Critical PHP2Shell Flaws Enable Unauthenticated Remote Code Execution
Summary
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) enable unauthenticated RCE. PHP released fixes on October 21, 2026; early exploitation reports are inconsistent, and end-of-life versions have no planned fix.
Key points
- CVE-2026-109618 involves out-of-memory corruption; CVE-2026-109619 involves stale global state and use-after-free conditions.
- The flaws affect PHP installations serving web requests across multiple server configurations and can expose worker memory containing passwords, session tokens, and API keys.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are end-of-life and have no planned fix.
- Details leaked before the coordinated release, and attack attempts, honeypot observations, and public proof-of-concept research were reported; exploitation evidence was inconsistent.
- ReliaQuest reported no successful exploitation in its customer environments at the time of writing.
- The article recommends patching or upgrading unsupported versions, rotating credentials and secrets on exposed servers, and investigating activity predating remediation.
- Monitor for web-server processes spawning shells, suspicious PHP requests, web-shell changes, worker crashes, and anomalous outbound connections.
Article Details
- Vulnerability Types
- Out-of-memory corruption leading to remote code execution
- Use-after-free caused by stale global state, leading to remote code execution
- Severity
- Both vulnerabilities are rated CVSS v4.0 9.2.
- Affected Versions
- PHP versions earlier than 8.5.12
- PHP versions earlier than 8.4.27
- PHP versions earlier than 8.3.36
- PHP versions earlier than 8.2.35
- PHP 8.1 and earlier, reported affected back to PHP 5.4
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Upgrade end-of-life PHP versions; the article says no fix is planned for PHP 8.1 and earlier.
MITRE ATT&CK
T1021 · Remote ServicesThe article describes possible lateral movement after gaining code execution on PHP servers.T1033 · System Owner/User DiscoveryThe article lists whoami and id among discovery commands to monitor for after exploitation.T1041 · Exfiltration Over C2 ChannelThe article says post-exploitation may include data theft from compromised PHP servers.T1053 · Scheduled Task/JobScheduled tasks are identified as a possible persistence method after compromise.T1059.001 · PowerShellThe article recommends detecting web-server or PHP processes spawning PowerShell after exploitation.T1059.003 · Windows Command ShellThe article recommends detecting web-server or PHP processes spawning cmd.exe after exploitation.T1059.004 · Unix ShellThe article recommends detecting web-server or PHP processes spawning bash or sh after exploitation.T1078 · Valid AccountsThe article identifies persistence through creating new accounts after compromise.T1082 · System Information DiscoveryPost-exploitation discovery commands listed include uname and system-identification activity.T1105 · Ingress Tool TransferThe article describes attackers downloading tools after gaining code execution and recommends watching for curl and wget.T1190 · Exploit Public-Facing ApplicationThe flaws allow unauthenticated remote code execution through crafted requests to PHP web servers.T1505.003 · Web ShellThe article warns that attackers may persist through web shells, including new PHP files placed in web roots.
CVE
CVE-2026-109618PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026.CVE-2026-109619PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026.
Vendors
Products
Drupalremote code execution (RCE) on servers running PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and a large share of the world's websites.Joomlacode runs. Researchers have shown unauthenticated RCE against default installations of WordPress, Drupal, Joomla, and Magento without any application-layer flaw. The bugs can also leak worker memory containingLaravelcode execution (RCE) on servers running PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and a large share of the world's websites.Magentoremote code execution (RCE) on servers running PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and a large share of the world's websites.PHPPHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026.WordPressunauthenticated remote code execution (RCE) on servers running PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and a large share of the world's websites.