🛡️ Threat Intelligence Report: PHP2Shell - Critical PHP Core RCE (CVE-2026-109618 & CVE-2026-109619)

Scope: all TI Mindmap HUB reports ingested in the last 3 days (2026-10-19 to 2026-10-22) that cite CVE-2026-109618 and/or CVE-2026-109619. The 13 reports retrieved cite both CVEs.

1. Reports Summary Table

The following table lists all 13 TI Mindmap HUB reports analyzed for this assessment, ordered by ingestion date (newest first).

2. Executive Summary

Overview

On 2026-10-21, the PHP project released out-of-band security updates (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) fixing two critical memory-safety vulnerabilities in the PHP engine: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell (or "php2shell"). Both are rated CVSS v4.0 9.2 (CWE-1419, Incorrect Initialization of Resource) and can enable unauthenticated remote code execution through a single crafted HTTP request, executing as the PHP/web-worker account before application code runs. Application-layer controls (authentication, WAF plug-ins, CMS maintenance mode) therefore cannot prevent exploitation.

The root cause is PHP's longjmp()-based fatal-error and out-of-memory (OOM) handling, which can leave request memory partially initialized (CVE-2026-109618) or leave global state pointing into freed request memory that a later request on the same worker reuses (CVE-2026-109619). Every PHP branch since 5.4.0 is reportedly affected; PHP 8.1 and older are end of life with no upstream fix (minimal source backports were provided for 7.4, 8.0 and 8.1 only). Exposure is enormous: Palo Alto Cortex Xpanse counted 22.6 million potentially exposed instances, and VirusTotal found about 5.1 million PHP-associated IPs, roughly 758,000 of which disclose an end-of-life version.

The disclosure was chaotic. Details of the CVEs leaked on 2026-10-20, a deleted video showing working exploits circulated, and Chainguard published patched images more than six hours before the coordinated release, triggering a public dispute with the PHP Foundation. Wiz demonstrated unauthenticated RCE against WordPress, Drupal and Joomla (Sansec lists 11 applications), and several sources report early attack attempts, although successful in-the-wild compromise is not confirmed and the functionality of public PoCs is disputed. The research was heavily AI-assisted (Wiz, OpenAI, Calif, Chainguard), signalling shrinking patch windows for core-runtime flaws.

Diagram: Attack Overview

 ┌───────────────────────────── DISCLOSURE TIMELINE ─────────────────────────────┐
 │ 2024        Quarkslab/OSTIF audit notices OOM root cause (theoretical)        │
 │ 08-11/15    Calif + OpenAI report unconditional RCE; PHP confirms PoC         │
 │ 10-20 15:00 CVE IDs leak (wrong CVSS 10.0) -> release pulled forward          │
 │ 10-20 20:00 Calif exploit video leaked/deleted -> public PoC development      │
 │ 10-21 02:29 Leaked archive reaches VirusTotal                                 │
 │ 10-21 07:41 Chainguard ships patched images (embargo break)                   │
 │ 10-21 07:43 Cloudflare observes first attack attempts, deploys WAF rules      │
 │ 10-21 ~14:00 PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 released                   │
 └───────────────────────────────────────────────────────────────────────────────┘

        ┌──────────────────────────────────────────────┐
        │  INITIAL ACCESS (T1190) - unauthenticated    │
        │  crafted multipart/form-data / upload-       │
        │  progress request to ANY PHP endpoint        │
        └───────────────────────┬──────────────────────┘
                                ▼
        ┌──────────────────────────────────────────────┐
        │  Force fatal error / OOM during request init │
        │  (longjmp leaves state half-initialized)     │
        └─────────────┬─────────────────────┬──────────┘
                      ▼                     ▼
     ┌────────────────────────────┐  ┌─────────────────────────────────┐
     │ CVE-2026-109618            │  │ CVE-2026-109619                 │
     │ Partially-initialized data │  │ Stale global state -> UAF on    │
     │ used in cleanup; upload-   │  │ next request in same worker     │
     │ progress unserializer UAF  │  │ (fatal-error backtrace UAF,     │
     │ + worker memory disclosure │  │  OPcache type confusion)        │
     └─────────────┬──────────────┘  └───────────────┬─────────────────┘
                   └────────────────┬────────────────┘
                                    ▼
        ┌──────────────────────────────────────────────┐
        │ RCE as web-worker user BEFORE app code runs  │
        └───────────────────────┬──────────────────────┘
        ┌───────────────────────┼───────────────────────┐
        ▼                       ▼                       ▼
 ┌──────────────┐   ┌─────────────────────┐   ┌─────────────────────┐
 │ Shell / curl │   │ Webshell + cron /   │   │ Secrets from memory │
 │ payload pull │   │ systemd / SSH key   │   │ & files (.env, IMDS,│
 │ reverse shell│   │ persistence         │   │ K8s tokens, TLS key)│
 └──────────────┘   └─────────────────────┘   └─────────────────────┘

