PHP "php2shell" Critical Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)

1. Threat Overview & Timeline

Over 75% of websites with known server-side programming languages run on PHP. On October 21, 2026, security researchers coordinated with the PHP Core Team to disclose two profound architectural flaws residing directly within the Zend Memory Management (Zend MM) and global request lifecycle layers.

Telemetry collected by global threat intelligence sensors (including AWS MadPot and honeypot fleets) recorded weaponized proof-of-concept scanning within 36 hours of publication. The attack requires no prior authentication, no uploaded executable files (like .php backdoors), and succeeds even on default, hardened web configurations.

2. Deep Technical Root Cause Analysis

CVE-2026-109618: Out-Of-Memory Abortion via longjmp()

In standard execution, PHP processes requests inside the Zend Engine with pre-configured memory constraints (memory_limit). When an execution pathway requests memory beyond this ceiling, PHP invokes internal memory handlers that issue a C runtime longjmp() call.

The issue stems from complex allocation routines—specifically during nested multipart parsing and large string concatenations. If an out-of-memory error triggers midway through a multi-step heap allocation:

• The abrupt longjmp() skips the remaining initialization instructions for adjacent pointers.
• The Zend garbage collector and request teardown logic (shutdown_memory_manager) assume the memory blocks conform to valid structures.
• When the web server worker (e.g., PHP-FPM or Apache worker) is kept alive to service subsequent requests, attackers can leverage this uninitialized chunk to overwrite function pointers and pivot into arbitrary code execution.

CVE-2026-109619: Stale Global State & Use-After-Free (UAF)

PHP retains several global internal states that briefly reference request-bound structures to maintain high throughput. A prominent example is the Session Upload Progress tracking mechanism (session.upload_progress.enabled).

When a client submits an upload progress form that triggers an unhandled fatal error or connection reset, the cleanup handlers free the request-bound memory pool but fail to clear the global pointer table. Consequently:

• The global pointer continues to point to freed heap memory.
• A following request allocated on the same PHP-FPM worker thread re-allocates that exact memory block with attacker-controlled user input.
• A Use-After-Free condition is achieved, enabling unauthorized memory read/write primitives and shell execution.

3. Official Patch Matrix

The PHP development team released the following patch versions on October 21, 2026. Verify your running PHP version and upgrade immediately to match or exceed the patched versions below:

4. Step-by-Step Remediation Guide

A. Debian / Ubuntu Server (Ondřej Surý PPA or Default Repositories)

# Update package repositories
sudo apt-get update

# Upgrade PHP runtime and common modules
sudo apt-get --only-upgrade install php8.2 php8.2-fpm php8.2-cli \
    php8.3 php8.3-fpm php8.3-cli php8.4 php8.4-fpm php8.4-cli

# Restart PHP-FPM and Web Server
sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx # or apache2

# Verify active version
php -v

B. RHEL / Rocky Linux / AlmaLinux (Remi's RPM Repository)

# Clean metadata and update packages
sudo dnf clean all
sudo dnf upgrade php php-cli php-fpm

# Restart service
sudo systemctl restart php-fpm
sudo systemctl restart httpd

C. Docker Containers & Kubernetes Deployments

Rebuild all container images pulling from updated base images (e.g., php:8.3.36-fpm-alpine or php:8.4.27-fpm). Rolling restarts of pods will flush out vulnerable in-memory workers.

# Example Dockerfile fix
FROM php:8.3.36-fpm-bookworm

# Ensure package security updates run during build
RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*

5. Emergency Compensating Controls (If Upgrade is Delayed)

If you are in an enterprise freeze window or managing legacy code that cannot be updated immediately, apply these defensive controls to disrupt known exploit chains:

6. Frequently Asked Questions