cyber.hendryadrian.com
Threat Research · crowdstrike.com

CrowdStrike Details PHP2Shell Flaws and Barriers to Reliable Exploitation

· Original article ↗

Summary

CrowdStrike describes three flaws behind PHP2Shell, explains why reliable exploitation may require targeting specific PHP deployments, and says it has seen no successful exploitation in the wild. It recommends patching and hardening PHP environments.

Key points

  • CVE-2026-109618 and CVE-2026-109619 affect PHP versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12; older versions may also be affected.
  • CrowdStrike maps CVE-2026-109618 to a partial HashTable insertion flaw and CVE-2026-109619 to serialization-context and session-global use-after-free flaws.
  • The flaws can potentially enable RCE; depending on the flaw and configuration, they may also cause memory disclosure, worker crashes or service unavailability.
  • CrowdStrike says it reproduced a proof-of-concept achieving RCE, but has not observed successful exploitation in the wild or its honeypots, or identified a fully weaponized exploit.
  • Reliable exploitation is likely to require adaptation to a specific deployment, such as a known PHP version, SAPI, application and container image.
  • Recommendations include promptly patching PHP, rebuilding containers and restarting workers, disabling unused upload features, limiting request bodies and running applications with minimal privileges.

Article Details

Attack Vectors
  • CVE-2026-109618: A memory-allocation failure during HTTP request-variable parsing can leave a partially initialized HashTable entry that PHP later processes during request shutdown, potentially enabling memory corruption or code execution.
  • CVE-2026-109619: A fatal error interrupting serialize() or unserialize() can leave a stale serialization-context pointer in a persistent PHP worker; a later request handled by that worker may access or modify freed memory.
  • CVE-2026-109619: A fatal error during multipart upload processing can interrupt session upload-progress cleanup, leaving stale pointers in a persistent PHP worker for a subsequent request.
Defensive Notes
  • Patch PHP applications to the latest version, prioritizing internet-facing applications.
  • Rebuild container images and restart Apache and PHP-FPM workers after patch deployment to clear stale process state.
  • Disable session upload progress with session.upload_progress.enabled = Off unless required; this does not mitigate the HashTable vulnerability.
  • Disable file uploads with file_uploads = Off where they are unnecessary.
  • Limit request-body and upload size and duration, parameter-name length, nesting depth, and form-field count; reject unusually large URL-encoded keys and malformed or abnormal multipart requests.
  • Run each PHP application under a separate, minimally privileged account and prevent PHP workers from modifying application code or accessing unrelated secrets.

CVE

CVE-2026-109618On October 21, 2026, PHP disclosed two critical severity vulnerabilities (now tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell) affecting multiple PHP versions.CVE-2026-109619On October 21, 2026, PHP disclosed two critical severity vulnerabilities (now tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell) affecting multiple PHP versions.

Products

ApacheWith mod_php, PHP is loaded directly into Apache as a module, and PHP code executes within Apache worker processes.NGINXA web server such as Apache or Nginx forwards requests to these workers using the FastCGI protocol, typically through a Unix socket or a TCP connection.PHPOn October 21, 2026, PHP disclosed two critical severity vulnerabilities (now tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell) affecting multiple PHP versions.PHP-FPMOperations reproduced a POC exploit achieving RCE with the privileges of the running mod_php or the PHP-FPM worker processes, both of which should be unprivileged in most cases, as dictated by the least privilegesWordPressseverity and the fact that PHP powers approximately 70% of all websites on the internet,1 including WordPress, these vulnerabilities have received widespread media and industry attention prior to and immediately

Related Articles