1. General Information on the Vulnerability
What is it?
CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell by researchers, are two critical vulnerabilities in PHP core. Each is rated 9.2 under CVSS v4.0 and can allow an unauthenticated attacker to run code with the privileges of a PHP web worker. PHP has released 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix them. PHP security release
How does it work?
CVE-2026-109618 — out-of-memory corruption. In affected releases, PHP uses a nonlocal jump to abort a request when an allocation exceeds its configured memory limit. In some native operations, memory becomes visible to later cleanup before it is fully initialized. A fatal allocation failure between those steps skips the remaining initialization. Calif describes a HashTable example: PHP increases the count of live entries, then attempts a key allocation that can fail. Cleanup may process the unfinished entry as though it were valid. Multipart parsing can make a request consume far more heap memory than its body size suggests; nested empty file fields, for example, cause PHP to build several metadata trees. PHP confirms unauthenticated RCE against Apache mod_php, whose shutdown path runs even after request startup fails. A complete FPM exploit for this specific path has not been demonstrated. PHP advisory for 109618, Calif technical writeup
CVE-2026-109619 — stale global state. A PHP worker can retain a pointer to memory owned by an earlier request after that memory has been freed. A fatal error may skip a reset; in other cases, a later nonfatal diagnostic can repopulate the state after PHP has reset it. If the same worker handles another request, PHP may use the stale pointer before normal initialization replaces it. Confirmed early consumers include session upload-progress processing and certain initialization diagnostics. For FPM, the demonstrated session path requires a suitable application operation interrupted after request startup; a startup failure normally exits the FPM child. PHP confirms RCE through stale-state paths for both mod_php and FPM and identifies an additional PHP 8.5 fatal-error-backtrace path. PHP advisory for 109619, Calif technical writeup
These examples do not exhaust the possible paths. Wiz Research describes other exploit paths and impacts grouped under these same two CVEs, including upload-progress use-after-free, process-memory disclosure, fatal-error-backtrace use-after-free, and OPcache type confusion. The underlying bugs sit in PHP itself, while the route to exploitation varies with the build, web server, configuration, and application behavior. The CVE descriptions and mitigations here follow PHP's advisories. Wiz technical writeup, PHP advisories
Affected Software
The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Install one of these or a distribution package with the corresponding backport. PHP 8.1 and older receive no normal upstream security release; PHP published limited source backports for 7.4, 8.0, and 8.1 for organizations building from source. Check the PHP package actually serving each site, since a version banner alone cannot reveal whether a distribution has backported the fix. PHP release guidance
PHP says all installations serving web requests need attention, whether they use PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed. It considers mod_php the highest-risk deployment because an unauthenticated request can trigger a demonstrated path before application code runs. That ranking does not make other SAPIs safe. PHP security advisory
2. Real Case Scenario: From Disclosure to Attack Activity
Discovery & Disclosure
The PHP security team issued advance notice on 20 October 2026 and released the fixes on 21 October. Calif credits researchers from Calif, OpenAI, and Wiz with the discoveries. Calif and Wiz report code-execution demonstrations against major PHP applications, including WordPress, Drupal, and Joomla; Calif also reports execution against ordinary PHP scripts in some configurations. These are research demonstrations, not reports of compromised customer sites. PHP release timeline, Calif disclosure timeline, Wiz technical writeup
Exploitation Status
Palo Alto Networks Unit 42 says its Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to these CVEs. That is an exposure estimate, not a count of confirmed exploitable systems. Unit 42 also says at least one European government took a website offline as a precaution; its brief does not report a confirmed compromise. Unit 42 threat brief
Patchstack says hosting partners reported active exploitation incidents on 21 October. Its own 13:57 UTC telemetry update, however, described probing, with no hard evidence of breaches yet. Cloudflare separately reports attack traffic targeting its customers and modified payloads aimed at bypassing its defenses. These public reports document active attempts and partner-reported incidents, but do not establish a verified successful compromise. Patchstack live timeline, Cloudflare attack-traffic report
Update (22 October 2026): Amazon Threat Intelligence reports a PHP2Shell exploitation attempt against its MadPot honeypot on 17 October, followed by more attempts on 21 October and broad exploitation attempts after disclosure. watchTowr reports attempts against both CVEs. AWS says it is unclear whether the early attempts would have succeeded on real-world systems. The cited public reports do not document a verified successful customer compromise. AWS threat analysis, watchTowr observations
Real-World Threat Scenario
An internet-facing service running an unpatched PHP build may process attacker-controlled request data before its application checks authentication. On a vulnerable mod_php deployment, a request can trigger the confirmed out-of-memory path during automatic input parsing and reach unsafe cleanup before the target script runs. A stale-state path instead depends on a surviving worker retaining request-owned state and a later request reaching it. The exact route depends on the server and application. This is a risk scenario derived from the vendor and researcher demonstrations, not a report of a specific intrusion. PHP advisory for 109618, PHP advisory for 109619
3. Why is it Important / Business-Critical?
- The flaws are in a shared runtime. PHP core flaws can affect many unrelated applications. Calif and Wiz demonstrated code execution against multiple major PHP applications without relying on a vulnerability in each application's code. Calif research, Wiz research
- Exposure spans different stacks and generations. PHP names several web-serving SAPIs as at risk, while older branches lack normal upstream releases. Unit 42's potential-exposure estimate indicates a large response workload, although it does not establish how many systems are exploitable. PHP release guidance, Unit 42 threat brief
- The demonstrated exploit paths do not require a login. PHP confirms that an unauthenticated attacker can execute code with web-worker privileges, including through a mod_php path before application code runs. Requirements still vary by path and deployment. PHP advisories
4. Immediate Action Required
Patch immediately. Install PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a vendor package containing the fixes. Restart or replace the workers that load PHP. For end-of-life branches, use a supported distribution backport, the limited PHP source backports where applicable, or migrate to a supported release. PHP release guidance
Use partial mitigations only while updating. Enforce memory_limit=-1 administratively (for example, with php_admin_value), verify that no pool, directory, or application setting restores a finite limit, and restart workers. This removes the predictable PHP memory-limit trigger used in the demonstrated 109618 attack, but underlying allocation failures remain possible and uncapped PHP allocation raises availability risk. Disable session.upload_progress.enabled in php.ini or FPM/server configuration applied before request parsing, then restart workers; ini_set() and FPM .user.ini are too late for the confirmed early session paths of 109619. On PHP 8.5, set fatal_error_backtraces=0 administratively and restart workers; this blocks one confirmed producer only. Setting pm.max_requests=1 can interrupt FPM cross-request chains at a performance cost, but does not address the confirmed single-request mod_php path. These measures do not replace updating. 109618 advisory, 109619 advisory
Limit exposure and monitor workers. PHP recommends edge limits on decoded request size, multipart parts, nesting depth, and uploads. Wiz advises watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. WAF rules and outbound filtering are additional defenses that may reduce exposure or impact; they are not substitutes for the PHP update. PHP advisory for 109618, Wiz technical writeup
Lab Environment
We are preparing hands-on content so researchers and defenders can explore these PHP vulnerabilities in an isolated environment and compare vulnerable and patched behavior. One box is currently being built and validated.
Final Thoughts
The PHP2Shell vulnerabilities have demonstrated unauthenticated code-execution impact, and defenders have observed attack traffic and received reports of active exploitation incidents. PHP's fixed releases are available. The public reports cited here do not document a verified successful real-world compromise as of this article's update, but exposed PHP workers should be patched promptly. PHP security release, Patchstack live timeline, Cloudflare attack-traffic report
