Skip to content

OSG-SEC-2026-10-21 PHP2Shell PHP RCE via OOM corruption and stale global state (CVE-2026-109618, CVE-2026-109619)

Dear OSG Security Contacts, Two critical vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been identified in PHP and can allow an unauthenticated remote attacker to achieve arbitrary code execution on affected systems. PHP is widely used for both custom web applications and off-the-shelf web applications such as Wordpress, Joomla, Drupal, and many others. Consider checking web applications that you have installed across your organization.

WHAT ARE THE VULNERABILITIES:

CVE-2026-109618 is a memory-corruption vulnerability involving PHP's handling of out-of-memory (OOM) conditions. An attacker can use specially crafted requests to trigger excessive memory consumption while PHP is processing request data. Under certain conditions, the resulting allocation failure can leave partially initialized state accessible during request shutdown, potentially allowing an unauthenticated remote attacker to execute arbitrary code. Several weaknesses in multipart parsing can cause a request to exhaust memory despite appearing to remain within PHP’s configured limits: A multipart request without a valid declared content length may bypass the initial post_max_size check and continue delivering decoded body data. A multipart part may contain an unlimited number of headers. PHP’s in-memory representation of those headers can be substantially larger than their wire representation, allowing a request within post_max_size to exceed the configured memory_limit. Empty file-upload controls are not counted against max_file_uploads, yet PHP still creates the usual file-metadata arrays for them. Nested field names further amplify the resulting array allocations and processing. OOM conditions may also arise through application-specific paths whenever attacker-controlled input induces a sufficiently large allocation or repeated memory consumption. CVE-2026-109619 is a separate memory-safety vulnerability involving request-specific state that may remain accessible after its underlying memory has been freed. When a PHP worker processes subsequent requests, this stale state can potentially be reused in an unsafe manner. A remote, unauthenticated attacker may be able to exploit this condition to achieve arbitrary code execution. Both vulnerabilities can be triggered through attacker-controlled HTTP requests and may result in code execution with the privileges of the affected PHP process. Internet-facing PHP applications should therefore be prioritized for remediation.

AFFECTED VERSIONS

The following PHP release branches are affected: PHP 8.2 versions earlier than 8.2.35 PHP 8.3 versions earlier than 8.3.36 PHP 8.4 versions earlier than 8.4.27 PHP 8.5 versions earlier than 8.5.12 The vulnerabilities are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, respectively. Sites using PHP packages provided by their operating system or a third-party repository should consult the applicable vendor's security guidance, as fixed package versions may differ from the upstream PHP versions listed above.

WHAT YOU SHOULD DO:

Upgrade to a vendor-provided fixed version.

It is recommended as a precaution that you shut down web servers where PHP is installed until you can apply the recommended mitigations below.

MITIGATION

CVE-2026-109618: Please see reference [1] for complete list of suggested mitigation.

Warning: Updating to a patched PHP release is the only complete fix.

CVE-2026-109619: There is no complete generic configuration mitigation as an application, extension or server path may publish stale state or consume it without a predictable log entry. See reference [2] for more information.

REFERENCES

[1] https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
[2] https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
[3] https://nvd.nist.gov/vuln/detail/cve-2026-109618
[4] https://nvd.nist.gov/vuln/detail/cve-2026-109619
[5] https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/?comments-page=1#comments
[6] https://access.redhat.com/security/cve/cve-2026-109618
[7] https://access.redhat.com/security/cve/cve-2026-109619

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team