PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation

PHP disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. These flaws allow unauthenticated attackers to execute arbitrary commands on affected PHP deployments by exploiting memory exhaustion and stale state reuse during request processing. Exploitation attempts were observed in the wild as early as October 17, 2026, four days before public disclosure. The vulnerabilities affect all PHP web deployments, including Apache modules, PHP-FPM, and CGI setups. Successful exploitation does not require application-level authentication and can result in shell command execution under the web server's privileges without necessarily crashing the worker process.

AI-extracted · verify before operational use