Critical Remote Code Execution Vulnerabilities in PHP Core ("PHP2Shell" - CVE-2026-109618 & CVE-2026-109619)

PHP is the dominant server-side web programming language powering a vast majority of the world's web applications and content management systems.

The PHP security team issued urgent updates addressing two critical flaws residing in the core request handling and memory cleanup routines:

• CVE-2026-109618 (Critical - CVSS v4.0: 9.2): Out-of-Memory (OOM) Heap Corruption leading to RCE. This flaw occurs during abnormal request termination contexts, such as when an execution exceeds the configured memory_limit. Because PHP historically relies on longjmp() to abruptly abort execution rather than cleanly unwinding the call stack, internal C functions interrupted midway through constructing complex data structures fail to invoke destructors or roll back bookkeeping. Consequently, when the cleanup routine executes, it assumes all structures are in a consistent state, resulting in an uninitialized pointer dereference (CWE-824) and stale heap corruption that can be weaponized for remote code execution.

• CVE-2026-109619 (Critical - CVSS v4.0: 9.2): Use-After-Free (UAF) via Fatal Error Handling. This flaw is a use-after-free vulnerability triggered during fatal errors or multipart form parsing (notably involving the upload progress tracking callback php_session_rfc1867_callback under session.upload_progress.enabled). Leftover memory state from an abruptly aborted request points to freed memory chunks, which can subsequently be reached and abused by subsequent requests processed by the same worker process or thread.

These vulnerabilities are actively targeted in the wild following public proof-of-concept leaks. Because they reside in the PHP core engine itself, patching application-level code or plugins is insufficient: the underlying PHP runtime binary must be upgraded and all worker pools restarted.

• PHP 8.5.x versions prior to 8.5.12;
• PHP 8.4.x versions prior to 8.4.27;
• PHP 8.3.x versions prior to 8.3.36;
• PHP 8.2.x versions prior to 8.2.35;
• All legacy End-of-Life (EOL) versions (including PHP 8.1, 8.0, 7.4, 7.x, and 5.x) which do not receive official public upstream patches.