PHP2Shell: Critical Unauthenticated Remote Code Execution in PHP (CVE-2026-109618, CVE-2026-109619)

On October 21, 2026, the PHP project released emergency security updates addressing two critical vulnerabilities in its core interpreter, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 under CVSS v4.0 and can allow unauthenticated attackers to execute arbitrary code within a PHP worker process or disclose sensitive process memory. The vulnerabilities affect PHP releases dating back to version 5.4, including supported and end-of-life branches. Affected deployments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk identified in mod_php, where exploitation can occur before application code executes. Vega observed active exploitation attempts against monitored environments within a day of disclosure, including a request that a web application firewall matched on the session upload-progress field the exploit abuses, and a coordinated burst of POST requests from several hosts using rotating user agents consistent with a single operator.

The vulnerabilities stem from memory-safety failures in PHP's handling of fatal errors and request-specific internal state. CVE-2026-109618 involves corruption during out-of-memory handling, where a fatal allocation failure can interrupt request processing and leave internal data in an invalid state. One exploitation path abuses session upload-progress processing during multipart form-data parsing, resulting in a use-after-free condition that can enable remote code execution. A related flaw allows attackers to retrieve memory from previous requests through an unexpectedly large PHPSESSID response cookie. Exposed memory may contain authentication tokens, passwords, API keys, or other sensitive data, and disclosure does not require successful code execution.

CVE-2026-109619 involves stale internal state persisting after memory has been freed. One attack path exploits fatal-error backtrace handling, where a subsequent request processed by the same worker can access a dangling pointer before the state is properly reinitialized. Another involves OPcache type confusion, where interrupted memory allocation can leave inconsistent runtime-pointer metadata that is later reused. Both conditions can lead to memory corruption and arbitrary code execution. Exploitation requirements vary by configuration and attack path, with some chains requiring multiple requests or application-reachable fatal errors.

Successful remote code execution runs within the security context of the affected PHP worker, potentially allowing attackers to execute system commands, deploy additional payloads, access application secrets, or establish persistent access. Since the vulnerabilities exist below the application layer, application logs may provide limited visibility into exploitation. Potential indicators include unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized or malformed PHPSESSID response cookies, and unexplained PHP worker crashes or restarts. Endpoint telemetry may also reveal PHP or web server processes spawning command interpreters, reconnaissance utilities, or payload-download tools. These behaviors are useful investigation signals but are not individually conclusive, and memory-disclosure attacks may leave no suspicious child-process activity.

The complete remediation is upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or applying equivalent vendor-backported fixes. PHP 8.1 and earlier are no longer supported by the PHP project, although certain distributions and long-term-support vendors may provide patches. Temporary measures include disabling session upload-progress handling, restricting multipart request sizes and complexity, and adjusting PHP memory limits alongside operating-system-level memory controls. These measures reduce exposure to specific exploitation paths but do not eliminate the vulnerabilities. Administrators should update affected PHP runtimes and restart the associated web server and PHP worker processes.