PHP2Shell — Critical Security Alert: Two Vulnerabilities Enable Unauthenticated Remote Code Execution in PHP (CVE-2026-109618 & CVE-2026-109619)

Executive Summary

A critical dual-vulnerability advisory, designated as PHP2Shell, has been officially disclosed impacting the PHP runtime engine. Bearing a severe CVSS score of 9.2 (Critical), these vulnerabilities allow remote, unauthenticated attackers to execute arbitrary code on target web servers running vulnerable versions of PHP.

The security advisory outlines two distinct, highly dangerous memory-safety flaws:

1. CVE-2026-109618: A critical flaw in PHP's out-of-memory (OOM) error-handling logic.
2. CVE-2026-109619: A memory use-after-free (UAF) condition within the internal Zend memory allocator.

When chained or triggered under specific execution conditions, an external attacker can bypass standard application-level controls, manipulate the process heap, and achieve Unauthenticated Remote Code Execution (RCE) without requiring prior access, valid user credentials, or social engineering.

With PHP powering nearly 75% of all web applications worldwide—including enterprise frameworks, CMS platforms (WordPress, Drupal, Joomla), API gateways, and custom microservices—this vulnerability poses an immediate threat to internet-facing infrastructure.

---

PHP2Shell Vulnerabilities at a Glance

Parameter	Details
Vulnerability Name	PHP2Shell
CVE Identifiers	CVE-2026-109618 & CVE-2026-109619
CVSS v3.1 Score	9.2 (Critical)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N) — Completely Unauthenticated
User Interaction	None (UI:N)
Vulnerability Types	Out-of-Memory Handling Flaw & Memory Use-After-Free (UAF)
Impact	Remote Code Execution (RCE), System Compromise, Shell Access
Official Source	Official PHP Security Advisory

[!CAUTION] Zero Authentication Required: Exploitation of PHP2Shell can be conducted remotely over HTTP or HTTPS. An attacker does not need an active session, API key, or administrative credentials to compromise a target server running vulnerable PHP binaries.

---

In-Depth Vulnerability Analysis

The vulnerability name PHP2Shell reflects the weaponization chain that allows attackers to turn a routine HTTP request into an interactive reverse or bind shell on the host operating system.

1. CVE-2026-109618: Out-of-Memory (OOM) Error Handling Flaw

The first component of the vulnerability centers on how the Zend Engine handles memory exhaustion:

• During normal operations, PHP imposes a configurable memory cap per request via memory_limit (commonly 128M or 256M).
• When an incoming request initiates large allocations—such as nested multipart body processing, compressed stream decoding, or large JSON/XML parsing—the engine triggers an Out-of-Memory (OOM) fatal bail-out.
• In vulnerable versions, the error cleanup handler fails to safely unwind internal pointers and free execution frames in the correct sequence.
• This leaves dangling references in global hash tables and request-lifecycle state structures, placing the PHP execution thread in a corrupted, unstable heap configuration.

2. CVE-2026-109619: Memory Use-After-Free (UAF)

The second vulnerability exploits the corrupted state left by the cleanup failure:

• Following the incomplete deallocation, subsequent memory operations attempt to reference memory blocks that have already been freed or partially reallocated by the Zend memory manager (zend_mm).
• An attacker can groom the heap using concurrent or pipeline-crafted HTTP requests, replacing the freed memory block with controlled data structures (such as forged zend_string or object handler tables).
• Once the engine dereferences the stale pointer, control flow is hijacked, allowing arbitrary machine code execution under the privileges of the web worker (www-data, nginx, or apache).

[ Remote Attacker ]
        │
        ▼ (Specially crafted HTTP payload triggering memory spike)
[ PHP Web Application / PHP-FPM Worker ]
        │
        ├── 1. Memory exhaustion triggered (CVE-2026-109618)
        ├── 2. Zend bail-out handler fails to clear internal table pointers
        ├── 3. Dangling memory reference created in heap
        │
        ▼ (Heap grooming payload injected via concurrent request)
[ Corrupted Memory Slot Reallocated (CVE-2026-109619) ]
        │
        ├── 4. Stale pointer dereferenced during shutdown/cycle handler
        ├── 5. Instruction pointer hijacked (EIP/RIP control)
        │
        ▼
[ Remote Code Execution Achieved — Shell Spawned ]

---

Affected Versions & Patch Matrix

The PHP development team has issued immediate security updates across all currently supported release branches. Verify your environment against the matrix below:

PHP Branch	Status	Vulnerable Versions	Minimum Patched Version
PHP 8.5	Current Stable	< 8.5.12	8.5.12
PHP 8.4	Supported	< 8.4.27	8.4.27
PHP 8.3	Supported	< 8.3.36	8.3.36
PHP 8.2	Security Only	< 8.2.35	8.2.35
PHP 8.1 & older	End-of-Life (EOL)	All versions	No official patches released

[!WARNING] Legacy and EOL PHP Versions: PHP 8.1, 8.0, 7.x, and 5.x have reached End-of-Life and will not receive official security updates. If your organization operates legacy PHP workloads, they are permanently exposed unless migrated to a supported branch or shielded behind strict network and WAF isolation.