Vulnerability Profile

Exploitation Status and Cross-Source Discrepancies

Attribution & Threat Actor Profile

Threat actor: none attributed. All 13 reports list zero associated threat actors. Sansec tags the public exploit as the PHP2Shell malware/tool.

Discovery credit: Calif (RCE proof of concept, exploit video), OpenAI (independent report of the root cause on 2026-08-11), Wiz Research (additional attack vectors; used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol), Chainguard (independent rediscovery with a test harness and a frontier AI model), Quarkslab (2024 OSTIF audit, funded by the Sovereign Tech Agency).

Likely adversaries (assessment): Talos warns that state-sponsored operators, ransomware groups and other financially motivated actors routinely weaponize critical RCEs, and compares the potential cascade to Log4Shell. VirusTotal notes about 5,700 PHP hosts with five or more detections, including a NOX Stealer (BOMBAY) panel, indicating criminal infrastructure is itself exposed.

3. Technical Details

3.1 Vulnerability & Exploit Analysis

CVE-2026-109618 - OOM corruption. When memory allocation fails while PHP prepares request data (typically while parsing RFC 1867 multipart/form-data, before module initialization), longjmp() aborts the request and leaves internal data only partially initialized. Request cleanup then treats the invalid data as valid. Datadog reproduced an unauthenticated HTTP POST against PHP 8.5.11 where the cleanup routine executed an attacker-selected command; the request never reached the target application, so even a script returning a static response exposes the path. Huntress reports PHP validated full RCE against mod_php with default input and memory limits on a standard prefork setup.

Memory disclosure primitive (Wiz, Sansec). Session upload-progress processing publishes a session identifier; an induced OOM leaves a dangling pointer. A later multipart request on the same worker makes PHP treat reclaimed memory as a string and URL-encode it into the PHPSESSID response cookie, leaking attacker-sized slices of live worker memory (passwords, tokens, API keys, certificates, other users' data, potentially TLS private keys). session_start() is not required.

CVE-2026-109619 - stale global state. PHP keeps global pointers into request memory; after a fatal error the heap is destroyed without resetting them. The next request handled by the same worker reads or branches on the stale state before normal initialization. Confirmed paths:

• Fatal-error backtrace UAF (PHP 8.5, fatal_error_backtraces): a diagnostic emitted early in the next request dereferences the dangling backtrace reference. Wiz turned this into controlled corruption and unauthenticated RCE against Drupal.
• OPcache type confusion: an allocation failure during persistence advances the per-worker pointer-map frontier but not the shared one, so another worker assigns a different object type to the same slot and corrupts shared OPcache state. Used in a WordPress RCE chain.
• Upload-progress unserializer UAF (stale unserialization state), chained with memory disclosure to defeat ASLR.

Exploit reliability. Datadog notes the exploit does not rely on crashes or brute force: a calibrated memory layout and a few preparatory requests bypass ASLR, and a successful exploit may not crash the worker, so crash-based monitoring is unreliable. Wiz believes more variants exist because the problem is rooted in PHP's fatal-error cleanup architecture; the upstream fix (commit 31c0ea7d7ff1d1fccb6492e52dab544011628065) addresses the root cause and known variants.

Applications demonstrated (Sansec, Securelist, Wiz). Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1, WHMCS, phpBB. These are examples; any PHP endpoint is a viable trigger.

