PHP2Shell RCE: CVE-2026-109618 and CVE-2026-109619 Threaten 70% of Web Servers -- Patch PHP Now

CVE-2026-109618 exploits PHP's behavior when a request runs out of allocated memory at the wrong execution point. PHP's memory manager deallocates request-scoped variables, but the deallocation is incomplete when it occurs during internal data structure operations. The result is a half-initialized worker state that persists into the memory pool available to the next request on the same worker process. An attacker sends a crafted request that reliably triggers this specific OOM condition, then a second request that lands on the same worker and exploits the corrupted memory layout to overwrite a function pointer or return address.

CVE-2026-109619 takes a different path to the same result. PHP maintains global state across the lifecycle of a worker process, including internal tables for class definitions, function registries, and extension contexts. Under specific request sequencing, data from a completed request remains accessible in this global state after the response is sent. A follow-up request from any source can read or write that dangling reference, a classic use-after-free condition. Both CVEs share the CWE-824 root cause classification (Access of Uninitialized Pointer) and both require zero authentication from the attacker.

The PHP team identifies Apache mod_php as highest-risk because Apache's prefork and event MPMs share worker memory more directly across requests than FPM-based configurations. PHP-FPM pools are also affected when pool recycling is not aggressive enough to clear stale state between requests. Rapid7's ETR notes that working exploits require specific combinations of OS, PHP version, and web server configuration, but the public PHP2Shell toolkit already packages multiple working variants targeting the most common configurations.

PHP 8.2, 8.3, 8.4, and 8.5 are all affected by both CVEs. The PHP team also released minimal backports for the end-of-life branches PHP 7.4, 8.0, and 8.1, which remain deployed on a significant share of production infrastructure. Any PHP installation serving live HTTP requests through Apache, Nginx with php-cgi, FrankenPHP, or LiteSpeed is in scope.

The exposure distribution skews heavily toward Apache mod_php and PHP-FPM. A runZero scan of internet-reachable PHP servers identified millions of unpatched instances in the 72 hours following disclosure. Government sites in at least three countries went offline proactively after disclosure, rather than risk serving traffic on vulnerable PHP builds, and the NSA issued an internal advisory urging federal operators to update or take PHP services offline.

Organizations still on PHP 7.4 or 8.0 face compounding risk: those branches have reached end of life, and the backport is a one-time emergency release that does not commit to ongoing security maintenance. The correct long-term response for those deployments is migration to a supported branch.

The PHP security team received a responsible disclosure report from ox.security researchers in mid-October 2026. The team fast-tracked an out-of-band release, avoiding the normal monthly cycle, and coordinated with CISA to issue a simultaneous advisory on October 21. A proof-of-concept toolkit labeled "PHP2Shell" appeared on a public tech forum approximately 24 hours before the official fix shipped, forcing the accelerated release timeline.

SecurityWeek's sensor network confirmed exploitation attempts within 48 hours of the public disclosure. Beazley Security Labs' advisory from October 23 describes the PHP2Shell PoC as demonstrating reliable unauthenticated RCE against Apache mod_php on major Linux distributions. Rapid7's ETR states that exploit code is being independently reproduced across multiple research teams, and it expects weaponized variants targeting the broadest-exposure configurations to be broadly available within days.

CrowdStrike confirmed its Falcon platform is blocking PHP2Shell-sourced exploitation attempts as of October 23. The University of Toronto issued an internal advisory to all departments running web applications on PHP, and the Beazley advisory was classified as involving "active exploitation" in the title, reflecting the sensor-confirmed exploitation attempts.

Defenders should treat this as actively exploited. The combination of a public PoC, independent reproduction, and confirmed sensor hits means the window between "being exploited by targeted actors" and "mass automated scanning" is closing fast.

No attacker-controlled C2 infrastructure has been publicly attributed to PHP2Shell campaigns as of October 24. The following behavioral and structural indicators are derived from the vulnerability's exploitation mechanics and are ready for immediate SIEM and EDR rule creation.

The most reliable host-based signal is a web server worker process spawning an interactive shell. A legitimate PHP application never forks /bin/bash, /bin/sh, or /bin/dash as a child of the apache2 or php-fpm process. Any such event is high-confidence exploitation. Similarly, any new PHP file written by the www-data, apache, or nginx user to a web-accessible directory outside of a known deployment window should be treated as webshell installation.

On the network side, look for unexpected outbound connections from web server processes: a php-fpm or apache2 process initiating a TCP connection to an external IP on ports 4444, 1337, 9001, 9999, or any non-standard high port is a strong post-exploitation indicator. The absence of a prior outbound connection pattern from that process makes these events easy to baseline and alert on.

Two detection rules cover the primary PHP2Shell attack phases: initial exploitation (web server spawning a shell) and post-exploitation webshell persistence (web server writing unexpected PHP files). Both carry experimental status; validate against your Linux audit logging configuration before enabling automatic blocking.

Patching is the only complete fix. The PHP team explicitly states no configuration change, permission restriction, or web server setting fully mitigates CVE-2026-109618 or CVE-2026-109619. Every PHP installation serving live web traffic must be updated. The remediation sequence below prioritizes the highest-risk deployment mode first.

For organizations that cannot patch within hours, removing the PHP-FPM socket from external reach and temporarily disabling session.upload_progress in php.ini reduces the attack surface for the most common exploit path without shutting down application functionality entirely. This is a temporary measure only.

PHP2Shell is structurally different from most web application CVEs. This is not a flaw in a specific CMS, framework, or plugin -- it is a flaw in the PHP language runtime itself. Every organization running PHP-backed infrastructure is exposed regardless of how well they harden their application code.

The attack requires no credentials, no prior access, and no special knowledge of the target application. An attacker can enumerate PHP servers via Shodan or Censys, run the PHP2Shell toolkit against identified targets, and obtain remote code execution without interacting with any application logic. This is the same attack profile that made Log4Shell devastating in 2021 and ProxyShell devastating in 2022: a flaw in a widely deployed runtime component that attackers can target at scale.

Review your full PHP deployment inventory. Legacy applications, development and staging environments, and test servers running older PHP branches are frequently overlooked during patch cycles. Any one of those hosts could be used as a pivot point into your internal network once compromised.

For related pre-auth RCE context on similarly structured web infrastructure vulnerabilities, see ServiceNow CVE-2026-18885 Unauthenticated RCE and Exchange CVE-2026-62911 Pre-Auth RCE.