---

How to Verify Your PHP Version

To determine whether your environments are vulnerable to PHP2Shell, perform the following verification steps across your instances, containers, and pipelines:

1. Command Line Verification (CLI & PHP-FPM)

Run the following command on your application hosts:

php -v

Expected output for a secure installation (example for PHP 8.4 branch):

PHP 8.4.27 (cli) (built: Oct 2026) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.4.27, Copyright (c) Zend Technologies

If your web server utilizes PHP-FPM, check the running FPM binary directly:

php-fpm -v
# Or for versioned installations:
php-fpm8.4 -v
php-fpm8.3 -v

2. Package Manager Audit

Debian / Ubuntu

dpkg -l | grep -E "php[0-9]"

RHEL / CentOS / Rocky Linux / AlmaLinux

rpm -qa | grep -E "php(-common|-fpm|-cli)"

Alpine Linux (Container Base)

apk info -v | grep php

3. Docker & Containerized Workloads

Inspect your active container images:

docker run --rm <your-app-image> php -v

---

Emergency Remediation & Action Plan

Organizations should execute the following five-step remediation procedure immediately:

Step 1: Upgrade PHP Binaries to Fixed Releases

Upgrade using your operating system's native package manager or official repository mirrors:

Ubuntu / Debian (using Ondřej Surý PPA or official repos)

sudo apt update
sudo apt install --only-upgrade php8.4 php8.4-fpm php8.4-cli \
  php8.3 php8.3-fpm php8.3-cli \
  php8.2 php8.2-fpm php8.2-cli

RHEL / Rocky Linux / AlmaLinux (using Remi's Repository)

sudo dnf check-update
sudo dnf upgrade php\*

Alpine Linux / Docker Base Images

Update your Dockerfile base image tags and rebuild:

# Ensure you rebuild without caching to pull the latest security patch
FROM php:8.4.27-fpm-alpine

Step 2: Restart Web Server and Application Workers

Upgraded packages on disk do not protect running worker processes in memory. You must restart PHP-FPM and your web server:

# Restart PHP-FPM
sudo systemctl restart php8.4-fpm
# or
sudo systemctl restart php-fpm

# Reload Web Server
sudo systemctl reload nginx
# or
sudo systemctl reload apache2

Step 3: Temporary Mitigations (If Immediate Upgrades Are Blocked)

If production change freezes or legacy dependencies prevent an immediate patch rollout, implement the following compensating controls:

1. Deploy Web Application Firewall (WAF) Rules:

   • Restrict maximum HTTP request body size (client_max_body_size in Nginx / LimitRequestBody in Apache).
   • Filter abnormal nested multipart boundaries and excessively fragmented chunked encoding requests.

2. Harden PHP Execution Boundaries:

   • Disable dangerous system execution functions in php.ini if not strictly required:

     disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
     

   • Set strict memory limits and execution timeouts to minimize heap manipulation windows:

     max_execution_time = 30
     max_input_time = 30
     

3. Container Sandboxing:

   • Enforce read-only root filesystems (read_only: true in Kubernetes / Docker).
   • Drop all non-essential Linux capabilities (cap_drop: ["ALL"]).
   • Never run PHP workers as the root user.

---

Proactive Defense with VAPT Insights

Vulnerabilities in runtime engines like PHP reinforce the necessity of continuous, automated perimeter and supply chain security. Point-in-time annual audits cannot protect against critical zero-day and unauthenticated RCE advisories.

With VAPT Insights:

• Continuous Perimeter Scanning: Automatically detects exposed, out-of-date PHP runtimes, vulnerable HTTP endpoints, and insecure headers across all your subdomains and IP addresses.
• Automated SBOM & Container Dependency Tracking: Scans your base images, OS packages, and language libraries within CI/CD pipelines before code reaches production.
• Unified Security Intelligence: Consolidates CVE telemetry across all your microservice repositories into a single pane of glass with actionable remediation guidance.

Protect your perimeter today by running an instant security scan at VAPT Insights.

---

References & Official Sources

• Official PHP Security Advisory
• National Vulnerability Database (NVD)
• VAPT Insights Security Intelligence Hub