Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 exploited in wild

1. Executive summary

Two critical remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, were patched on 2026-10-21 in an emergency release after details leaked ahead of a coordinated disclosure embargo. Both are rated CVSS v4.0 9.2 by the PHP security team, and both are unauthenticated: a single request can trigger execution before application code runs. No CVE in this item has a NVD record, EPSS score or CISA KEV entry, so the exploitation state rests on vendor reporting rather than a government catalogue. Cloudflare reported early attacks on 2026-10-21 and watchTowr says it reproduced CVE-2026-109618, but no actor has been named and no attribution is possible. For EMEA financial services the exposure is any internet-facing PHP estate, including WordPress, Drupal, Joomla, Laravel and Magento front ends, shared hosting and forgotten embedded installs that will not be patched.

2. Regulatory framing

3. Technical analysis & attack chain

The two flaws are distinct memory-safety failures in PHP's error handling, both reachable without authentication. CVE-2026-109618 is an out-of-memory handling defect: when an OOM condition triggers longjmp(), control flow leaves request memory only partially initialized, and request cleanup later treats the invalid data as valid. An attacker who can force an OOM condition can use it as a reliable trigger for code execution. CVE-2026-109619 is a stale global state defect: longjmp() fatal error handling leaves global memory pointing at freed regions, and a later request handled by the same worker can read or branch on that stale state before normal initialization resets it. One report describes CVE-2026-109618 as a use-after-free; the PHP security team had not published a root cause at the time of the source reporting, so treat the precise memory-corruption classification as provisional.

Confirmed steps, as far as public reporting supports them:

1. The attacker sends a request to a PHP endpoint. No credentials are required. The demonstration video references PHP 5.4.0 and later, and CERT-EU states all PHP versions from 5 onwards may be affected.
2. For CVE-2026-109618, the request drives PHP into an out-of-memory condition, which invokes longjmp() and leaves request memory uninitialized.
3. For CVE-2026-109619, the fatal error path leaves global state pointing at freed memory; a subsequent request on the same worker uses that stale state.
4. Execution occurs in the PHP worker context before application code runs. Huntress expects this to appear as abnormal child processes spawned by php-fpm, php-cgi, php-cgi.exe, httpd or apache2.

Affected deployments named in reporting are PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Help Net Security states mod_php setups face the greatest danger. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are end-of-life with no upstream fix; the PHP security team released minimal source backports for 7.4, 8.0 and 8.1 for organisations that build from source or lack an LTS vendor. Linux distributions and LTS vendors received patches ahead of public release. The rpms.remirepo.net volunteer repository will not have updates on release day, and its users are advised to switch to distribution packages or build from source.

Exposure estimates vary by telemetry and should be read as order-of-magnitude. Palo Alto Networks Cortex Xpanse reports over 22.6 million exposed instances. Silas Cutler's rough estimate is over 1.3 million internet-exposed hosts, and a Shodan search by Henk Poley counts over 1.9 million. W3Techs puts PHP at 69.3% of websites whose server-side language is known.

Interim mitigations reported before the patch: setting session.upload_progress.enabled = Off gives partial mitigation (it is On by default), per SANS ISC. Cloudflare deployed WAF rules for known exploit vectors to all customers including free tier, described by its CTO as a stopgap only. Palo Alto Networks Advanced Threat Prevention Plus carries Frontier Virtual Patching from 2026-10-20 under Threat Prevention signature 543004.

Confidence caveats. Exploitation is single-sourced to Cloudflare's public statement that it is "seeing early attacks emerging"; watchTowr told BleepingComputer it believes it reproduced CVE-2026-109618. Huntress and watchTowr both said they had not seen in-the-wild exploitation at the time of their reporting, and The Hacker News reported no exploitation. The claims are not contradictory (they are time-stamped differently) but neither is corroborated by a second independent exploitation report. Sansec's prediction that mass exploitation would start within 15 minutes of patch release is a forecast, not an observation. No threat actor, tooling or post-exploitation payload has been identified in any source, so no attribution is made. CVSS is inconsistent across reporting: the PHP security team and Unit 42 give 9.2, SANS ISC cites 9.4, and watchTowr and a Hacker News post were reported as 10.0. The 9.2 figure is the one the PHP project published.

