{"type":"bundle","id":"bundle--5d34eb8f-cfb6-518e-b992-d46bec0535f6","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--4e03274f-0fd2-535f-9a79-2e5741b1bf1d","created":"2026-10-21T15:55:41.210Z","modified":"2026-10-21T15:55:41.210Z","name":"PHP2Shell: crafted HTTP requests run code on PHP web servers without a login (CVE-2026-109618, CVE-2026-109619)","description":"Two critical bugs in the PHP interpreter (CVSS v4.0 9.2 each) allow unauthenticated remote code execution as the web worker. CVE-2026-109618: PHP's longjmp()-based out-of-memory bailout can leave partially initialized request memory that request shutdown later consumes; multipart parsing (unbounded per-part headers, empty file controls, nested field names) lets a request stay under post_max_size yet exhaust memory_limit, and under Apache mod_php this happens before any application code runs. CVE-2026-109619: request-owned global state (error, session, object, extension state) can survive a fatal error into the next request on the same worker and be consumed before normal initialization, a use-after-free; confirmed producers are PHP 8.5 fatal_error_backtraces and session upload progress. Details leaked on 2026-10-20; PHP shipped fixes 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting partners reported exploitation attempts to Patchstack and Cloudflare reported early attacks.","aliases":["CVE-2026-109618","CVE-2026-109619","PHP2Shell","GHSA-w8hw-w9fx-j79w","GHSA-6wmf-4rv5-p3rp","PHP RCE via OOM corruption","PHP RCE via stale global state"],"first_seen":"2026-10-21T07:34:00Z","last_seen":"2026-10-21T07:43:00Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): RCE via OOM corruption","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"source_name":"PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): RCE via stale global state","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"source_name":"php.net news archive 2026: Upcoming Critical PHP Security Release","url":"https://www.php.net/archive/2026.php"},{"source_name":"Patchstack: PHP vulnerable to critical RCE, attacks ongoing","url":"https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/"},{"source_name":"CERT-EU advisory 2026-018: Critical Vulnerabilities in PHP","url":"https://cert.europa.eu/publications/security-advisories/2026-018"}]}]}