PHP Disclosure Leaks Exposed Two Critical Remote-Code-Execution Flaws
Summary
PHP said leaks exposed details of two critical remote-code-execution flaws before patches were ready. Amazon telemetry recorded attempted exploitation before known leaks, while PHP reported no functional exploits at public disclosure.
Key points
- The PHP Foundation said leaks in its coordinated disclosure process exposed details of CVE-2026-109618 and CVE-2026-109619 before fixes were ready.
- The flaws enable remote code execution through out-of-memory corruption and stale global state; each received a critical CVSS v4 score of 9.2.
- The foundation said it knew about the out-of-memory flaw in 2024, but remediation stalled amid debate over fixes, resource constraints, and compatibility concerns.
- PHP said it moved its planned patch release forward after leaks emerged. It reported no functional exploits identified at public disclosure.
- Amazon telemetry recorded an attempted PHP2Shell exploit against a honeypot on Saturday, before the leaks were known. Amazon said how the actor obtained exploit information was unclear.
- PHP blamed several disclosure failures, including an early proof-of-concept video and Chainguard's publication of fixed images before the coordinated release; Chainguard's CEO said the decision followed evidence of exploitation and how easily an exploit could be built.
- Organizations took some internet-facing PHP servers offline while preparing fixes. The PHP Foundation said it was changing its security-team decision process.
Article Details
- Vulnerability Types
- Out-of-memory corruption
- Stale global state
- Severity
- Critical; both vulnerabilities have a CVE v4 score of 9.2.
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
CVE-2026-109618spilling before fixes were ready. The foundation sat on the out-of-memory flaw now tracked as CVE-2026-109618 for roughly two years while security team members debated the tradeoffs of different fixes.CVE-2026-109619The leaks weren't the only challenge. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, facilitate remote code execution - respectively through out-of-memory corruption and a stale global state - and can be used
People
Alexandre DulaunoyCybersecurity expert with the Computer Incident Response Center Luxembourg who discussed challenges in coordinated vulnerability disclosure.CJ MosesAmazon CISO who said honeypot telemetry showed attempted exploitation from an anonymized IP address before known leaks were spotted.Dan LorencChainguard's CEO; said his team independently discovered the flaw and built an exploit after being read into the coordinated disclosure process.
Vendors
AmazonTelemetry from Amazon's threat intelligence group shows attackers were already trying to exploit the flaw as early as Saturday. The cloud giant's honeypots recorded an attempted PHP2Shell exploitation from an IP addressCalifLater that afternoon, cybersecurity firm Calif, which had reported some of the flaws to PHP developers, "mistakenly published a video" early that showed a proof-of-concept attack in progress, revealing some additionalChainguardThe foundation additionally fingered supply-chain security firm Chainguard for pushing fixes six hours before the rescheduled, coordinated vulnerability disclosure time Wednesday.The PHP FoundationThe PHP Foundation said Wednesday that it detected multiple leaks in its coordinated vulnerability disclosure process, resulting in PHP2Shell details spilling before fixes were ready. The foundation sat on theWizNumerous organizations were involved, including researchers at cybersecurity firms Wiz and Calif, who discovered and reported the vulnerabilities to the PHP team, and joined forces to help coordinate fixes. Over the
Products
Drupalservers, including websites, until they can be fixed. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software thatJoomlaincluding websites, until they can be fixed. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software that doesn'tMagentowebsites, until they can be fixed. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software that doesn't even advertisePHPMaintainers of ubiquitous web scripting language PHP first spotted in 2024 one of the zero days flaws causing an internet-wide scramble to head off attacks sparked by their Tuesday disclosure ahead of patches.WordPressPHP servers, including websites, until they can be fixed. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software