PHP php2shell: Patch CVE-2026-109618 and CVE-2026-109619

Millions of public-facing web servers are exposed to takeover after two critical flaws surfaced in the engine behind much of the web. On October 21, 2026, the PHP development team rushed out emergency security updates for CVE-2026-109618 and its companion flaw, CVE-2026-109619.

Researchers call the pair php2shell, and together these critical PHP core vulnerabilities carry a CVSS v4.0 score of 9.2. An unauthenticated, remote attacker can execute arbitrary shellcode directly in memory, with no user interaction and no valid login.

The scale is hard to overstate. According to attack surface telemetry released by Palo Alto Networks Unit 42, more than 22.6 million internet-connected systems run vulnerable PHP environments.

Cybersecurity firm watchTowr detected active scanning and exploitation attempts across its global honeypots within hours of the flaw’s premature leak on social media. CISA, the NSA, and CERT-EU have all issued emergency advisories urging infrastructure operators to patch production web tiers immediately.

Quick Answer

CVE-2026-109618 and CVE-2026-109619 (“php2shell”) are critical PHP remote code execution flaws (CVSS v4.0 9.2) affecting PHP versions 5.x through 8.x when processing crafted web requests. The vulnerabilities stem from unsafe longjmp() memory handling during out-of-memory errors and request shutdowns.

Organizations must immediately upgrade to official fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Unsupported installations running PHP 8.1, 7.x, or 5.x must apply OS backports or be isolated behind strict web application firewall filters.

What Happened & Incident Timeline

The disclosure did not go to plan. On October 20, 2026, details of two unpatched, high-severity RCE vulnerabilities in PHP core began circulating on social media, along with a reference to an embargoed release planned for late October.

Maintainers knew adversaries could reverse-engineer the leaked parameters. So the open-source PHP team worked with national cybersecurity agencies and moved the official patch release forward to October 21, 2026, at 13:30 UTC.

Scanning followed almost immediately. Researchers at watchTowr documented in-the-wild exploitation probes hitting their global honeypot nodes before many enterprise change boards had even convened. European government departments temporarily restricted access to public portals as a precaution, and cloud hosting platforms began deploying virtual patching rules to shield downstream customers.

Vulnerability Facts at a Glance

The technical attributes of both vulnerabilities, drawn from verified vendor documentation and national advisory disclosures, are below:

Affected and Fixed Versions

The exposure spans every major PHP release branch used across web applications, hosting panels, and containerized microservices. In practical terms, the supported 8.2 through 8.5 branches have a patch, and everything older needs a vendor backport or compensating controls.

Technical Attack Chain

To see how the php2shell exploit works, defenders need to look at the Zend Engine’s internal request lifecycle:

[Remote Attacker]
      │ (Transmits HTTP POST with maliciously structured, oversized multipart data)
      ▼
[Web Server (Nginx / Apache)] ──► Passes payload to FastCGI Process Manager (php-fpm)
      │
      ▼
[Zend Engine Memory Manager] ──► Allocator encounters deliberate Out-Of-Memory (OOM) threshold
      │
      ├─► CVE-2026-109618 (Unsafe longjmp Control Flow)
      │      longjmp() aborts execution, bypassing clean shutdown routines
      │      Request data structures left partially initialized in memory
      ▼
[Subsequent Worker Request Cycle]
      │
      ├─► CVE-2026-109619 (Global State Use-After-Free)
      │      Global pointers reference freed heap blocks from prior failed request
      │      Attacker's second payload overwrites function pointers in reclaimed heap memory
      ▼
[Arbitrary Code Execution] ──► Spawns interactive reverse shell under web user permissions (www-data)

1. Initial Heap Manipulation & Out-of-Memory Induction

The attacker starts by sending crafted HTTP multipart form submissions built to exhaust the PHP engine’s per-request allocation limits. Normally, exceeding memory_limit triggers a graceful bailout. CVE-2026-109618 exposes a critical flaw in how PHP handles low-level C longjmp() jumps during out-of-memory conditions. The abrupt jump halts execution while internal request-tracking structures are left in an uninitialized state.

2. State Confusion & Use-After-Free (CVE-2026-109619)

The accompanying vulnerability, CVE-2026-109619, completes the weaponization sequence. The request handler failed to release its resources cleanly during the longjmp() bailout, so global engine pointers still reference memory that has been deallocated. When the persistent PHP-FPM worker process handles the next incoming HTTP request, the engine tries to read or execute functions referenced by those dangling pointers.

3. What the Attacker Did Next

An attacker who sends a companion request right after the induced crash can place controlled bytecode into newly allocated heap memory. The dangling pointer then branches straight into that shellcode. In telemetry observed by threat researchers, attackers used this execution window to spawn background processes (/bin/sh, /bin/bash), deploy stealthy memory-only webshells, and harvest database connection parameters directly from wp-config.php, .env, and configuration caches.

Why Patching Alone May Not Be Enough

Updating PHP closes the memory allocation flaw. It does not evict an attacker who got in during the pre-patch window.

