PHP2Shell
- Product
- PHP Group PHP core (request lifecycle, session upload progress, fatal-error handling)
- CVE
- CVE-2026-109618CVE-2026-109619
- Disclosed
- 2026-10-21
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- PHP 5.4 through 8.5.11 (8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12; EOL branches unpatched)
- Fixed
- 8.2.35, 8.3.36, 8.4.27, 8.5.12 (source patches for 7.4-8.1)
Summary
Two memory-safety bugs in PHP's request lifecycle let an unauthenticated attacker get code execution with crafted HTTP requests, even against a trivial PHP app. They were reported by researchers from Wiz, Calif, OpenAI and others; details leaked on 20 October, a day before the coordinated release, and watchTowr and Cloudflare reported exploitation attempts on release day. The CNA (PHP) CVSS v4.0 score is 9.2.
Root cause
CVE-2026-109618: PHP aborts on out-of-memory with longjmp(), and some contexts leave request memory uninitialized when that happens; request shutdown then reads or branches on the invalid state. Multipart parsing gives several ways to hit OOM within apparent limits (bodies without a usable Content-Length, unlimited part headers, empty file controls), and full RCE was validated against Apache mod_php with default limits. CVE-2026-109619: worker-persistent global state (the PHP 8.5 fatal-error backtrace, session upload-progress state, pre-request INI diagnostics) can still point into a finished request's freed memory, so a later request on the same worker uses it (use-after-free); session upload-progress RCE was validated on both mod_php and PHP-FPM.
Impact
Unauthenticated remote code execution as the PHP/web-server user on a large share of internet-facing PHP deployments.
Detection
Check php -v against fixed versions; look for bursts of multipart requests followed by memory-limit fatal errors or HTTP 500s, malformed or oversized PHPSESSID cookies, and unusual PHP worker crashes.
Mitigation
Upgrade PHP immediately. Interim, partial mitigations from PHP: session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0 (set in php.ini or pool config, then restart all workers), plus vendor WAF rules.