Critical PHP core flaws CVE-2026-109618/19 hit all versions with early PoCs

1. Executive summary

Two critical remote code execution flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, were patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both are rated CVSSv4.0 9.2 by the PHP security team; no NVD record, EPSS score or CISA KEV entry exists for either CVE at the time of writing, so exploitation is not yet confirmed by those authorities. Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and PHP 5.x through 8.1.x are end-of-life with no vendor fix. Cloudflare reports early attacks and has deployed WAF rules, watchTowr says it reproduced CVE-2026-109618, and Sansec expects mass exploitation within 15 minutes of patch release. EMEA financial services firms running customer-facing PHP applications, shared hosting, or embedded PHP in appliances face unauthenticated remote code execution before application code runs; the exposure is highest for mod_php deployments and for estates with forgotten or unmaintained PHP.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17	A critical unauthenticated RCE in PHP core affects every PHP installation serving web requests, with early attacks reported by Cloudflare and mass exploitation expected within 15 minutes of patch release.	The ICT-related incident management process must cover this class of event: detection of exploitation attempts, containment of affected web servers, and a defined patch-and-verify procedure for the PHP estate.
DORA Art. 19	Cloudflare reports early attacks and Sansec expects mass exploitation; where exploitation succeeds on a production system, a major ICT-related incident may result.	If exploitation is confirmed on a regulated entity's system, the major incident reporting timeline to competent authorities applies; the clock starts at detection, not at patch availability.
NIS2 Art. 21(2)(d)	PHP is embedded in third-party applications, hosting platforms and appliances that the entity does not patch directly, and PHP 5.x through 8.1.x have no vendor fix.	Supply chain security measures must extend to asking hosting providers, software vendors and appliance manufacturers when they will ship the fixed PHP versions, and what compensating controls apply where they will not.

3. Technical analysis & attack chain

The two flaws are distinct mechanisms in the PHP core, both leading to remote code execution without authentication. CVE-2026-109618 is an out-of-memory handling flaw: OOM can interrupt PHP while internal request data is only partially initialized, and request cleanup then treats the invalid data as valid. CVE-2026-109619 is a stale global state flaw: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it. Public reporting also describes CVE-2026-109618 as a use-after-free, which is consistent with the OOM corruption description rather than a competing classification.

Confirmed attack chain, from the sources:

The attacker sends an HTTP POST request with a multipart/form-data body to a PHP endpoint. No authentication is required.
The request carries a PHP session upload progress field and an oversized multipart filename (the published PoC uses a filename of roughly 5 MB).
The malformed request triggers the core memory handling flaw, either the OOM corruption path (CVE-2026-109618) or the stale worker state path (CVE-2026-109619).
PHP executes attacker-controlled code in the context of the web server worker process, before application code runs.

The published PoC is unreliable and incomplete. It sends Content-Type: multipart/form-data; boundary=SctxPoc2026, a PHP_SESSION_UPLOAD_PROGRESS field, and a filename="f0-NNNNNNNNN...NNNNNNNNNNNN" value of about 5 MB, with Content-Length: 5244717. The PoC is useful for building detection signatures, not for confirming exploitability of a given host.

Affected and fixed versions, per Kevin Beaumont's reporting cited by Tenable: PHP 8.5.x fixed in 8.5.12, 8.4.x in 8.4.27, 8.3.x in 8.3.36, 8.2.x in 8.2.35. PHP 5.x through 8.1.x are end-of-life with no vendor fix; the PHP team has released minimal source backports for 7.4, 8.0 and 8.1 for organisations that build from source or lack an LTS vendor. Linux distributions and LTS vendors received patches ahead of the public release. The rpms.remirepo.net volunteer repository will not have updates on release day; users of that repository are advised to switch to distribution packages or build from source.

Exposure is large. W3Techs puts PHP at 69.3% of websites whose server-side language is known. Silas Cutler estimates over 1.3 million internet-exposed hosts are potentially vulnerable; a Shodan search by Henk Poley counts over 1.9 million. WordPress, Drupal, Joomla, Laravel and Magento all run on PHP, and Huntress notes PHP is embedded in control panels, shared hosting and software that does not advertise its PHP dependency.