3.2 Techniques & Attack Phases

1. Reconnaissance (T1595, T1592, T1046). Fingerprint PHP through X-Powered-By, PHPSESSID, framework headers and apps (only ~1.1M of 3.8M PHP IPs disclose a version, so banner-only hunting underestimates exposure). SSH banners, LiteSpeed/PHP 8.2.34 profiles and origin IPs behind WAFs help target selection.
2. Preparation. Send preparatory multipart requests to shape worker heap layout and, for CVE-2026-109618, leak worker memory through the PHPSESSID cookie to defeat ASLR.
3. Exploitation (T1190). Trigger an allocation failure/fatal error (for example by exceeding memory_limit), then route the follow-up request to the same persistent worker to reclaim freed memory and hijack control flow. Apache mod_php is the highest-risk configuration; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed/lsphp are also affected.
4. Execution (T1059). Commands run as the web worker (www-data, apache, nginx, lsphp). Elastic expects validation via id, whoami, hostname, uname -a, then sudo -l, SUID and getcap -r / enumeration.
5. Payload staging (T1105, T1140). curl/wget downloads, curl ... | bash, base64 -d, openssl enc -d, xxd -r; interpreters (Python, Perl, Ruby, Node.js, PHP CLI) allow shell-less execution.
6. Persistence (T1505.003, T1053.003, T1098.004, T1136). PHP webshells (.php, .phtml, image polyglots, avatar.php.jpg), cron jobs, systemd units, SSH authorized_keys, new accounts.
7. Credential access and exfiltration (T1552, T1003, T1041). Memory disclosure of secrets; reads of .env, ~/.aws/credentials, /etc/shadow, Kubernetes service-account tokens and the IMDS endpoint 169.254.169.254.
8. Command and control (T1095 / T1071). Reverse shells via /dev/tcp, nc, socat, mkfifo, pty.spawn, fsockopen.

Only steps 1 to 3 have report-backed evidence of demonstrated research; steps 4 to 8 are expected post-exploitation behavior per Elastic, Huntress and Recorded Future, not confirmed campaigns.

3.3 Exposure & Disclosure Infrastructure

Global exposure (VirusTotal, Unit 42):

Talos estimates about half of deployed PHP systems sit on branches that will not receive upstream fixes; PHP 8.2 itself reaches end of support on 2026-12-31.

Supply-chain and ecosystem notes. Embedded PHP runtimes in appliances, control panels (cPanel, Plesk), vendor products and containers are in scope. The volunteer-run rpms.remirepo.net repository was not expected to ship fixed packages on release day. Chainguard's early patched images enabled patch diffing by attackers while most users could not update.

Disclosure governance. The root cause was noticed in 2024 but fixes stalled over compatibility, DoS risk and a consensus-based decision process with few engine experts. PHP plans majority-based security decisions, faster escalation to Foundation leadership and additional funding.

4. Detection Opportunities

4.1 Network and Request-Level Detections

• Multipart traffic: alert on bursts of multipart/form-data POSTs to any PHP endpoint (including non-upload paths), malformed boundaries, oversized bodies, requests crafted to cross memory_limit, and repeated preparatory requests from one source.
• Memory-disclosure signal: anomalously long, malformed or binary-looking PHPSESSID response cookies, especially following HTTP 500 responses. Retain response headers for investigation.
• Error correlation: pre-application OOM/allocation-failure messages in PHP and web-server logs followed by additional requests reaching the same worker; repeated HTTP 500s.
• Application logs are insufficient: exploitation occurs before application instrumentation, so correlate web-server, reverse-proxy, PHP runtime, OS process, EDR and network telemetry.

4.2 Host and Process Detections

• Process ancestry (primary, exploit-agnostic signal): php-fpm, php-cgi, php-cgi.exe, lsphp, frankenphp, apache2, httpd (or nginx) spawning sh, bash, dash, zsh, cmd.exe, powershell.exe, Python, Perl, Ruby, Node.js, curl, wget, nc, socat or certutil.exe.
• Command-line artifacts: /dev/tcp/, mkfifo, fsockopen, base64 -d, curl ... | bash, wget -qO- ... | sh, id, whoami, uname -a, sudo -l, getcap -r /, SUID searches, reads of /etc/shadow.
• File-system: new or renamed .php/.phtml files in web roots, high-entropy web-executable files, double-extension polyglots, scripts under /tmp, /var/tmp, /dev/shm, files created, executed and deleted by PHP; new cron entries, systemd units, authorized_keys, user accounts.
• Credential access: web-server context reading .env, ~/.aws/credentials, /var/run/secrets/kubernetes.io/, or contacting 169.254.169.254.
• Stability: unexplained PHP-FPM worker crashes/restarts, segfaults, OPcache corruption or abnormal memory behavior (successful exploitation may not crash).

