critical severityConfidence highHistorical record

PHP2Shell: crafted HTTP requests run code on PHP web servers without a login (CVE-2026-109618, CVE-2026-109619)

Two critical bugs in the PHP interpreter (CVSS v4.0 9.2 each) allow unauthenticated remote code execution as the web worker. CVE-2026-109618: PHP's longjmp()-based out-of-memory bailout can leave partially initialized request memory that request shutdown later consumes; multipart parsing (unbounded per-part headers, empty file controls, nested field names) lets a request stay under post_max_size yet exhaust memory_limit, and under Apache mod_php this happens before any application code runs. CVE-2026-109619: request-owned global state (error, session, object, extension state) can survive a fatal error into the next request on the same worker and be consumed before normal initialization, a use-after-free; confirmed producers are PHP 8.5 fatal_error_backtraces and session upload progress. Details leaked on 2026-10-20; PHP shipped fixes 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting partners reported exploitation attempts to Patchstack and Cloudflare reported early attacks.

Also tracked as CVE-2026-109618 · CVE-2026-109619 · PHP2Shell · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · PHP RCE via OOM corruption · PHP RCE via stale global state

First observed
Oct 21, 2026
Last observed
Oct 21, 2026
Last reviewed
Oct 21, 2026
Tracking ended
Oct 21, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Exploitation status is from Patchstack hosting partners and Cloudflare; Patchstack's latest pre-release update said its own telemetry showed probing only. Apache mod_php is the confirmed application-independent target; PHP-FPM is susceptible per source analysis for CVE-2026-109618 without a demonstrated complete exploit, while the CVE-2026-109619 session path was validated on FPM. FrankenPHP and LSAPI exposure is inferred, not demonstrated.

  • Hosts on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distribution build listing both CVEs fixed) are not affected
  • PHP CLI scripts and workers that do not handle HTTP requests are not reachable by the documented request paths
  • PHP 8.1 and older are affected and receive no upstream fix; only distribution backports
  • Configuration mitigations do not fully close either bug; PHP states updating is the only complete mitigation
  • Patching does not remove a web shell planted before the update

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    PHP security team pre-announces an emergency release for two critical vulnerabilities, scheduled 2026-10-21 14:00 UTC.

  2. Update

    CERT-EU advises preparing for immediate patching or isolating internet-facing PHP applications.

  3. First observed

    Patchstack receives multiple reports of active exploitation incidents from hosting partners; Cloudflare reports early attacks at 07:43 UTC.

  4. Vendor action

    PHP publishes GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Publication clock: 18.3 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • php-src@<8.2.35 || >=8.3.0 <8.3.36 || >=8.4.0 <8.4.27 || >=8.5.0 <8.5.12phppackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-2206A36E