PHP2Shell Remote Code Execution Vulnerabilities

Byadmblake

What is the Vulnerability? The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP’s internal request-processing and memory-management behavior that can be triggered when handling malicious requests. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). • CVE-2026-109618 – RCE via…

What is the Vulnerability?

The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP’s internal request-processing and memory-management behavior that can be triggered when handling malicious requests. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0).

• CVE-2026-109618 – RCE via out-of-memory corruption: An out-of-memory condition can interrupt PHP while internal request data is only partially initialized. Subsequent request-cleanup operations may incorrectly process this invalid data, potentially enabling remote code execution.

• CVE-2026-109619 – RCE via stale global state: Internal request state can persist after its associated memory has been freed. A later request handled by the same worker may access this stale state before normal initialization resets it, potentially enabling remote code execution.

Successful exploitation could compromise the PHP application process and potentially provide access to sensitive server resources, application data, or databases, depending on the permissions of the affected process and the surrounding environment.

PHP announced emergency security updates for October 21, 2026, following reports that details of the vulnerabilities had leaked ahead of the planned disclosure. Subsequent reports highlighted ongoing exploit research and potential attack activity, underscoring the urgency of applying the available patches. However, widespread exploitation of either vulnerability has not been independently confirmed.

What is the recommended Mitigation?

The vulnerabilities affect PHP installations that process web requests, including deployments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP identifies Apache deployments using mod_php as particularly at risk because a demonstrated exploit can trigger before application code runs.

Organizations should prioritize patching internet-facing PHP servers and other exposed deployments immediately.

1. Apply the security updates. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate. Organizations using vendor-maintained packages should apply the corresponding security updates from their distributions or service providers.

2. Reduce exposure until patching is complete. Where immediate remediation is not possible, isolate affected systems from untrusted networks or temporarily disable exposed services when operationally feasible.

3. Review request-processing limits. Apply appropriate web-server or reverse-proxy limits for request sizes, input fields, multipart sections, headers, and nesting depth. These controls can reduce exposure but are not a substitute for patching.

4. Review potentially vulnerable systems. Investigate suspicious web requests, unexpected PHP worker behavior, unexplained process execution, and unusual access to application files or databases. Prioritize internet-facing systems and investigate potential compromise before returning affected services to production.

PHP 8.1 and older are no longer supported by the PHP project and do not receive its standard security updates. Organizations using these versions should check whether their operating-system vendor provides backported fixes or migrate to a supported release.

What FortiGuard Coverage is available?

• FortiGuard Labs recommends a defense-in-depth approach to reduce exposure to attacks targeting vulnerable PHP deployments.

• FortiGuard Labs is monitoring the situation and will provide updates as new information becomes available and additional protections are released.

• FortiCNAPP Vulnerability Management Service: Detects CVE-2026-109618 and CVE-2026-109619 in PHP packages installed from Linux distribution repositories. Ubuntu, Debian, and Alpine Linux 3.24 have published fixes. RHEL and its rebuilds, Amazon Linux, and SUSE have not yet published fixes; accordingly, findings for these distributions may not include a fixed version until the respective vendors release updates.

• FortiGuard Web Application Firewall (FortiWeb): Where applicable, review web application protection policies and request inspection controls to help identify or block malicious HTTP requests. These controls should not be considered a replacement for the PHP security updates.

• FortiGuard Antivirus and Behavior Detection: Use available malware detection and behavioral protections to help identify suspicious payloads or post-exploitation activity associated with a compromised web server.

• FortiGuard Incident Response: If exploitation is suspected, investigate the affected server, identify potential persistence mechanisms, determine whether sensitive data or credentials were accessed, and contain any confirmed compromise.

• For information on Fortinet products affected by this vulnerability, please refer to the Fortinet PSIRT Advisory (FG-IR-26-186).

PSIRT | FortiGuard Labs

Related