{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-2206A36E",
  "slug": "cve-2026-109618-php2shell-php-rce-emergency-update",
  "title": "PHP2Shell: crafted HTTP requests run code on PHP web servers without a login (CVE-2026-109618, CVE-2026-109619)",
  "aliases": [
    "CVE-2026-109618",
    "CVE-2026-109619",
    "PHP2Shell",
    "GHSA-w8hw-w9fx-j79w",
    "GHSA-6wmf-4rv5-p3rp",
    "PHP RCE via OOM corruption",
    "PHP RCE via stale global state"
  ],
  "summary": "Two critical bugs in the PHP interpreter (CVSS v4.0 9.2 each) allow unauthenticated remote code execution as the web worker. CVE-2026-109618: PHP's longjmp()-based out-of-memory bailout can leave partially initialized request memory that request shutdown later consumes; multipart parsing (unbounded per-part headers, empty file controls, nested field names) lets a request stay under post_max_size yet exhaust memory_limit, and under Apache mod_php this happens before any application code runs. CVE-2026-109619: request-owned global state (error, session, object, extension state) can survive a fatal error into the next request on the same worker and be consumed before normal initialization, a use-after-free; confirmed producers are PHP 8.5 fatal_error_backtraces and session upload progress. Details leaked on 2026-10-20; PHP shipped fixes 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting partners reported exploitation attempts to Patchstack and Cloudflare reported early attacks.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Exploitation status is from Patchstack hosting partners and Cloudflare; Patchstack's latest pre-release update said its own telemetry showed probing only. Apache mod_php is the confirmed application-independent target; PHP-FPM is susceptible per source analysis for CVE-2026-109618 without a demonstrated complete exploit, while the CVE-2026-109619 session path was validated on FPM. FrankenPHP and LSAPI exposure is inferred, not demonstrated.",
  "firstObservedAt": "2026-10-21T07:34:00Z",
  "lastObservedAt": "2026-10-21T07:43:00Z",
  "publishedAt": "2026-10-21T15:55:41.210Z",
  "reviewedAt": "2026-10-21T13:54:32.722Z",
  "expiresAt": "2026-10-21T07:43:00Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ghsa-618",
      "label": "PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): RCE via OOM corruption",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-21T13:34:25Z"
    },
    {
      "id": "ghsa-619",
      "label": "PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): RCE via stale global state",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-21T13:34:13Z"
    },
    {
      "id": "php-announce",
      "label": "php.net news archive 2026: Upcoming Critical PHP Security Release",
      "url": "https://www.php.net/archive/2026.php",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-20T19:33:47Z"
    },
    {
      "id": "patchstack",
      "label": "Patchstack: PHP vulnerable to critical RCE, attacks ongoing",
      "url": "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/",
      "sourceType": "research",
      "observedAt": "2026-10-21T00:00:00Z"
    },
    {
      "id": "certeu",
      "label": "CERT-EU advisory 2026-018: Critical Vulnerabilities in PHP",
      "url": "https://cert.europa.eu/publications/security-advisories/2026-018",
      "sourceType": "government",
      "observedAt": "2026-10-20T20:33:27Z"
    }
  ],
  "artifacts": [
    {
      "id": "php-src",
      "artifactClass": "package",
      "ecosystem": "php",
      "name": "php-src",
      "version": "<8.2.35 || >=8.3.0 <8.3.36 || >=8.4.0 <8.4.27 || >=8.5.0 <8.5.12",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "announce",
      "occurredAt": "2026-10-20T19:33:47Z",
      "eventType": "disclosure",
      "summary": "PHP security team pre-announces an emergency release for two critical vulnerabilities, scheduled 2026-10-21 14:00 UTC.",
      "sourceIds": [
        "php-announce"
      ]
    },
    {
      "id": "certeu",
      "occurredAt": "2026-10-20T20:33:27Z",
      "eventType": "other",
      "summary": "CERT-EU advises preparing for immediate patching or isolating internet-facing PHP applications.",
      "sourceIds": [
        "certeu"
      ]
    },
    {
      "id": "itw-reports",
      "occurredAt": "2026-10-21T07:34:00Z",
      "eventType": "first_observed",
      "summary": "Patchstack receives multiple reports of active exploitation incidents from hosting partners; Cloudflare reports early attacks at 07:43 UTC.",
      "sourceIds": [
        "patchstack"
      ]
    },
    {
      "id": "fix",
      "occurredAt": "2026-10-21T13:34:25Z",
      "eventType": "vendor_action",
      "summary": "PHP publishes GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.",
      "sourceIds": [
        "ghsa-618",
        "ghsa-619"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Hosts on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distribution build listing both CVEs fixed) are not affected",
    "PHP CLI scripts and workers that do not handle HTTP requests are not reachable by the documented request paths",
    "PHP 8.1 and older are affected and receive no upstream fix; only distribution backports",
    "Configuration mitigations do not fully close either bug; PHP states updating is the only complete mitigation",
    "Patching does not remove a web shell planted before the update"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-109618-php2shell-php-rce-emergency-update/corrections"
}