FlashCone

PHP php2shell Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Posted on: 21 October, 2026

CVSS v4.0: 9.2 (Critical) | Unauthenticated Remote Code Execution (RCE)

1. Overview

php2shell refers to two independent but complementary memory-corruption vulnerabilities within the PHP interpreter core. These are not application-layer vulnerabilities — they are not bugs in frameworks or CMS such as WordPress, Laravel, Drupal, etc.

Attackers can achieve arbitrary remote code execution on the target server without authentication, credentials, session cookies, tokens, or any flaw in the web application. The exploit triggers while PHP parses incoming HTTP request bodies of type multipart/form-data, before any application PHP code is executed. A website does not need to have a file upload feature. As long as the PHP SAPI accepts multipart/form-data POST requests, the service is exposed.

Affected SAPIs

PHP-FPM
Apache mod_php (highest risk for CVE-2026-109618)
php-cgi
FrankenPHP
LiteSpeed SAPI

Affected & Fixed Versions

PHP Branch	Vulnerable Versions	Fixed Secure Version
PHP 8.2	< 8.2.35	8.2.35
PHP 8.3	< 8.3.36	8.3.36
PHP 8.4	< 8.4.27	8.4.27
PHP 8.5	< 8.5.12	8.5.12

PHP 7.x / PHP 5.x: End-of-life. No official security patches will be released. Migration to a supported PHP 8.2+ branch is mandatory.

2. Attack Principle & Deep Technical Details

CVE-2026-109618: Heap Corruption Triggered by OOM During Request Parsing

PHP uses the memory_limit INI directive to cap memory consumption for each individual request. When memory usage exceeds this threshold, PHP raises a fatal out-of-memory error. To avoid infinite recursion during catastrophic allocation failure, PHP uses longjmp() to unwind the call stack and abort execution immediately. This mechanism skips the normal, ordered resource cleanup path.

Bug condition

An attacker sends a specially crafted multipart/form-data POST payload containing a large number of nested form parts and empty file segments. The total body size stays below post_max_size, but the internal C structures created during parsing consume large amounts of heap memory.

If the OOM fatal error fires midway through multipart parsing, while the request object is partially initialized and inconsistent, the emergency cleanup routine attempts to free partially allocated structures. This corrupts the process heap. mod_php shares the address space with Apache worker processes and is easier to exploit; PHP-FPM is still vulnerable with slightly higher exploitation complexity.

CVE-2026-109619: Use-After-Free with Stale Per-Worker Global State

PHP-FPM workers are long-lived processes. A single worker handles many sequential HTTP requests and reuses the same virtual address space across requests. PHP is designed to fully reset all global parser state between requests.

Two-stage exploit sequence

First malicious POST request: The crafted multipart payload triggers a fatal error inside the multipart parser. PHP frees some global parsing structures, but does not null out pointers referencing that freed memory. The worker remains running with dangling pointers to deallocated heap memory.
Second malicious POST request to the same worker: Before PHP finishes resetting the global parser state, the new request uses the stale dangling pointers, creating a classic use-after-free (UAF) condition.

The attacker controls heap layout via carefully constructed multipart boundaries and field content. With controlled UAF, the attacker can overwrite internal function pointers inside the PHP runtime, eventually gaining arbitrary code execution inside the PHP worker process.

Important constraint: Both vulnerabilities require a multipart/form-data POST request. Plain GET requests cannot trigger either flaw.

3. Impact & Risk

Successful exploitation lets the attacker execute arbitrary operating-system commands under the Linux user identity of the PHP worker process. Potential consequences:

Upload webshells and install persistent backdoors
Read application configuration files containing database credentials, API keys and secrets
Dump application databases
Deploy cryptocurrency miners or ransomware
Lateral movement to compromise other hosts inside the internal network
Website defacement and data tampering

4. Remediation & Mitigation

✅ Permanent Fix (Only fully effective solution)

Upgrade PHP packages to the corresponding fixed secure release for your installed branch.
Restart the PHP service (php-fpm / Apache).

Critical pitfall: Updating RPM / DEB packages does not terminate existing running PHP worker processes. The old binary remains loaded in memory, and the vulnerability persists until service restart.

Upgrade commands

Debian 12 / Debian 13

# update repo index
apt update
# upgrade all php8.2 packages
apt install php8.2-fpm php8.2-cli php8.2-{bz2,curl,gd,intl,mbstring,mysql,opcache,xml,zip}
# restart php-fpm
systemctl restart php8.2-fpm
# verify version
php8.2 -v
php-fpm8.2 -v

If using php8.3 / php8.4 replace 8.2 with your PHP minor version.

Ubuntu (22.04 / 24.04)

apt update
apt install php8.2-fpm php8.2-cli php8.2-{bz2,curl,gd,intl,mbstring,mysql,opcache,xml,zip}
systemctl restart php8.2-fpm
php8.2 -v
php-fpm8.2 -v

Rocky Linux 9 (Remi PHP repo)

# update php packages
dnf update php php-fpm php-bz2 php-curl php-gd php-intl php-mbstring php-mysqlnd php-opcache php-xml php-zip
# restart service
systemctl restart php-fpm
# check version
php -v
php-fpm -v

⚠️ Temporary Mitigations (Risk reduction only; CANNOT replace patching)

These controls increase exploitation difficulty but may be bypassed by skilled adversaries:

WAF rule: Block Content-Type: multipart/form-data POST requests exhibiting extreme nesting, excessive part count or abnormally large individual form fields.
INI setting: session.upload_progress.enabled = Off — removes one common primitive used for heap shaping in exploits.
Run PHP workers as an unprivileged dedicated user. Never run PHP as root.
Tune memory_limit appropriately to raise the difficulty of triggering OOM, without breaking normal application operation.
Network ACL: Restrict source IPs that can reach the web port if public access is unnecessary.
Enable full access logging and monitor for anomalous multipart POST traffic.

5. Official Reference Links

PHP Foundation official security announcement: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
PHP official downloads & changelog: https://www.php.net/downloads.php
PHP Git commit patches for CVE-2026-109618 and CVE-2026-109619
Vulnerability research page (Calif.io): https://calif.io/php2shell/
php2shell vulnerability project page: https://www.php2shell.com/

Announcement