PHP2Shell OOM-corruption RCE added to CISA KEV after honeypot shells confirmed

CVE-2026-109618 is a memory-corruption flaw in how PHP recovers from out-of-memory errors during request processing. It gives an unauthenticated remote attacker code execution as the web worker account ¹. It was disclosed alongside CVE-2026-109619, and the pair is branded PHP2Shell. Both were fixed on 2026-10-21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 ^1,2.

PHP says every installation serving web requests is at risk ². The attack does not depend on the CMS, framework or plugins in use. Wiz demonstrated pre-authentication RCE against WordPress, Drupal and Joomla container images, and it also showed that PHP worker memory, including passwords, tokens and API keys, can leak ⁶. The flaw also reaches products that bundle PHP. Palo Alto Networks rates PAN-OS on PA-Series, VM-Series and Panorama as affected with no special configuration needed ⁴. Siemens lists all RUGGEDCOM APE1808 devices running PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 as affected ⁵.

Exploitation has moved from probes to working shells, so far only on honeypots. Amazon recorded a pre-disclosure attempt on 2026-10-17 and several PoC-based attempts from 2026-10-21. It describes the flaws as now broadly exploited but is unsure whether any attempt would have succeeded against real systems ¹¹. Cloudflare reported that attempts reached millions by 2026-10-22, with payloads altered to evade its WAF ¹². On 2026-10-24, Perplexity researcher Adel Karimi recorded 35 shells launched from two IPs across three honeypots. The traffic closely matched a public PoC. Karimi notes the honeypots ran a deliberately favorable single-worker mod_php setup, and no second-stage download was observed ⁹.

CISA added CVE-2026-109618 and CVE-2026-109619 to KEV on 2026-10-26 with a due date of 2026-10-29 ³. Arctic Wolf linked likely weaponized attempts to the Potassium Mirai-variant botnet. It notes that request telemetry does not prove the targets were vulnerable or that code ran ⁸. Censys assessed more than 34.4M PHP services as still vulnerable on 2026-10-23 ¹⁰. No confirmed compromise of a production system appears in the sources reviewed.

PHP uses longjmp() to bail out of a request when an allocation fails with out-of-memory. In some contexts request memory is reachable before it is fully initialized, so an early exit leaves that memory invalid. The request shutdown routine then reads or branches on that memory. The failed allocation does not need to be related to the invalid memory ¹. The patch removes longjmp() for OOM. It is replaced by a delayed soft OOM at the next VM safe point and an immediate hard OOM via _exit() above a higher threshold ¹.

Request startup parses request bodies, including multipart bodies, before any application code runs. The vendor lists several multipart-handling gaps that let a request hit OOM while it appears to stay within configured limits ¹. No authentication or user interaction is needed, and the attack works remotely over HTTP ¹. The weakness is tagged CWE-416, 755, 824, 1325 and 1419 ¹. Wiz describes the chain differently, as a stale session upload-progress pointer that survives an OOM and is consumed by a later request on the same worker. That resembles PHP's description of the companion CVE-2026-109619 ². This brief follows the vendor's root cause for CVE-2026-109618 ^1,6.

Apache mod_php is the highest-risk SAPI. It always runs request shutdown, even after startup fails, so the attack can succeed before any application code runs. The vendor demonstrated full RCE against mod_php with default limits in a normal prefork setup ¹. PHP-FPM ends the child process when startup fails, which blocks that path. FPM is still considered susceptible through later-stage OOM, but no complete FPM exploit has been shown ¹. Rapid7 found the public PoCs environment-specific ⁷. A VulnCheck exploit lead later said a public exploit now achieves RCE on ASLR-enabled x86-64 with PHP's recommended production configuration ¹⁰.

1. 1

   Upgrade to a patched release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The vendor says updating is the only complete mitigation. Check distro and LTS vendor packages, then restart every PHP worker ^1,2.

2. 2

   Meet the CISA KEV requirement: apply vendor mitigations in line with BOD 26-04 and complete forensic triage by 2026-10-29 ³.

3. 3

   Also apply the remediation for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): set session.upload_progress.enabled=0 at php.ini, FPM-pool or server level. PHP's 2026-10-23 informational advisory repeats this setting for a separate vector, CVE-2026-115560 ².

4. 4

   If you cannot update yet, set memory_limit=-1 in a way applications cannot override (FPM pool or Apache config), then restart workers. This is partial, because an underlying allocation failure can still reach the vulnerable path ¹.

