 |
| Two critical flaws in the PHP interpreter allow code execution without authentication. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them. |
The PHP development team has released emergency security updates for two critical vulnerabilities that allow unauthenticated attackers to execute arbitrary code on vulnerable servers. Dubbed "PHP2Shell," the flaws affect nearly every version of PHP and pose the greatest risk to Apache servers running mod_php.
The patches, released Wednesday at 14:00 UTC, arrive a day earlier than originally planned after technical details leaked on Hacker News. The updates address CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale.
The Flaws: A Decade-Old Bug Finally Weaponized
Both vulnerabilities exist in the PHP interpreter itself—not in any application framework or CMS—meaning even a simple "Hello World" page running on an unpatched server could be compromised.
CVE-2026-109618: Out-of-Memory Corruption
This flaw stems from how PHP handles memory exhaustion errors. When an out-of-memory condition occurs during request parsing, PHP uses longjmp() to exit the current context—even when request memory is only partially initialized. The shutdown procedure then treats this invalid state as legitimate. Attackers can trigger the condition through crafted multipart requests that stay within post_max_size but exhaust memory_limit through excessive headers, empty file fields, or nested field names.
According to the official PHP advisory, the patch replaces longjmp() with a delayed soft OOM at the next VM safe point and a hard _exit() above a second, higher threshold.
CVE-2026-109619: Stale Global State
The second vulnerability involves global state that persists across requests. When a fatal error aborts an operation before it resets its state, a global field continues pointing to freed heap memory. The next request handled by the same worker reads this stale value before normal initialization, resulting in a use-after-free condition. PHP's advisory identifies two confirmed exploitation paths: the fatal_error_backtraces setting in PHP 8.5 and session upload progress, which is enabled by default.
Why mod_php Users Face the Highest Risk
Apache with mod_php represents the most dangerous configuration. The module unconditionally invokes request shutdown procedures even when request startup has already failed. Running out of memory during request body parsing is sufficient to trigger exploitation—no application code needs to execute.
PHP researchers validated complete remote code execution against mod_php with default memory and input limits. While PHP-FPM terminates child processes when startup fails (blocking the direct attack path for CVE-2026-109618), the second flaw was successfully exploited against a normal FPM pool, though it requires a suitable application operation.
Security firm Wiz Research discovered the vulnerabilities and reported them on August 24. According to their analysis, FrankenPHP appears to behave similarly to mod_php, while LiteSpeed's LSAPI is a conditional candidate.
Active Exploitation Attempts Detected
The Hacker News reports that Cloudflare observed early attack traffic before patches shipped, with attackers modifying payloads to bypass firewall rules. Security firm watchTowr confirmed active exploitation attempts against both CVEs as of 14:19 UTC on October 21.
No successful compromises have been confirmed publicly. However, several organizations took precautionary measures: BambooHR temporarily took its service offline across multiple countries, and Dutch government services including DigiD and MijnOverheid went offline as a safety measure.
The UK's National Cyber Security Centre (NCSC) issued urgent guidance, recommending organizations take unpatched systems offline if temporary mitigations cannot be applied quickly.
AI Played a Central Role in Discovery
Wiz credits Gemini 4 Argon and GPT-5.6 Sol with assisting in vulnerability discovery, exploit development, and patch validation. The PHP Foundation revealed that a core developer first spotted signs of the out-of-memory flaw during PHP's 2024 external audit, but no working exploit was demonstrated at the time. Work stalled for months due to disagreements over fix approaches before AI-assisted research established the full impact.
Calif, one of the research firms involved, traced the bug's lineage to PHP research from 2004. The researchers say AI models helped compress what would have taken a team months into roughly one week of work.
What Administrators Must Do Now
Update immediately. The only complete fix is upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Linux distributions and LTS vendors received patches in advance—check package changelogs for the CVE identifiers rather than relying on version strings.
For systems that cannot be updated immediately:
- Set
memory_limit=-1administratively to remove the predictable per-request limit exploited by CVE-2026-109618 - Set
session.upload_progress.enabled=0and restart all workers - On PHP 8.5, set
fatal_error_backtraces=0 - Keep
post_max_sizeconservative and enforce request-size limits at the frontend - Block multipart form data entirely if your application doesn't use it
Huntress notes that PHP 8.1 and earlier no longer receive official updates. Minimal source backports exist for PHP 7.4, 8.0, and 8.1, but end-of-life branches require administrators to build from source or migrate to supported versions.
The NCSC recommends auditing systems for evidence of compromise before upgrading, watching for unusual multipart requests, memory-limit errors, repeated HTTP 500 responses, and unexpected PHP worker restarts.
For organizations running WordPress, Drupal, Joomla, or other PHP applications, remember that updating the CMS does not update the PHP runtime beneath it. The fix must come from the server package, hosting provider, or container image.