• Persistent Webshells in Writable Directories: Once arbitrary code execution occurs, attackers routinely drop secondary backdoors into media directories (such as wp-content/uploads/ or /tmp/), disguised as benign image or font files.
• Compromised Backend Credentials: Web applications running on PHP store cleartext database credentials, API access keys, and cloud storage tokens in environment variables or configuration files. If an attacker achieved RCE, assume those secrets were exfiltrated.
• Living-off-the-Land Persistence: Threat actors have been observed establishing persistent cron jobs (crontab -e) and adding SSH public keys to the authorized keys of the web server service account (www-data or apache).

Indicators of Compromise (IOCs) & Hunting Telemetry

SOC analysts and network defenders should hunt for the following network artifacts and behavioral patterns:

SOC & IT Emergency Response Checklist

Work through this prioritized, six-step plan to protect your web application tier.

1. Inventory All Running PHP Environments. Find every active PHP instance across bare-metal servers, virtual machines, cloud instances (AWS EC2, Azure VMs, GCP Compute), and containerized deployments (Docker, Kubernetes). Stale container images and forgotten staging servers are easy to miss, so check them too.
2. Apply Upstream Security Patches Immediately. Upgrade PHP to one of the secured releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35). In Linux environments, refresh your package managers:

   # Debian / Ubuntu
   sudo apt update && sudo apt --only-upgrade install php*-fpm php*-cli
   # RHEL / Rocky / AlmaLinux
   sudo dnf upgrade php php-fpm

3. Restart Web and FastCGI Services. Make sure active worker processes are terminated and replaced with patched binaries:

   sudo systemctl restart php*-fpm nginx apache2

4. Deploy Temporary WAF Inspection Rules. If you cannot patch right away, configure your Web Application Firewall (Cloudflare, AWS WAF, ModSecurity) to reject incoming HTTP requests that contain excessively large or nested multipart form boundaries.
5. Inspect Process Trees for Web-Spawned Shells. Query your Endpoint Detection and Response (EDR) tooling or run system checks to find active interactive shells spawned by web daemons:

   pgrep -a -P $(pgrep -d, -f "php-fpm|apache2|httpd")

6. Audit and Rotate Application Secrets. If unexpected worker crashes or unfamiliar child processes were logged between October 20 and October 22, rotate all database passwords, encryption salts, and cloud service credentials configured in application files.

Global Regulatory & Compliance Implications

Enterprise security leaders need to coordinate incident assessment across several reporting regimes at once:

Disclaimer: This regulatory summary provides operational security context and does not constitute formal legal counsel.

CyberInfos Analyst Insight

From an investigative and defensive engineering perspective, three takeaways stand out from the php2shell incident.

Process Isolation Must Replace Ambient Trust.

Too many enterprise architectures run PHP-FPM processes with direct read access to local disks, network shares, and outbound internet connections. Hardening the web tier means running PHP workers in restricted seccomp sandboxes and blocking outbound network access at the firewall. That way, reverse shell callbacks fail even when a memory corruption bug exists.

The End-of-Life Technical Debt Trap.

Millions of web servers worldwide continue to run PHP 7.4, 8.0, or 8.1. Upstream maintainers do not release public patches for unsupported branches, so organizations on outdated runtimes face severe exposure unless they pay for commercial vendor support or complete a modernization upgrade.

Rapid Exploitation Requires Preemptive Runtime Defenses.

The gap between the initial leak and automated scanning was under twelve hours. Manual patch cycles alone can’t keep pace with that. Modern SOCs need pre-configured WAF virtual patch rulesets that can block exploit payloads within minutes of validating a threat signal.

Frequently Asked Questions (FAQ)

What is CVE-2026-109618?
It is a critical remote code execution vulnerability in PHP core, caused by unsafe memory handling during out-of-memory errors. Unauthenticated attackers can use it to execute arbitrary code on web servers.

What is the difference between CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 involves improper control flow management during memory allocation failures, while CVE-2026-109619 exploits the resulting dangling pointer in subsequent requests through a use-after-free condition.

Which PHP versions have official security patches?
The PHP Group released official security updates for active supported branches: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35.

Are older PHP releases like 7.4 or 8.1 vulnerable?
Yes. The underlying architectural code exists in PHP 5, 7, and 8. Older versions are end-of-life and receive no official community patches, so they require OS vendor backports or strict WAF mitigation.

Can an attacker exploit this vulnerability without authentication?
Yes. The vulnerability can be triggered remotely by sending specially crafted HTTP POST requests to any publicly reachable PHP script that accepts input.

Final Thoughts

The disclosure of CVE-2026-109618 is a reminder of how fragile foundational web technology can be when low-level memory corruption bugs reach the open internet. Treat this advisory as an emergency. Inventory every public-facing system, apply the official PHP updates immediately, and review process execution logs to confirm your environment is clean.

Stay informed with actionable intelligence: Follow CyberInfos.in on LinkedIn, X (Twitter), and our dedicated WhatsApp Channel for daily breaking vulnerability analyses, reverse-engineering teardowns, and defensive implementation playbooks.