PHP — Emergency Alert Issued for Two Unpatched Critical RCE Flaws (CVE-2026-109618 and CVE-2026-109619)

Publication date: October 21, 2026
Category: Vulnerability / Web Security

Introduction

The web development ecosystem faced an emergency security alert after the disclosure of two critical remote code execution (RCE) vulnerabilities affecting PHP, dubbed php2shell by security researchers. Following a premature information leak across forums and social media, PHP maintainers were forced to schedule an out-of-cycle security release. Rated officially at 9.2 out of 10 on the CVSS v4.0 scale, these flaws present an imminent hazard to millions of internet-facing web servers running across multiple branches of the language.

What is the PHP Ecosystem and the php2shell Threat? (General Analysis)

PHP (Hypertext Preprocessor) is one of the world’s most widely deployed open-source scripting languages, acting as the structural backbone for content management systems (CMS), enterprise portals, and dynamic web applications globally. Its massive footprint makes it a high-value target for threat actors aiming to compromise underlying web server infrastructure.

The vulnerabilities tracked under CVE-2026-109618 and CVE-2026-109619 theoretically allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system via specially crafted requests.

  • Official CVSS v4.0 Score (per vendor advisory): 9.2 (Critical).
  • CWE Classification: To be detailed in official bulletins, though conceptually categorized under injection and command execution flaws (CWE-78: Improper Neutralization of Special Elements used in an OS Command — reasoned estimation based on the RCE nature of the defect).
  • CISA KEV Catalog: Not listed in the Known Exploited Vulnerabilities catalog at the time of the initial advisory.

How Does It Work? (Technical Analysis)

Although exact technical details and exploitation vectors remained under embargo prior to the official patch release, the mechanics of php2shell follow classic high-level interpreter vulnerability patterns:

  • Initial Exploit Entry Flow: An attacker submits meticulously crafted HTTP requests targeting the web server handling PHP scripts (e.g., via PHP-FPM or CGI interfaces). If the core parser or argument handler improperly processes specific input fields or flags, an injection condition is triggered.
  • Arbitrary Code Execution: Bypassing internal validation layers diverts execution control toward operating system utilities or triggers evaluation of malicious payloads under the privileges of the web server process (www-data, apache, etc.).
  • Absence of Early Public Proofs of Concept: At the time watchTowr issued its alert and organizations like Huntress published rapid responses, no active exploits had been documented in the wild, providing administrators a narrow pre-patch defensive window.

Affected Systems / Environments

The potential impact spans a massive fraction of public web infrastructure. Supported PHP branches are strictly limited to four lines of development:

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-109618 CWE-78 (Estimated) Remote Code Execution 9.2 (v4.0) Network / Low Complexity / None / None
CVE-2026-109619 CWE-78 (Estimated) Remote Code Execution 9.2 (v4.0) Network / Low Complexity / None / None
CVE-2024-4577 (Reference) CWE-78 (Confirmed) Remote Code Execution 9.8 (v3.1) Network / Low Complexity / None / None
  • Supported Branches Eligible for Patches:
    • PHP 8.5: In active support.
    • PHP 8.4: In active support.
    • PHP 8.3: Security fixes only.
    • PHP 8.2: Security fixes only.
  • End-of-Life (EOL) Systems: Versions such as PHP 8.1, 8.0, 7.x, and 5.x will receive no official patches, despite telemetry scans (such as those by Mallory via Shodan) revealing that hundreds of thousands of exposed servers continue running these obsolete branches.

Mitigation and Detection

Remediation

  1. Comprehensive Inventory: Discover and catalog every PHP installation across your infrastructure, including bundled vendor appliances, Windows software, and hosting control panels like cPanel and Plesk.
  2. Prioritized Patching: Apply official PHP patches immediately upon release, prioritizing internet-facing exposure vectors.
  3. EOL Isolation: If running an obsolete branch (PHP 8.1 or older) that will not receive vendor patches, upgrade immediately, take the server offline, or place it strictly behind a Virtual Private Network (VPN) or Web Application Firewall (WAF) until remediation is complete.

Detection

Incident response teams must closely monitor child processes spawned by web server daemons and interpreters.

“Early detection of anomalous behavior in processes spawned by the web server — such as unexpected shell interpreters or download utilities initiated from PHP execution contexts — is critical to intercepting breaches before persistence is established.”

  • Process Monitoring: Configure alerts for the execution of command shells (/bin/sh, /bin/bash, cmd.exe), external interpreters, or networking tools (curl, wget) spawned by parent processes like php-fpm, php-cgi, httpd, or apache2.
  • Sample Linux Analytic Rule (process-watcher):
    yaml 
    title: PHP Child Process Execution of Shell Utilities
status: experimental
level: high
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: 
      - '/php-fpm'
      - '/php-cgi'
      - '/apache2'
      - '/httpd'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/nc'
      - '/curl'
      - '/wget'
  condition: selection

Wrapping Up

The emergence of the emergency alert regarding php2shell (CVE-2026-109618 and CVE-2026-109619) highlights the inherent fragility of global web infrastructure when core components face critical vulnerabilities. With a 9.2 CVSS rating and massive volumes of legacy servers operating without patch eligibility, rapid inventorying, strict boundary isolation, and robust endpoint telemetry remain indispensable pillars for effective defensive postures.

References