PHP2Shell Flaws Enable Unauthenticated RCE; Exploitation Attempts Preceded Patches
Summary
PHP2Shell comprises two critical PHP core CVEs enabling unauthenticated remote code execution and memory disclosure. Attempts were reported before the fixes shipped; Sysdig details affected versions, detection, and mitigation.
Key points
- CVE-2026-109618 and CVE-2026-109619 cover four related memory-safety bugs; each CVE has a CVSS v4.0 score of 9.2.
- The flaws involve stale pointers after a fatal out-of-memory error, enabling use-after-free issues, memory disclosure, and remote code execution.
- Amazon Threat Intelligence reported an attempt against its MadPot honeypots on October 17; Cloudflare reported attacks more than six hours before the October 21 fixes shipped.
- The bugs affect PHP versions 5.4 through 8.5 and web-serving SAPIs; the article says vulnerable default configurations require no special settings to be exposed.
- Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For older or unsupported branches, use vendor-patched packages or move to a supported branch.
- Sysdig says its runtime rules were validated against a working exploit; Falco can detect resulting host activity but cannot see the malicious HTTP request itself.
- Sysdig recommends patching and restarting PHP workers, using interim settings only to reduce risk, reviewing activity dating back to October 17, and rotating secrets on exposed servers.
Article Details
- Vulnerability Types
- Use-after-free
- Type confusion
- Memory disclosure
- Unauthenticated remote code execution
- Severity
- CVSS v4.0: 9.2 for both vulnerabilities
- Affected Versions
- PHP 5.4–7.3
- PHP 7.4
- PHP 8.0
- PHP 8.1
- PHP 8.2 before 8.2.35
- PHP 8.3 before 8.3.36
- PHP 8.4 before 8.4.27
- PHP 8.5 before 8.5.12
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Set memory_limit=-1 through php_admin_value and enforce request-size limits at the web server or proxy; the article says this reduces risk but does not remove it.
- Set session.upload_progress.enabled=0 in php.ini or the FPM pool configuration; the article says this reduces risk but does not remove it.
- On PHP 8.5, also set fatal_error_backtraces=0.
- Block multipart/form-data at the edge if uploads are not needed; this blocks the session upload-progress path and memory disclosure but does not cover every bug and can break file uploads and some checkout forms.
- Restart PHP workers after applying mitigations and verify settings through a web request.
MITRE ATT&CK
T1059.004 · Unix ShellThe article says successful exploitation can give an attacker a command line and describes shells spawned by web-server processes as post-exploitation activity to detect.T1068 · Exploitation for Privilege EscalationThe article describes a possible path from container code execution to host access through a kernel local privilege-escalation vulnerability.T1105 · Ingress Tool TransferThe article describes downloading and running a tool as a possible action after gaining code execution on the PHP workload.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities allow unauthenticated attackers to exploit a PHP server exposed to HTTP requests.T1496 · Resource HijackingStarting a miner is described as a possible post-exploitation action after PHP2Shell code execution.
CVE
CVE-2026-109618On October 21, 2026, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, were fixed in two emergency releases from the PHP project. The two CVEs group four related memory-safety bugs, and both vulnerabilities have aCVE-2026-109619On October 21, 2026, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, were fixed in two emergency releases from the PHP project. The two CVEs group four related memory-safety bugs, and both vulnerabilities have a
Vendors
Products
PHP2026, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, were fixed in two emergency releases from the PHP project. The two CVEs group four related memory-safety bugs, and both vulnerabilities have a CVSS v4.0Sysdig SecureTo provide additional recommendations for security teams and create runtime detection coverage for Sysdig Secure and open source Falco users, the Sysdig Threat Research Team (TRT) analyzed PHP2Shell exploitation. The