Summary
| Field | CVE-2026-109618 | CVE-2026-109619 |
|---|---|---|
| CVE Title | PHP Out-of-Memory Handling Vulnerability | PHP Stale Global State Vulnerability |
| Vulnerability Type | Remote Code Execution (RCE) | Remote Code Execution (RCE) |
| Severity | Critical | Critical |
| CVSS v4.0 Score | 9.2 | 9.2 |
| Root Cause | Improper OOM error handling can leave request memory uninitialized. | Global state may retain references to freed request memory. |
CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, are critical PHP vulnerabilities that can allow unauthenticated attackers to execute code through crafted HTTP requests. One involves uninitialized memory after an out-of-memory error, while the other involves references to freed memory. Successful exploitation may expose data, enable unauthorized changes, or disrupt services. Fixed PHP releases were published on October 21, 2026. Organizations should update affected systems and investigate suspicious activity.
Urgent Actions Required
- Update PHP: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as applicable, or install the corresponding security package from your vendor.
- Restrict exposure: Limit access to vulnerable applications and management interfaces. Apply the PHP Project's documented temporary mitigations if immediate patching is not possible.
- Investigate suspicious activity: Review web server and WAF logs, PHP errors, unexpected processes, modified PHP files, and unusual outbound connections.
Technical Overview
- Vulnerability Type: Remote Code Execution (RCE) caused by memory-handling flaws in PHP.
Affected Software:
| PHP Branch | Affected Versions | First Fixed Version |
|---|---|---|
| PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| PHP 8.1 and earlier | End-of-life versions | Migration to a supported branch is recommended. Vendor-specific fixes must be verified. |
- Attack Vector: Network (crafted HTTP requests)
- Exploitability Score:
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Attack Requirements (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Integrity (VI): High (H)
- Vulnerable System Availability (VA): High (H)
- Subsequent System Confidentiality (SC): None (N)
- Subsequent System Integrity (SI): None (N)
- Subsequent System Availability (SA): None (N)
- Patch Availability: Yes, available
- PHP: News Archive - 2026
- RCE via OOM corruption · Advisory · php/php-src · GitHub
- RCE via stale global state · Advisory · php/php-src · GitHub
- Release: Elastic Beanstalk Amazon Linux 2023 PHP platform updates for PHP 8.5 and PHP 8.4 on October 21, 2026 - AWS Elastic Beanstalk
- Release: Elastic Beanstalk Amazon Linux 2023 PHP platform updates for PHP 8.3 and PHP 8.2 on October 22, 2026 - AWS Elastic Beanstalk
- CVE-2026-109618
- CVE-2026-109619
- RHSB-2026-013 Request handling memory corruption - php (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) - "php2shell" | Red Hat Customer Portal
How Does the PHP2Shell Exploit Work?
The attack typically follows these steps:
How Does the PHP2Shell Exploit Work?
The exploitation process depends on which vulnerability is triggered:
- An attacker sends a crafted HTTP request to a vulnerable PHP runtime. No authentication is required.
- For CVE-2026-109618: The request triggers an out-of-memory (OOM) condition during PHP processing. The resulting longjmp() operation interrupts normal handling, potentially leaving request memory uninitialized.
- PHP’s subsequent cleanup operations may use this invalid memory state, causing memory corruption.
- For CVE-2026-109619: An error or interrupted cleanup process leaves global state referencing request memory. After that memory is freed, a subsequent request may use the stale reference, triggering a use-after-free condition.
- If exploitation succeeds, the attacker may execute arbitrary code with the privileges of the affected PHP worker, potentially access process-accessible data, modify application resources, or disrupt services.
How Can You Mitigate PHP2Shell Exploit?
If immediate patching is delayed or not possible:
- Restrict access to internet-facing PHP applications or place them behind network-layer authentication, such as ZTNA.
- Disable file uploads by setting file_uploads = Off when uploads are unnecessary, and block unwanted multipart/form-data requests at the web server or WAF.
- Apply the documented PHP interim mitigations: memory_limit=-1 for the relevant CVE-2026-109618 attack path, session.upload_progress.enabled=0, and fatal_error_backtraces=0 on PHP 8.5 where applicable.
- Restart PHP workers after changing configurations and verify the effective settings through a live web request.
- Use applicable AWS WAF managed rules or vendor-provided IPS protections to help reduce exposure.
Note: These measures reduce specific attack paths but do not replace installing the applicable security updates.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- PHP Web Applications: Applications running affected PHP versions, particularly those accessible through crafted HTTP requests.
- PHP Execution Environments: Deployments using Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed.
- Cloud Workloads and Containers: Custom PHP runtimes, container images, and affected cloud service configurations that use vulnerable PHP versions.
- Third-Party Products and Appliances: Products that bundle PHP and require vendor-specific security updates.
- Business-Critical Systems at Risk:
- PHP-Based Services: Applications where successful exploitation could expose process-accessible data, permit unauthorized modifications, or disrupt services.
- Exposure Level:
- Internet-Facing PHP Applications: Prioritize systems running affected PHP versions because unauthenticated attackers may reach vulnerable request-processing paths.
- End-of-Life PHP Deployments: PHP 8.1 and earlier require particular attention because standard upstream binary fixes are unavailable and migration to a supported branch is recommended.
- Vendor-Managed and Bundled Software: Verify patch status with the relevant vendor rather than assuming that updating a separately installed PHP package will remediate the bundled runtime.
How Can You Detect PHP2Shell Exploitation?
Exploitation Signatures:
Review web server and WAF logs for suspicious multipart/form-data POST requests targeting endpoints that do not normally accept uploads. Also, investigate requests containing the PHP_SESSION_UPLOAD_PROGRESS field.
How Can You Detect CVE-2026-28950 Exploitation?
Exploitation Signatures:
Retained notification content on affected iPhone or iPad devices after notifications were deleted or dismissed may indicate exposure related to CVE-2026-28950.
Indicators of Compromise (IOCs/IOAs):
- PHP and Web Server Logs: Unusual spikes in memory-exhaustion errors, worker crashes, or segmentation faults.
- Process Activity: Unexpected child processes launched by PHP or web server processes, particularly shells, scripting interpreters, or download utilities.
- Web Root Changes: Newly created or modified PHP files that could indicate web shells.
- Network Activity: Unexpected outbound connections from PHP processes to unfamiliar destinations or autonomous systems (ASNs).
- Authentication Logs: Successful administrative logins to affected applications that require further investigation.
Strengthen Proactive Cyber Defense with Fidelis Elevate®
-
-
- Discover how Open and Active XDR protects networks, cloud, and endpoints
- Explore integrated network security, deception, and Active Directory protection
- Learn how to detect post-breach attacks up to 9x faster
-
