By ByteBot
PHP issued emergency patches on October 21 for two critical CVSS 9.2 remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively named PHP2Shell. Both flaws live in the PHP runtime itself, not in any application you’ve written. If you run PHP and haven’t applied this patch, your application code quality is irrelevant: an unauthenticated attacker can run code on your server. Exploit attempts have been logged since before the patches shipped.
Two Vulnerabilities, Two Mechanisms
PHP2Shell is two distinct bugs that both reach RCE before any of your application code executes.
CVE-2026-109618 is an out-of-memory corruption flaw. PHP uses longjmp() to abort requests when memory runs out, and if memory runs out while a request is only half-initialized, the shutdown code walks over that broken state. An attacker triggers this by crafting a specific multipart POST body — oversized field names, empty file controls that don’t count toward upload limits, many headers nested inside a single part. The exploit is self-contained and atomic: one request, one shot, execution happens during cleanup of that same request. No session required.
CVE-2026-109619 is a stale global state use-after-free. When a PHP worker dies mid-request — from a fatal error, timeout, or OOM — it can leave freed memory pointers in global state. The next request handled by that worker reads those stale pointers. The confirmed trigger is PHP’s Session Upload Progress feature, which is enabled by default. Exploitation at scale started within hours of public disclosure.
The uncomfortable part: both vulnerabilities are reached during request parsing, before PHP even touches your code. Updating your Laravel version, running composer update, patching WordPress plugins — none of that helps. This is a runtime-level flaw, and it requires a runtime-level fix.
Who Is Affected
Every PHP version from 5.4 onward has at least one of these vulnerabilities. All server APIs are in scope: Apache mod_php (the most exposed), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. If you run WordPress, Drupal, Magento, Laravel, or a custom PHP app, your exposure is determined by your PHP runtime version, not your framework.
PHP ships patches for 8.2, 8.3, 8.4, and 8.5 only. PHP 8.1 and older receive nothing from php.net. That affects a large chunk of production infrastructure still sitting on legacy branches.
What to Do Right Now
Primary fix: patch and restart. Update your PHP binary to one of the patched releases and restart every PHP worker.
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
After patching, restart Apache, PHP-FPM, and any long-running PHP processes. The patch does nothing if old workers are still running in memory.
On PHP 8.1 or older: Switch to PHP 8.2 or later (preferred), or apply the community backport patches from the Anton-Barinov/php2shell-patches repository, which has been fleet-tested on WordPress, OpenCart, HestiaCP, and aaPanel.
Temporary mitigations if you cannot patch immediately:
- For CVE-2026-109618: set
memory_limit=-1in php.ini and restart workers. Do not use RLIMIT_AS or cgroup memory limits as a substitute — they don’t close the vulnerability. - For CVE-2026-109619: set
session.upload_progress.enabled=0in php.ini and restart workers. On PHP 8.5, also setfatal_error_backtraces=0.
These are stopgaps, not fixes. Patch as soon as you can. CISA has issued an alert calling for immediate patching.
Cloud and WAF Protections
If you’re behind a WAF, check your provider’s status. Cloudflare shipped protection on October 21 at 03:02 UTC — before public disclosure — and it’s on by default for Free plan users. AWS released version 2.3 of its PHP managed rule group (AWSManagedRulesPHPRuleSet) on October 22, adding the PHP2Shell_BODY rule for CVE-2026-109619; version 2.4 adds coverage for CVE-2026-109618. If you’re on AWS, confirm your WAF is on the latest version. AWS published a detailed WAF mitigation guide for CloudFront and ALB deployments.
WAF rules are not a substitute for patching. They block known request patterns; a well-crafted payload can still bypass them. Patch first, WAF second.
How These Were Found — and What That Signals
Both vulnerabilities were discovered in August 2026 — not by pen testers, but by AI. Researchers at Calif and Wiz independently used GPT-5.6 Sol and Gemini 4 Argon to find exploitable patterns in PHP’s C source. OpenAI’s “Patch the Planet” initiative, which deploys frontier models specifically to find vulnerabilities before attackers do, is how this came to light.
The disclosure timeline worked in defenders’ favor: PHP maintainers had roughly 2.5 months to prepare patches before public disclosure. Wiz’s original research lays out how the Defender’s Window was created. That window is now closed — exploit PoC frameworks appeared within hours of the October 21 release, some of them also using AI for OOM fuzzing automation. The same tools that found these bugs are now being used to exploit them at scale.
Check your PHP version. Patch now.
