PHP Patches Critical PHP2Shell RCE Vulnerabilities Rated 9.2

The PHP team released out-of-cycle patches for two critical core interpreter vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Researchers dubbed the flaws PHP2Shell, allowing unauthenticated remote code execution without requiring bugs in application code.

Both defects stem from how the interpreter handles memory errors. The first flaw triggers when memory_limit is exhausted during data parsing, causing PHP to jump out of context via longjmp() while leaving internal structures uninitialized. The cleanup routine then treats this leftover garbage as valid data. The second flaw is a classic cross-request use-after-free where worker global structures point to memory already freed and handed to a subsequent request, leaking process memory containing sensitive sessions and keys.

According to Wiz Research and Sansec, the flaws affect versions dating back to PHP 5.4 and impact servers running PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Researchers noted that frontier AI models compressed the timeline for turning these decade-old latent bugs into stable exploits from months of elite team effort down to a single week.

Mitigation requires updating PHP to branches 8.2.35, 8.3.36, 8.4.27, or 8.5.12, and explicitly restarting worker processes. Versions 8.1 and older lack official patches, requiring vendor backports or migration. As noted by the PHP team, no configuration completely blocks the vulnerability except updating.

Source: PHP Advisory CVE-2026-109618

Source: PHP Advisory CVE-2026-109619

Source: habr