PHP2Shell Flaws Enable Unauthenticated Remote Code Execution Across PHP 7.x and 8.x
Summary
CrowdStrike details two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated command execution through crafted HTTP requests. It recommends patching and describes Falcon detection coverage.
Key points
- CVE-2026-109618 and CVE-2026-109619 are memory-corruption flaws in PHP’s Zend engine, both rated CVSS 4.0 9.2 Critical.
- CrowdStrike says an attacker can exploit the flaws without authentication or vulnerable application code; it verified command execution with an anonymous POST request against Apache mod_php.
- One flaw can trigger during request cleanup after memory exhaustion; the other can leave stale process-level state that is consumed by a later request.
- The issues affect PHP 7.x and 8.x releases, but reachability depends in part on request-size and memory-limit configuration.
- CrowdStrike reports exploitation may return HTTP 200 without unusual application logs; a memory-exhaustion error marked “in Unknown on line 0” may appear in the web-server error log.
- CrowdStrike says Falcon provides post-exploitation detection and has added exposure checks and SIEM detection content for the CVEs.
- The article recommends identifying affected systems and applying the latest security updates.
Article Details
- Vulnerability Types
- Memory-corruption remote code execution caused by uninitialized request memory
- Memory-corruption remote code execution caused by invalid process-scoped global state and use of freed memory
- Severity
- Critical; CVSS 4.0 score 9.2 for both vulnerabilities.
- Affected Versions
- PHP 7.3.0 and later 7.x releases
- PHP 8.x releases
- PHP 7.1 and later releases (CVE-2026-109619 serialization path)
- PHP 5.4 and later releases (CVE-2026-109619 session path)
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Where immediate patching is not feasible, use endpoint behavioral monitoring to detect post-exploitation activity.
MITRE ATT&CK
T1059.004 · Unix ShellSuccessful exploitation can cause an Apache mod_php worker to launch a shell and execute an attacker-specified command.T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker can send HTTP POST requests to exploit vulnerable PHP request parsing on an affected web server.T1505.003 · Web ShellThe article identifies web shell deployment as a possible post-exploitation activity following command execution.
CVE
CVE-2026-109618Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS 4.0 score of 9.2 (Critical) and are classified as CWE-824: Access of Uninitialized Pointer.CVE-2026-109619Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities carry a CVSS 4.0 score of 9.2 (Critical) and are classified as CWE-824: Access of Uninitialized Pointer.
Vendors
Products
CrowdStrike FalconThe CrowdStrike Falcon® platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of both vulnerabilities.CrowdStrike Falcon Next-Gen SIEMFalcon Next-Gen SIEM: Emerging Threat Response DashboardFalcon Exposure ManagementFinding Vulnerable PHP Versions with Falcon Exposure ManagementPHPTwo critical memory-corruption remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, have been disclosed in core PHP, the underlying engine powering a vast portion of the web.