Exploitation status is mixed and should be read carefully. Cloudflare CTO Dane Knecht said on 21 October the company is "seeing early attacks emerging" and is updating mitigations as new vectors appear; Cloudflare has WAF rules deployed for known exploit vectors, available to all customers including free. watchTowr says it reproduced CVE-2026-109618. Huntress and watchTowr say they have not seen either vulnerability exploited in the wild. Sansec expects mass exploitation to start within 15 minutes of patch release. These are single-source claims from named vendors; none is corroborated by NVD, EPSS or CISA KEV, and the Cloudflare "early attacks" statement does not specify targets, volumes or success.

The UK NCSC is urging organisations to patch PHP systems immediately and to consider taking offline any system that cannot be fixed right away. ANSSI/CERT-FR recommends isolating affected equipment on unsupported versions and migrating to a maintained version once the vendor patch is published.

4. Mitigation & containment

P1 within 24 hours:

Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On distribution packages, apply the vendor update as soon as it is published; do not wait for php.net source builds. Verify the running version with php -v and php-fpm -v after restart.
For PHP-FPM deployments, set php_admin_flag[session.upload_progress.enabled] = off in the pool configuration and session.upload_progress.enabled = Off in php.ini. This disables the upload-progress feature and, per CERT-FR, reduces attack surface against only one of the two vulnerabilities.
Where patching cannot be completed, block HTTP requests with Content-Type: multipart/form-data at the WAF or reverse proxy. This breaks file uploads; where blocking is not possible, apply a monitoring policy to those requests.
Enable Cloudflare WAF rules if the site is behind Cloudflare; they cover known exploit vectors and are available on the free tier.
For PHP 5.x through 8.1.x with no vendor fix, isolate the host from untrusted networks or take it offline, then migrate to a supported branch. CERT-FR recommends isolation followed by migration.
Identify every PHP runtime: web servers, containers, CI images, dev machines, control panels, appliances and shared hosting. On managed or shared hosting, ask the provider when they will deploy the fixed version.

P2 within 72 hours:

Hunt for child processes spawned by php-fpm, php-cgi, php-cgi.exe, httpd or apache2 that are shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) or download tools (curl, wget, nc, certutil.exe). Command lines containing /dev/tcp/ or fsock warrant review.
Review web server logs for POST requests with multipart bodies and filenames of unusual length, and for PHP_SESSION_UPLOAD_PROGRESS fields on endpoints that do not legitimately accept uploads.
Set expose_php=Off, review the PHP session cookie name, and avoid .php extensions where the application permits. These are obscurity measures only; they do not substitute for the patch.

P3 within 7 days:

Replace rpms.remirepo.net with distribution packages or a source build so future PHP security updates can be applied on release day.
Add PHP version inventory to the asset register and set an alert for end-of-life branches.
For WordPress, confirm the PHP version under Tools → Site Health → Info → Server.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the sources. The published PoC request is a behavioural artefact, not a reliable atomic indicator, and the sources give no confirmed in-the-wild IOC set.

Behavioural indicators

behaviour	where to observe	confidence
POST request with `Content-Type: multipart/form-data` and a filename of several megabytes	web server access logs, WAF logs, reverse proxy logs	medium (from published PoC; PoC is unreliable)
POST body containing `PHP_SESSION_UPLOAD_PROGRESS` on endpoints that do not accept uploads	WAF logs, application logs	medium
Multipart boundary `SctxPoc2026`	WAF logs, packet capture	low (specific to the published PoC, not to working exploits)
PHP worker process (`php-fpm`, `php-cgi`, `httpd`, `apache2`) spawning `sh`, `bash`, `cmd.exe`, `powershell.exe`, `python`, `perl`, `curl`, `wget`, `nc` or `certutil.exe`	EDR, process accounting, auditd	medium (Huntress expectation, not observed exploitation)
Command lines containing `/dev/tcp/` or `fsock`	EDR, process accounting	medium

6. Detection

The sources give distinctive request artefacts (multipart boundary, upload-progress field name, oversized filename pattern) but no file-level strings, so a YARA rule on files is not supported. A Sigma rule on web server and process telemetry is.

