Critical PHP Vulnerabilities Force Emergency Site Shutdowns

A pair of critical memory-handling flaws in the core PHP engine triggered emergency downtime across the web on October 21, 2026. Administrators took platforms offline—including the Internet Archive, registrar BookMyName, and the registry for Germany's .de top-level domain—to manually deploy updates before automated attacks could exploit the bugs.

Known collectively as PHP2Shell, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, carrying a CVSS score of 9.2. According to security advisories from CERT-EU and details published by security researchers at Wiz and Sansec, technical details leaked prior to the coordinated disclosure date. Sansec warned that automated, mass exploitation attempts were likely to begin within 15 minutes of the patches going live.

The root causes stem from memory corruption during request handling. CVE-2026-109618 occurs when an out-of-memory condition triggers an abrupt jump using longjmp. This aborts request processing while internal data structures remain only partially initialized. During cleanup, the shutdown handlers attempt to interact with unallocated memory. Attackers can trigger this condition by manipulating multipart form payloads with high volumes of headers and no Content-Length.

The second flaw, CVE-2026-109619, is a use-after-free bug caused by failure to clear request-specific global state after timeouts, fatal errors, or memory exhaustion. Dangling pointers allow subsequent web requests processed by the same worker to read or write stale data. The attack surface affects setups handling web requests across Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with mod_php confirmed as the most directly exploitable target because it executes shutdown routines even during failures.

The PHP security team released patched versions spanning PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, as well as backported fixes for end-of-life branches reaching back to PHP 7.4, PHP 8.0, and PHP 8.1. Project maintainers stated that no workarounds exist and full mitigation requires installing the updated binaries.

Source: habr

Primary source: PHP