PHP2Shell Flaws Enable Unauthenticated Code Execution on PHP Servers
Summary
Arctic Wolf details two PHP2Shell flaws that allow unauthenticated code execution, their root causes and patched versions. The company reports scanning and malicious exploitation attempts, including requests to retrieve ELF and Go binaries.
Key points
- CVE-2026-109618 and CVE-2026-109619 are both rated 9.2 on CVSS 4.0; the article says either flaw can let an unauthenticated attacker run code on a vulnerable server.
- The flaws involve invalid request cleanup after an out-of-memory condition and stale request state; session upload progress is one confirmed path for CVE-2026-109619.
- PHP released fixes for branches 8.2 through 8.5. PHP 8.1 and older are end-of-life and require an upgrade or vendor-provided fixes.
- The article recommends inventorying PHP deployments, including bundled runtimes and containers, and updating affected systems, restarting services, and rebuilding container images.
- Configuration changes may reduce exposure to specific paths but are not a complete fix; the article says a patched runtime or vendor package with both fixes is required.
- Arctic Wolf reports scanning and malicious exploitation attempts, including requests to retrieve ELF and Go binaries associated with commodity malware.
Article Details
- Vulnerability Types
- Out-of-memory handling flaw
- Stale state flaw
- Severity
- Critical; both vulnerabilities are rated 9.2 on CVSS 4.0.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-109618, set memory_limit=-1 in a configuration applications cannot override; set a low post_max_size and keep upload_max_filesize below it; enforce request-size, field-count, and header limits at the web server or proxy.
- For CVE-2026-109619, disable session.upload_progress.enabled before request parsing and restart every worker; on PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
- The article says these measures reduce exposure to specific attack paths but do not make an installation safe; a patched runtime or vendor package that backports both fixes is the complete solution.
MITRE ATT&CK
T1105 · Ingress Tool TransferArctic Wolf Labs reports malicious exploitation attempts involving wget requests to retrieve ELF and Golang binaries.T1190 · Exploit Public-Facing ApplicationAn unauthenticated request can exploit either PHP2Shell flaw to run code on a vulnerable server.T1505.003 · Web ShellThe article identifies webshell deployment as an attacker behavior the Aurora Agentic SOC monitors after exploitation.
CVE
Products
Aurora Agentic SOCIf attackers exploit PHP2Shell, Aurora Agentic SOC is designed to detect the activity that follows, including webshell deployment, unauthorized command execution, persistence attempts, and lateral movement, enablingAurora Superintelligence PlatformHow the Aurora Superintelligence Platform keeps customers protectedAurora Vulnerability ManagementAurora Vulnerability Management identifies and prioritizes affected assets using live exploit activity and threat intelligence, helping security teams focus remediation efforts where risk is highest.PHPOn Tuesday, October 20, threat actors gained advance visibility into two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers.