PHP2Shell: unauthenticated RCE in PHP web SAPIs (CVE-2026-109618, CVE-2026-109619)

Executive summary

PHP2Shell is the name for two critical PHP vulnerabilities fixed on 2026-10-21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, both rated CVSS v4.0 9.2. CVE-2026-109618 (GHSA-w8hw-w9fx-j79w, "RCE via OOM corruption") is memory corruption in out-of-memory handling: PHP uses longjmp() on OOM during request startup and body parsing, leaving request memory in an invalid state that shutdown then processes. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, "RCE via stale global state") is the use-after-free: worker global state can keep pointing at memory owned by a finished request, which a later request on the same worker consumes.

CISA added both CVEs to KEV on 2026-10-26. Dream reported on 2026-10-26 a campaign that rooted Palo Alto Networks PAN-OS firewalls and a management server by chaining PHP2Shell with the Linux kernel flaw Fragnesia (CVE-2026-46300); Unit 42 reported the PAN-OS management interface campaign on 2026-10-29 and says it independently verified the attacker's tooling. Palo Alto's advisory states active exploitation of internet-exposed management interfaces.

Tenable explains why mass compromise of general web hosting has lagged: a working exploit must match the exact PHP build, SAPI, extensions and FPM pool configuration, whereas appliances ship identical builds across many devices, so one calibrated exploit reaches all of them. Appliances embedding PHP and internet-exposed management interfaces are the priority.

CVEs in this chain

Timeline

1. 2026-11-03

   CSA Singapore warns of active PHP2Shell exploitation against network and security products and lists affected vendors. Source

2. 2026-10-29

   Unit 42 reports the PAN-OS management interface campaign chaining PHP2Shell with a kernel privilege escalation; Palo Alto advisory updated with remaining fixed releases. Source

3. 2026-10-29

   Tenable explains why exploits succeed on identical appliance builds but rarely on diverse web hosting. Source

4. 2026-10-28

   CISA adds Fragnesia (CVE-2026-46300) to KEV, noting chaining with PHP2Shell for root. Source

5. 2026-10-27

   Palo Alto raises its PHP2Shell advisory to Critical severity and Highest urgency. Source

6. 2026-10-26

   CISA adds CVE-2026-109618 and CVE-2026-109619 to KEV; Dream publishes the chained exploit campaign against PAN-OS. Source

7. 2026-10-24

   Researcher honeypots record 35 successful shell executions on PHP 8.4.26 under mod_php. Source

8. 2026-10-23

   First government-affiliated PAN-OS firewall rooted in the campaign documented by Dream. Source

9. 2026-10-21

   PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp; Palo Alto publishes its advisory. Source

10. 2026-10-17

    Amazon MadPot honeypot records an exploitation attempt against the still-embargoed bugs. Source

Sources

1. php.net: Security advisory, critical remote code execution vulnerabilities (2026 news archive)
2. GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
3. GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
4. CISA Known Exploited Vulnerabilities Catalog
5. Palo Alto Networks: Impact of CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks products
6. CSA Singapore AL-2026-157: Active exploitation of PHP2Shell vulnerabilities
7. Unit 42: PHP2Shell threat brief
8. Dream: Chained PHP2Shell exploit roots 25 servers
9. Tenable: PHP2Shell one week later, why one exploit doesn't work everywhere
10. ComputingForGeeks: PHP2Shell check and patch (CLI vs PHP-FPM version checks)