PHP2Shell: Two Critical RCE Zero-Days Hit Every PHP Version, Patch Now

PHP uses longjmp() to abort execution on OOM. In certain contexts -- particularly during multipart body parsing -- an OOM leaves request memory partially initialized; the longjmp() path doesn't account for the early exit, leaving that invalid state live.

Three multipart parsing properties let an attacker exhaust memory while staying within PHP's apparent limits: absent content-length bypasses post_max_size; part headers have no count limit and consume more memory than their wire size; empty file controls still allocate full metadata arrays and nested field names multiply allocation work.

The mod_php attack path requires no application code. mod_php calls request shutdown unconditionally, even when startup fails. A crafted multipart request exhausts memory during startup, PHP longjmps out with invalid state live, and mod_php's shutdown processes that state -- RCE. The PHP team validated complete unauthenticated RCE at default limits against a standard prefork configuration.

PHP-FPM avoids the application-independent path (FPM terminates a child on startup failure), but OOM can occur in application code paths after successful startup, making FPM susceptible via application-specific triggers. FrankenPHP, which also calls shutdown unconditionally, is assessed susceptible to the application-independent path.

The patch replaces longjmp() for OOM with a delayed soft OOM at the next VM safe point and an immediate hard OOM (_exit()) at a second higher threshold -- request shutdown will no longer see invalid state.

PHP workers handle multiple requests and retain global state between them: error state, session state, object handles, extension state. That state must be reset before the request heap is freed. CVE-2026-109619 is a class of use-after-free vulnerabilities where that reset fails.

The lifecycle: a producer operation stores request-owned state in a global location. A fatal error -- including OOM -- abandons the operation before the matching reset. PHP frees the request heap. The same worker handles the next request. A consumer reads the stale pointer into freed memory. Heap layout manipulation converts the UAF to RCE.

Two paths were confirmed. First: PHP 8.5's fatal_error_backtraces feature stores backtrace data in a global field that is never reset on shutdown. A diagnostic during the next request's init reads the stale pointer -- application-independent RCE on PHP 8.5. Second: session upload progress initializes request-owned session and decoder state before normal session init; an OOM or fatal error prevents the matching reset; a later upload on the same worker consumes the freed state. Validated on both mod_php and FPM.

The full patch resets all identified state families, not just the two confirmed paths.

PHP released patched versions on October 21, 2026 at 14:00 UTC. PHP 5.x and 7.x are end-of-life and will not receive patches.

Updating is the only complete mitigation. Three partial steps reduce risk while a patch window is prepared -- apply them together and restart all PHP workers:

memory_limit=-1 removes the predictable PHP-level memory ceiling the confirmed mod_php OOM path relies on. It does not prevent allocator-level OOM from triggering the same longjmp() path but is the highest-value interim step for mod_php deployments.

session.upload_progress.enabled=0 removes the session lifecycle producer and consumer paths for CVE-2026-109619. It does not cover other state families or the fatal backtrace path.

fatal_error_backtraces=0 (PHP 8.5 only) removes the confirmed backtrace producer for CVE-2026-109619.

After patching, harden the remaining configuration: review post_max_size and max_input_nesting_level, set expose_php=0, and revert any temporary memory_limit=-1. Then check for compromise back to at least June 2026 -- look for files written to web-accessible directories by the web server account, modified .htaccess files, unauthorized accounts, unexpected outbound connections from the web server process, and PHP files with recent timestamps.

No network IOCs exist for PHP2Shell: there is no attacker infrastructure to block. Detection focuses on post-exploitation behavior after RCE is achieved and on the HTTP request patterns that trigger the OOM and stale state conditions. Three log sources cover the critical detection surface: Linux process creation events (auditd or EDR), Linux file events (auditd or EDR), and web proxy/access logs.

What to look for in process events: any shell or script interpreter launched by a web server daemon process. Legitimate web applications do not spawn bash, sh, dash, python, netcat, wget, or curl as children of httpd, apache2, php-fpm, or php. A single hit on this pattern is a high-confidence indicator of successful RCE.

What to look for in file events: the web server account (www-data, apache, nginx) writing a PHP file to any web-accessible directory. Legitimate content management deployments write uploads to configured upload directories; spontaneous writes to web root or outside configured paths indicate webshell deployment.

What to look for in proxy logs: POST requests to PHP endpoints with multipart/form-data content type and abnormally large body size or high header count. CVE-2026-109618 exploits excessive per-part header memory expansion; hunting for outlier multipart request sizes in proxy logs catches probing activity before successful exploitation.

Update PHP immediately. PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain the complete fix. PHP 5.x and 7.x are end-of-life and will not be patched. If you cannot update immediately, apply the interim configuration mitigations below in combination -- none individually constitutes a complete fix.