4. Mitigation & containment

P1 within 24 hours

• Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This is the only complete fix. Confirm the running version with php -v and, for FPM, the pool configuration in use.
• Where patching cannot happen immediately, take the system offline. The UK NCSC is explicitly advising organisations to consider taking offline any system that cannot be fixed right away, and at least one European government has already taken a website offline as a precaution.
• Set session.upload_progress.enabled = Off in php.ini as a partial mitigation on any host still unpatched. Treat it as a stopgap, not a fix.
• Enable Cloudflare WAF rules for PHP sites behind Cloudflare, or the Palo Alto Threat Prevention signature 543004 where that subscription is in place.
• Hunt for child processes spawned by php-fpm, php-cgi, php-cgi.exe, httpd or apache2 that launch sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, nc or certutil.exe, and for command lines containing /dev/tcp/ or fsock.

P2 within 72 hours

• Inventory every PHP runtime, including embedded installs inside CMS platforms, control panels and appliances that do not advertise PHP. Huntress notes a large amount of software runs PHP without saying so.
• For PHP 8.1 and earlier, either upgrade to a supported branch or apply the PHP project's source backports for 7.4, 8.0 and 8.1. Contact your distribution or LTS vendor for backported packages.
• Migrate off rpms.remirepo.net to distribution packages or a source build.
• Ask hosting providers and managed service providers to confirm their PHP versions in writing. Shared hosting is where the long tail sits.

P3 within 7 days

• Review web server and FPM logs for anomalous request patterns around OOM conditions and for repeated requests to the same worker that could exercise the stale-state path in CVE-2026-109619.
• Add the Sigma rule in §6 to detection pipelines and backfill against logs from 2026-10-20 onward.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The sources describe observable behaviours only.

Behavioural indicators

6. Detection

The sources give no file artefacts, so no YARA rule is emitted. The behavioural indicators support a Sigma rule for process creation.

title: PHP Worker Spawning Shell or Network Utility
id: 7f3c2a91-4b6e-4d18-9a2c-php2shell0001
status: experimental
description: Detects a PHP worker process spawning a shell, interpreter or network utility, consistent with php2shell exploitation (CVE-2026-109618, CVE-2026-109619)
author: Adverse Trace
date: 2026/10/21
references:

  - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
  - https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:

      - '/php-fpm'
      - '/php-cgi'
      - '/php-cgi.exe'
      - '/httpd'
      - '/apache2'
  selection_child:
    Image|endswith:

      - '/sh'
      - '/bash'
      - '/cmd.exe'
      - '/powershell.exe'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/certutil.exe'
  selection_cmdline:
    CommandLine|contains:

      - '/dev/tcp/'
      - 'fsock'
  condition: selection_parent and (selection_child or selection_cmdline)
falsepositives:

  - Legitimate maintenance scripts or cron jobs executed via PHP CLI (exclude php-cli parent where appropriate)
level: high

7. Sources

• Unit 42 (Palo Alto Networks), "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619", https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/, 2026-10-21
• Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched, update now!", https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/, 2026-10-21
• Tenable Research, "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities", https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote, 2026-10-21
• Huntress, "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)", https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities, 2026-10-21
• The Hacker News, "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert", https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html, 2026-10-21
• SecurityWeek, "PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws", https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/, 2026-10-21
• SANS Internet Storm Center, "Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]", https://isc.sans.edu/diary/rss/33440, 2026-10-21

8. Adverse Trace position

Adverse Trace assesses both CVEs as critical (CVSS v4.0 9.2, PHP security team rating) with no NVD record, no EPSS score and no CISA KEV entry available at the time of writing, so the exploitation state rests on Cloudflare's single-sourced report of early attacks and watchTowr's reproduction of CVE-2026-109618. No actor is named in any source and we make no attribution. Client impact is high for any firm with internet-facing PHP, particularly mod_php deployments and unmaintained embedded installs, and the patch window is measured in hours given the public proof of concept. We will monitor for the PHP advisory, for the first corroborated exploitation report, and for any CISA KEV addition, and will reissue this advisory if attribution or atomic indicators emerge. Clients should confirm their patched PHP versions to us within 24 hours so we can track exposure across the estate.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.