PHP2Shell Flaws Enable Memory Disclosure and Unauthenticated RCE in PHP

Summary

PHP2Shell comprises two CVEs covering four bugs. Crafted multipart uploads can trigger out-of-memory failures and stale pointers, enabling memory disclosure and demonstrated unauthenticated RCE. The article details affected PHP releases, detection clues and patches.

Key points

The article describes two critical PHP CVEs, CVE-2026-109618 and CVE-2026-109619, covering four bugs in the PHP core.
A crafted multipart upload can trigger an out-of-memory failure during session upload-progress handling; skipped worker cleanup leaves stale engine pointers.
The described use-after-free bugs can disclose worker memory through a PHPSESSID response cookie and enable memory corruption; unauthenticated RCE was demonstrated on current WordPress, Drupal and Joomla container images.
A separate OPcache type-confusion flaw can corrupt shared cache state across workers; the article says the specific requests and steps for this issue were not disclosed.
The article says PHP versions back to 5.4 are affected across PHP-FPM, Apache modphp, php-cgi, FrankenPHP and LiteSpeed, with modphp carrying the greatest risk.
Fixes shipped October 21 for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the article says PHP 8.1 and older have no official release.
Suggested response includes hunting for unusual multipart uploads, memory-limit errors, HTTP 500 bursts or malformed PHPSESSID cookies, patching exposed systems, and rotating secrets on exposed servers.

Article Details

Attack Vectors: An unauthenticated attacker sends a crafted multipart/form-data upload that triggers an out-of-memory error during PHP session upload-progress handling. The aborted request skips worker cleanup, leaving stale engine pointers when the worker is reused.
A subsequent multipart request handled by the same worker can cause PHP to treat attacker-reclaimed memory as a session ID and return it in the PHPSESSID cookie, disclosing worker memory.
Attacker-reclaimed memory used by the unserializer can cause memory corruption; combined with the memory leak, this was demonstrated to enable unauthenticated remote code execution on WordPress, Drupal, and Joomla.
A later diagnostic event on a worker with stale fatal-error backtrace state can access freed memory and may lead to memory corruption and remote code execution.
A separate OPcache flaw involves an allocation failure leaving process-local and shared trackers out of sync. According to Wiz, another worker can then reuse a memory slot as the wrong pointer type, corrupting shared OPcache state and enabling remote code execution; the article says the precise sequence was not disclosed.
Defensive Notes: Inventory all PHP installations, including bundled software, appliances, and internal tools, and patch internet-facing systems first.
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate. The article says PHP 8.1 and older have no official patched release.
Look for unusual or malformed multipart upload requests followed by memory-limit errors or bursts of HTTP 500 responses.
Inspect responses for oversized or malformed PHPSESSID cookies, which the article identifies as a possible sign of worker-memory disclosure.
Treat a PHP worker spawning a child process while parsing an upload, before application code runs, as a high-confidence signal to investigate.
Rotate credentials, tokens, and API keys resident in memory on exposed servers that may have been vulnerable before patching.