CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available

What it is

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical PHP core flaws that can allow unauthenticated remote code execution. PHP fixed both on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP says every installation serving web requests is at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest identified risk. Injected code runs with the web worker's privileges, not as root.

How it works

CVE-2026-109618 is out-of-memory corruption. An allocation failure can interrupt PHP while request memory is only partly initialized, and request cleanup then processes that invalid state. PHP validated unauthenticated RCE against mod_php before application code runs. PHP-FPM blocks that particular startup-failure sequence. It is still considered susceptible by other routes, but the advisory reports no complete FPM exploit for this CVE.

CVE-2026-109619 is stale global state. A worker keeps references to request memory after it is freed, and a later request on the same worker can use them. PHP validated a session-lifecycle RCE on mod_php and PHP-FPM. The FPM path needs a suitable application operation, a fatal error, and a further request reaching the same worker.

What to do

Upgrade to a fixed release or a vendor package that contains both fixes, then restart PHP services and workers. Updating WordPress, plugins or themes does not update PHP. Backported vendor packages may keep an older version number, so check the package against the vendor advisory instead of trusting an HTTP version header. Check containers, separate PHP installs, hosted services and products that embed PHP. PHP 8.1 and older are unsupported upstream. PHP supplied minimal source backports for 7.4, 8.0 and 8.1, so confirm with your provider.

Interim measures for CVE-2026-109618 (they do not make an unpatched install safe):

• Enforce memory_limit=-1 administratively so applications cannot restore a finite limit.
• Keep post_max_size conservative and upload_max_filesize below it. Bound request nesting, multipart parts and headers.
• Use container or cgroup memory limits. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable path.

Interim measures for CVE-2026-109619:

session.upload_progress.enabled=0
fatal_error_backtraces=0   ; PHP 8.5 only

Set these before request parsing and restart every worker. Do not rely on ini_set() or FPM .user.ini. Also remove per-request settings that emit diagnostics before initialization, and fix attacker-reachable fatal errors and timeouts. Where an app needs no multipart requests, consider blocking multipart/form-data before PHP. AWS, Cloudflare and Microsoft have published WAF guidance, but WAF rules do not cover every path.

Hunt for these signs:

• PHP workers launching shells or downloading tools.
• Unexpected files, processes or outbound connections.
• Multipart requests containing PHP_SESSION_UPLOAD_PROGRESS. This field has legitimate uses, so its presence alone proves nothing.
• Attempts to read environment variables or config files.

AWS recommends reviewing logs from at least 17 October 2026, its earliest observed attempt. Preserve logs, because patching does not remove an existing compromise.

Caveats

CVE-2026-115560, published by PHP on 23 October 2026, is a separate, unlikely RCE vector. It needs session.serialize_handler set to php_binary or php_serialize and then switched to php at runtime before session_start(), with upload progress enabled. PHP recommends session.upload_progress.enabled=0 until the next bugfix release. Apps that never change the handler at runtime can leave it on. This conflicts with the blanket mitigation above, so follow PHP's October 23 advice.

Exploitation attempts began on 17 October 2026 (Amazon Threat Intelligence). Cisco Talos and Wordfence also report scanning and payload attempts. Wordfence had seen no confirmed compromises as of 22 October. Research published that day describes successful exploitation on specific x86-64 setups with ASLR on and display_errors off, so those settings are not protection. CISA urges immediate patching, internet-facing systems first, and offline operation where patching is impossible.

Horizon3's NodeZero Rapid Response check combines PHP version data with a runtime probe and does not attempt full RCE. A negative result does not prove a system is patched or safe. The page does not give the CVSS scores, and says Red Hat's assessments differ on attack complexity for CVE-2026-109618.