PHP patches two critical RCE flaws after AWS reports pre-disclosure exploitation attempts

Summary

Datadog analyzes two critical PHP RCE flaws, their request-processing and stale-state mechanisms, and exploitation. AWS reported attempts as early as Oct. 17, before disclosure; PHP fixed releases are available, and patching is the only complete remedy.

Key points

CVE-2026-109618 and CVE-2026-109619 are critical PHP remote-code-execution vulnerabilities, each rated 9.2 under CVSS v4.0.
Datadog reproduced unauthenticated command execution during PHP request cleanup, before application code runs; successful exploitation need not crash the worker.
CVE-2026-109618 involves incomplete internal state after memory allocation failure; CVE-2026-109619 involves stale state reused across requests.
AWS reported PHP2Shell exploitation attempts as early as October 17, 2026—four days before public disclosure and patches.
Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP provided source backports for 7.4, 8.0, and 8.1.
Patching is the only complete fix. Reverse-proxy controls and configuration changes may reduce exposure but do not fully protect affected systems.
For investigation, correlate unusually large form submissions, request-initialization memory errors, and unexpected shell processes; no single signal is conclusive.

Article Details

Attack Vectors: CVE-2026-109618 can be triggered by an unauthenticated HTTP POST with crafted form fields that cause memory exhaustion during PHP request initialization, leaving an incomplete hash-table entry that cleanup processes as attacker-controlled data.
CVE-2026-109619 can be exploited when a fatal error or shutdown diagnostic leaves stale request state for a later request handled by the same PHP worker; described paths involve fatal-error backtraces and upload processing.
For CVE-2026-109618, heap grooming can place forged data in the unfinished bucket so request cleanup invokes system() with an attacker-supplied command. The article reports PHP2Shell exploitation attempts in the wild, citing AWS.
Defensive Notes: Apply patched PHP releases or vendor-patched packages, rebuild affected container images, and restart or replace workers still running vulnerable runtimes. Patching is the only complete fix described.
If patching is delayed, restrict public access or use a reverse proxy or other boundary control to block requests before they reach PHP's parser.
For CVE-2026-109618, the article recommends administrator-level memory_limit=-1 together with frontend request limits and container memory limits; limit decoded request-body size, including requests without a usable Content-Length header. These measures do not fully fix the flaw.
For CVE-2026-109619, disable session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces; load settings before request parsing and restart workers. These measures reduce exposure but do not fully fix the flaw.
Inspect unusually long form-field names, unexpected control bytes in form submissions, PHP memory-exhaustion errors during request initialization, and unexpected shells or commands spawned by web workers. Correlate signals because none alone is conclusive.
Inventory PHP runtimes bundled in containers and applications, rather than relying only on the command-line PHP installation.