Peter Banyard, PHP Core Developer.

Detection

Defensive security teams should monitor logs and network telemetry for the following indicators:

  • Unusual multipart HTTP requests followed by memory_limit errors or repeated HTTP 500 response codes.
  • Abnormally large or malformed PHPSESSID response cookies.
  • Unexplained and recurring restarts of PHP worker processes.

Wrapping Up

The PHP2Shell vulnerabilities represent some of the most critical web infrastructure threats uncovered in recent years, exposing deep-seated design flaws within decade-old PHP engine components. The leveraging of artificial intelligence models by researchers accelerated the translation of these primitives into functional exploits, highlighting a significant shift in the operationalization speed of complex low-level flaws. Upgrading vulnerable runtimes immediately remains mandatory to ensure global web server integrity.

References