PHP2Shell: Emergency PHP Fixes and Detection Guidance for Two Critical RCE Flaws

Oct 21, 2026 · Original article ↗

Summary

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. The article details separate WAF signatures, detection rules and compromise hunts for the two unauthenticated RCE flaws, stressing that patching is the only complete remedy.

Key points

Both flaws are rated CVSS v4.0 9.2 and permit unauthenticated code execution as the web worker account; CVE-2026-109619 also permits worker memory disclosure.
Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Restart all workers after upgrading; the article says affected code dates back to PHP 5.4.
Apache mod_php is the demonstrated exploitation path. PHP reported no complete FPM exploit for CVE-2026-109618, but the article warns that other web SAPIs remain at risk.
For CVE-2026-109618, the guidance blocks oversized form field names in both URL-encoded and multipart requests, accounts for parser differences, and avoids relying on Content-Length.
For CVE-2026-109619, approximately 450-byte exploit bodies evade size heuristics. Suggested signatures inspect multipart session-ID fields and suspicious filenames; disabling session.upload_progress is a temporary mitigation.
The article supplies ModSecurity and Suricata rules and explains inspection-window limitations and false-positive tuning. Its AWS WAF and Cloudflare rules are explicitly untested.
Hunting guidance covers memory errors attributed to 'Unknown on line 0,' oversized POST bursts, web-worker shell execution, persistence and outbound connections. The article attributes emerging attack reports to security teams and responders.

Article Details

Defense Focus: Detect and prevent exploitation of two independent PHP engine RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and hunt for compromise during the exposure window beginning 2026-10-20.
Detection Methods: Detect PHP fatal errors containing both 'tried to allocate' and 'in Unknown on line 0', indicating allocation failure outside normal script execution.
Inspect URL-encoded and multipart form field names for lengths of at least 1,000 bytes; distinguish names from values and include bare keys without a trailing equals sign.
Inspect multipart part headers for a PHPSESSID form field, PHP open tags in filenames, or serialized-object syntax in filenames. Correlate PHP_SESSION_UPLOAD_PROGRESS with PHPSESSID, but do not block upload-progress fields alone.
Hunt for POST bodies of at least 1,000,000 bytes and aggregate at least 10 matching requests per source address over a rolling 10-minute window; a .php path is optional.
Detect Linux web-worker processes spawning shells with -c or -lc and suspicious command-line patterns, tuning for legitimate application activity.
Correlate hundreds of large POST requests with Apache AH00052 errors and a subsequent slow request as possible ASLR brute-force activity.
Hunt for HTTP 200 responses to large POST requests containing Allowed memory size errors, unexpected worker child processes, web-user outbound connections, and files modified in temporary or web-writable directories.
Check for unfamiliar PHP files, modified authorized_keys, new web-user cron entries, and unexpected database changes where the web account has database access.
Data Sources: Web server access and error logs
PHP error logs
WAF, reverse proxy, and load balancer request telemetry
HTTP request bodies and multipart part headers
Plaintext HTTP traffic behind TLS termination
Linux process telemetry and audit logs
File modification and outbound connection telemetry
SSH authorized_keys, cron entries, web roots, and database audit evidence
Rule Types: ModSecurity SecRule request-body inspection rules
Suricata HTTP signatures using content matches and PCRE
AWS WAF regex pattern sets, ByteMatchStatement, SizeConstraintStatement, and rate-based rules; supplied configurations are untested
Cloudflare WAF body regex and size rules; supplied configurations are untested
SIEM Boolean event filters and source-address aggregation
Defensive Actions: Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart every worker. Prioritize internet-facing Apache mod_php deployments; updating is the only complete remediation.
Inventory all PHP installations, including bundled runtimes, appliances, control panels, CI runners, and container images. Upgrade end-of-life branches or obtain vendor updates or the published source backports.
For temporarily unpatched CVE-2026-109619 exposure, administratively disable session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces; restart workers and verify that settings are not overridden.
For temporarily unpatched CVE-2026-109618 exposure, the article lists memory_limit = -1 as an incomplete mitigation; do not treat configuration changes as substitutes for patching.
Block multipart form data where applications do not need it, deploy family-specific managed or custom WAF rules, and purge session.save_path to remove previously poisoned session files.
Inspect actual request bodies rather than relying on Content-Length. Optionally cap URL-encoded POST bodies at 1 MB where application behavior permits, and rate-limit more than 10 large POSTs per source IP per minute as a backstop.
Enable complete request-body inspection, size limits to accommodate legitimate traffic, reject parsing failures and partial inspection, and validate parsed form-name lengths as well as raw headers.
Account for cloud WAF inspection-window bypasses through padding; use origin-side full-body inspection where needed.
For network inspection, align body inspection limits, minimum inspection size, inspection window, and stream reassembly depth; inspect plaintext HTTP behind TLS termination.
Deploy rules in logging or Count mode first, review matches, then enable blocking. Ship web, PHP, and process telemetry to the SIEM and hunt across the entire exposure window, not only after patching.