title: PHP2Shell exploitation attempt via multipart upload progress
id: 8f3c2a71-4b6e-4d2a-9c1f-7e5a0b3d9c42
status: experimental
description: Detects HTTP POST requests matching the published PHP2Shell PoC pattern (multipart body, PHP_SESSION_UPLOAD_PROGRESS field, oversized filename) and PHP worker processes spawning shells or download tools.
author: Adverse Trace
date: 2026-10-21
references:

  - https://isc.sans.edu/diary/rss/33440
  - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: POST
  selection_ctype:
    cs-content-type|contains: 'multipart/form-data'
  selection_progress:
    cs-uri-query|contains: 'PHP_SESSION_UPLOAD_PROGRESS'
  selection_boundary:
    cs-content-type|contains: 'SctxPoc2026'
  condition: selection_method and selection_ctype and (selection_progress or selection_boundary)
fields:

  - c-ip
  - cs-uri-stem
  - cs-content-type
  - sc-status
falsepositives:

  - Legitimate file upload endpoints that use PHP session upload progress
level: high
---
title: PHP worker spawning shell or download tool
id: 2d9b7e14-6a3f-4c8e-b5d1-0f4a7c2e8b91
status: experimental
description: Detects PHP worker processes spawning shells, interpreters or download tools, consistent with post-exploitation of CVE-2026-109618 or CVE-2026-109619.
author: Adverse Trace
date: 2026-10-21
references:

  - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:

      - '/php-fpm'
      - '/php-cgi'
      - '/httpd'
      - '/apache2'
      - '\php-cgi.exe'
  selection_child:
    Image|endswith:

      - '/sh'
      - '/bash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\certutil.exe'
  selection_cmdline:
    CommandLine|contains:

      - '/dev/tcp/'
      - 'fsock'
  condition: selection_parent and (selection_child or selection_cmdline)
falsepositives:

  - Legitimate application code that shells out to these binaries
level: high

7. Sources

Johannes B. Ullrich, SANS Internet Storm Center, "Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]", 2026-10-21. https://isc.sans.edu/diary/rss/33440
Help Net Security, "A critical PHP security release is coming today, so get ready to update!", 2026-10-21. https://www.helpnetsecurity.com/2026/10/21/php-security-release-announcement-october-2026/
Tenable Research, "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities", 2026-10-21. https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!", 2026-10-21. https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
SecurityWeek, "PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws", 2026-10-21. https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/
Huntress, "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)", 2026-10-21. https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
ANSSI/CERT-FR, "Multiples vulnérabilités dans PHP", CERTFR-2026-ALE-014, 2026-10-21. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-014/
PHP.net, security release notice, 2026-10-20. https://www.php.net/archive/2026.php#2026-10-20-1
CERT-EU advisory 2026-018. https://cert.europa.eu/publications/security-advisories/2026-018/
jackalsyn, PoC write-up. https://jackalsyn.com/posts/php-up-2026.html
Cloudflare CTO Dane Knecht, statement via X. https://x.com/IntCyberDigest/status/2112845843938054610/photo/1

8. Adverse Trace position

Adverse Trace assesses both CVEs as critical (CVSSv4.0 9.2 per the PHP security team) with unauthenticated remote code execution reachable over a plain HTTP request, and treats the absence of NVD, EPSS and CISA KEV records as a timing artefact of same-day disclosure, not as evidence of low risk. The exploitation picture is single-sourced and should be read that way: Cloudflare's "early attacks" statement, watchTowr's reproduction and Sansec's 15-minute mass-exploitation forecast each come from one vendor and none is corroborated by an independent authority; clients should verify before treating any specific host as compromised. Client impact is highest for internet-facing mod_php deployments, shared hosting and estates with unmaintained PHP 5.x through 8.1.x, where no vendor fix exists and isolation or migration is the only option. We will track NVD publication, EPSS scoring and any CISA KEV addition for both CVEs, monitor for confirmed in-the-wild IOC sets from CERT-EU, Cloudflare and national CERTs, and reissue this advisory if a working exploit or confirmed compromise changes the assessment. Clients running PHP behind Cloudflare should confirm WAF rules are active now; clients on rpms.remirepo.net should plan migration off that repository this week.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.