PHP2Shell Emergency Patch Guide: CVE-2026-109618 and CVE-2026-109619

The PHP2Shell Outbreak: Decades of Silent Memory Corruption Exposed

The PHP core development team issued an emergency security update addressing two zero-day vulnerabilities that jeopardize almost 70 percent of the web. Dubbed PHP2Shell, the vulnerabilities allow unauthenticated attackers to trigger remote code execution across standard web deployments. Over 54.9 million web properties are currently exposed. If your infrastructure runs PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed, you are running vulnerable code right now.

What makes this release terrifying is not just the 9.2 CVSS severity rating. It is how these flaws were uncovered. Frontier AI models deployed by researchers at Wiz and OpenAI lowered the barrier for reverse engineering core engine mechanics. Automated agents scanned decades of legacy C source code, spotting memory management bugs that human auditors missed since PHP 5.4 was released in 2012. Attackers are already leveraging public proof-of-concept scripts to scan open ports and spray payloads.

According to a Rapid7 threat advisory, both vulnerabilities grant attackers the privileges of the underlying web worker process. Once an attacker gains worker control, they can scrape worker memory, steal session tokens, or install persistent keyloggers inside web roots.

Technical Autopsy: How CVE-2026-109618 and CVE-2026-109619 Trigger RCE

At the engine level, both vulnerabilities exploit how PHP handles internal execution halts via C standard library longjmp() calls. When a script hits a resource cap or memory ceiling, the Zend Engine uses longjmp() to break execution context and return control to the top-level request handler. It is an abrupt control flow transition. If state variables are not cleaned up prior to that jump, chaos follows.

CVE-2026-109618 occurs during out-of-memory allocation failures. When an attacker sends a oversized HTTP POST payload or forces excessive memory allocation, PHP attempts to handle the memory limit exception. However, request memory state is recorded as initialized before allocation completes. When longjmp() fires, the cleanup routines treat uninitialized heap regions as valid pointers. An attacker can craft heap layouts to turn this uninitialized state into predictable code execution, triggering a classic buffer overflow condition.

CVE-2026-109619 is a use-after-free flaw tied to global state retention between HTTP requests. In persistent environments like PHP-FPM or Apache mod_php, worker processes handle thousands of consecutive requests. When a request aborts unexpectedly, global pointers continue referencing freed memory chunks on the Zend heap. The next request assigned to that worker can read or branch on those pointers. This allows cross-request data leaking, exposing passwords, API keys, and system metadata from adjacent users.

# Test your local PHP binary version and compile options
php -v
php-fpm -v

# Check if persistent process managers are running exposed workers
ps aux | grep -E '(php-fpm|apache2|httpd|lsphp)'

Finding the Ghosts: Inventorying Legacy and Hidden PHP Runtimes

The biggest risk to your opsec is not the main application server you patched this morning. It is the forgotten shadow infrastructure. Legacy management portals, staging environments, embedded router firmware interfaces, and third-party administration software frequently ship with bundled PHP runtimes.

Do not trust system package managers to tell you where PHP lives. Custom software installations often compile binaries into non-standard directories like /opt, /usr/local, or inside container images. You must scan the entire file system for executable runtimes and shared objects.

A report published by ProjectDiscovery Research highlights that enterprise hosting environments often maintain shadow php-cgi handlers for legacy customer sites. These static binaries bypass standard package updates and leave open ports directly vulnerable to automated RCE.

# System-wide search for all compiled PHP binaries
sudo find / -type f -name "php*" -perm /111 2>/dev/null

# Scan running docker containers for vulnerable PHP libraries
docker ps -q | xargs -I {} docker exec {} php -v

Emergency Remediation Playbook: Patching, Isolating, and Mitigating

Your response time dictates your survival rate against automated AI-driven exploit tools. The window between vulnerability release and mass exploitation has collapsed to zero. Follow this emergency playbook immediately.

First, update all official package channels. PHP maintainers issued emergency releases for active branches: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, and PHP 8.5.12. Update your packages and restart your web service daemons. Simply updating disk binaries without restarting persistent PHP-FPM worker pools leaves corrupt code running in active RAM.

Second, if you cannot deploy patches immediately, take radical containment measures. Disable legacy handlers. Put unpatchable systems behind strict Web Application Firewalls (WAF) or drop traffic at the network edge. If a legacy box cannot be updated and cannot be isolated behind a segregated VLAN, pull it offline. Do not let an abandoned staging server become the entry point for network-wide ransomware deployment.

• Apply official upstream updates for supported releases (PHP 8.2.35+, 8.3.36+, 8.4.27+, 8.5.12+).
• Restart php-fpm, apache2, nginx, and lsws processes to clear running worker RAM.
• Deploy edge WAF rules to drop HTTP requests containing abnormally large payload bodies or suspicious chunked transfer encodings.
• Isolate legacy applications running PHP 7.x or 5.x on segregated VLANs with zero access to internal databases or cloud metadata endpoints.
• Inspect system access logs for unexpected worker crashes, segmentation faults, or unknown shell executions under user www-data or apache.