4.3 Vendor Detection Coverage

4.4 Inventory and Exposure Discovery

• Search process/parent names php*, lsphp*, frankenphp, sw-engine-fpm; use osquery, package manager inventories, file-system and container image inspection to find inactive or embedded PHP.
• VirusTotal queries: entity:collection collection_type:report "CVE-2026-109618", entity:ip port_service_cpe:php, entity:ip port_service_cpe:php port_banner:"PHP/".
• Validate that PHP-FPM pools and web-server configs actually load the intended settings, and that origin servers cannot be reached directly around the WAF.

4.5 Retrospective Hunt Window

Start no later than 2026-10-20 15:00 UTC (first CVE leak) and at minimum from 2026-10-21 07:43 UTC (first observed attack attempts, per Sansec) until every worker is patched and restarted. Patching does not remove pre-existing webshells or persistence.

5. Conclusion

PHP2Shell is among the most consequential web-runtime vulnerabilities of the year: two pre-authentication, application-independent RCE flaws in the engine behind a large share of the web, with a leaked and publicly circulating exploit, an unusually wide unsupported-version population, and a compressed disclosure window. Key takeaways across all 13 sources:

1. Patch the runtime, not the application. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CMS or plug-in updates, maintenance modes and application WAF logic do not help; restart all workers, services and containers after updating.
2. End-of-life PHP is the largest risk pool. PHP 8.1 and older (about 758,000 version-disclosing IPs plus many hidden ones) have no upstream fix. Use verified vendor/LTS backports or migrate; PHP 8.2.35 reaches end of life on 2026-12-31, so it is only a short-term target.
3. Mitigations are partial. session.upload_progress.enabled=0, memory_limit=-1 set outside application control, fatal_error_backtraces=0 (PHP 8.5), low post_max_size, blocking multipart/form-data, WAF and ZTNA/VPN isolation reduce known paths only. RLIMIT_AS/RLIMIT_DATA should not be used because they trigger the vulnerable path; ini_set() and .user.ini are too late in the request.
4. Assume exposure before patching. Leaks began 2026-10-20 and attack attempts were seen before fixes were public. Rotate passwords, session secrets, API keys and TLS private keys on exposed hosts even if no webshell is found, because CVE-2026-109618 can leak secrets without leaving artifacts.
5. Detect behavior, not signatures. No vendor published atomic IOCs. Web-server processes spawning shells, interpreters or downloaders, and webshell file creation, are the durable signals.
6. Disclosure and AI trends. Embargo failures, leaks and AI-accelerated discovery shorten time-to-exploit; organizations need hours-level patch pipelines for core runtimes.

Recommended Immediate Actions:

• Inventory every PHP runtime (servers, containers, appliances, control panels, CI/CD, legacy apps) and prioritize internet-facing hosts.
• Upgrade to a fixed release or verified vendor backport, then restart all PHP-FPM pools, Apache, LSAPI and containers.
• Where patching is delayed, apply the partial mitigations above, restrict multipart/form-data, isolate or take services offline, and enable WAF virtual patches.
• Enable process-ancestry detections for web workers; hunt back to 2026-10-20 15:00 UTC for webshells, persistence and outbound connections.
• Isolate and rebuild suspected hosts from a trusted baseline; preserve logs and volatile evidence first.
• Longer term: least privilege for PHP workers, restricted child-process creation and egress, application allowlisting, and migration off unsupported PHP.

6. Indicators of Compromise (IoC List)

None of the 13 reports published malicious IPs, domains, URLs, hashes, filenames or payload signatures tied to exploitation of these CVEs. The indicators below are vulnerability, version, vendor-detection and behavioral artifacts, plus one contextual infrastructure item.

6.1 Vulnerability & Advisory Identifiers

6.2 Vulnerable and Fixed PHP Versions

6.3 Network Indicators

6.4 Behavioral / Host Artifacts

6.5 Configuration Indicators

6.6 Affected Packages and Deployment Types

7. MITRE ATT&CK Techniques

Report-supported techniques are marked (R); analytical mappings for expected post-exploitation are marked (A).

Report generated by TI Mindmap HUB - Cross-source Threat Intelligence Analysis Analysis date: 2026-10-22 | Sources analyzed: 13 | Classification: TLP:WHITE