PHP2Shell: Two Critical PHP Flaws, Exploitation Evidence and Mitigations

Summary

PHP2Shell covers two critical PHP flaws that can enable code execution or memory disclosure. Patches are available; CISA lists both as exploited, while honeypot activity supports exploitation of CVE-2026-109618. The article outlines remediation and log hunts.

Key points

CVE-2026-109618 involves out-of-memory corruption; CVE-2026-109619 involves stale request state and a use-after-free. Both are rated CVSS v4.0 9.2 and may enable unauthenticated code execution or sensitive process-memory disclosure, depending on configuration.
PHP fixes are listed as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or vendor-confirmed patched packages. Restart serving workers and rebuild or replace affected containers; updating application code alone does not fix PHP.
CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26. Amazon recorded an exploitation attempt on October 17; a separate investigation observed 35 shell executions across three PHP 8.4.26 mod_php honeypots on October 24, consistent with CVE-2026-109618. The honeypot results do not establish reliability across deployments or production impact.
As of October 28, the article reports no publicly confirmed bypass of the October 21 fixes in the sources reviewed. Separate, configuration-dependent CVE-2026-115560 is not addressed by those releases; PHP recommends setting session.upload_progress.enabled=0 pending its fix.
The article recommends temporary configuration and request-size controls alongside patching, and warns that some settings carry availability risks. These measures do not replace the fixes.
SRF reported that Touring Club Switzerland confirmed customer and booking data theft involving Camping.Care. Reporting linked it to PHP2Shell, but attribution to either CVE remains unverified.
Detection guidance recommends correlating process telemetry for PHP or web-server workers launching shells and download tools with web and PHP logs. The article cautions that missing process matches or logged errors do not rule out exploitation or memory disclosure.

Article Details

Vulnerability Types: Out-of-memory memory corruption
Use-after-free
Severity: CVSS v4.0 9.2 for CVE-2026-109618 and CVE-2026-109619
Affected Versions: PHP 8.2–8.5 (pre-patch releases; exploitability depends on configuration)
Exploitation Status: active
Exploit Availability: public_exploit
Patch Status: partial
Workarounds: Set session.upload_progress.enabled=0 administratively and verify that .htaccess or .user.ini files do not re-enable it.
On unpatched PHP 8.5, set fatal_error_backtraces=0.
Enforce conservative limits on decoded request size, input fields, multipart parts, headers, and nesting; block multipart requests where unnecessary.