5. 5

   Keep post_max_size low (8M without uploads, 32M with). Enforce decoded request size, field count, part count, header count and nesting depth at the web server or proxy, including for requests without a usable Content-Length. Block multipart requests at the frontend if unused ².

6. 6

   Do not use RLIMIT_AS or RLIMIT_DATA, because they can trigger the vulnerable allocation failure. A container or cgroup limit is only an availability boundary ¹.

7. 7

   PAN-OS fixes are rolling out per train, with ETAs from 2026-10-27 to 2026-10-30. Until then, enable Threat Prevention coverage and restrict the management interface to a jump box. RUGGEDCOM APE1808 owners should follow Palo Alto's workarounds and contact Siemens ^4,5.

8. 8

   Attempts predate the patch, so assume pre-patch exposure. Hunt back to 2026-10-17, check for web shells and new accounts, and rotate secrets that PHP workers could reach, since worker memory can leak ^6,12.

• These bugs run below the application layer, so app logs may show little ⁶. Hunt for multipart requests that end in memory-limit errors or bursts of HTTP 500s, oversized or malformed PHPSESSID response cookies, and unexplained PHP worker restarts ⁶.
• Monitor for PHP workers that spawn shells, run identity-check commands, change to /tmp and fetch a second-stage file with wget. Arctic Wolf saw this pattern in likely weaponized attempts ⁸.
• Check session files and request logs for the published indicators. VulnCheck's canaries saw PHPSESSID values and session filenames planted through upload-progress, and Sophos saw payloads dropped to /tmp/nfs ^13,14.
• Vendor coverage: Sophos IPS signature VID444662 covers CVE-2026-109618 ¹⁴. Palo Alto Threat Prevention customers should enable the Threat IDs listed in its advisory, which include 543004 and 97622-97624 ⁴. CISA added a Sigma rule to its PHP alert on 2026-10-23 ⁹.
• Scope investigations back to at least 2026-10-17, not to the disclosure date ¹². The KEV entry requires forensic triage ³.

1. Aug 24, 2026

   Wiz Research reports the vulnerabilities to the PHP security team. ⁶

2. Oct 17, 2026

   Earliest known exploit attempt: an Amazon MadPot honeypot hit, before patch and disclosure. ¹¹

3. Oct 20, 2026

   PHP pre-announces an emergency release; CVE IDs and a PoC leak, so PHP brings the release forward. ¹⁶

4. Oct 21, 2026

   PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released with advisory GHSA-w8hw-w9fx-j79w. ²

5. Oct 21, 2026

   PHP says the PoCs published before the patch were not functional. ¹¹

6. Oct 22, 2026

   Cloudflare reports millions of exploit attempts; Amazon discloses the 2026-10-17 pre-disclosure attempt. ¹²

7. Oct 23, 2026

   Siemens publishes SSA-566512 for RUGGEDCOM APE1808 devices running PAN-OS. ⁵

8. Oct 24, 2026

   Karimi's honeypots record the first reported successful in-the-wild exploitation (35 shells from two IPs). ⁹

9. Oct 26, 2026

   CISA adds CVE-2026-109618 and CVE-2026-109619 to KEV with a 2026-10-29 due date. ³

10. Oct 26, 2026

    Palo Alto updates its advisory with PAN-OS hotfix ETAs of 2026-10-27 to 2026-10-30. ⁴

1. 1
   RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)

   PHP project (php-src) · Vendor · Oct 21, 2026
2. 2
   php.net news: security advisory, release announcements, informational advisory

   PHP Group · Vendor · Oct 21, 2026
3. 3
   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   CISA · Government · Oct 26, 2026
4. 4
   Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products

   Palo Alto Networks PSIRT · Vendor · Oct 26, 2026
5. 5
   SSA-566512: PHP2Shell vulnerabilities in PAN-OS on RUGGEDCOM APE1808

   Siemens ProductCERT · Vendor · Oct 23, 2026
6. 6
   PHP2Shell: AI uncovers critical RCE vulnerabilities

   Wiz Research · Research · Oct 21, 2026
7. 7
   CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated RCE in PHP

   Rapid7 · Research
8. 8
   PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated RCE

   Arctic Wolf Labs · Research · Oct 22, 2026
9. 9
   PHP2Shell Exploitation Moves From Probes to Working Shells

   SecurityWeek · News · Oct 26, 2026
10. 10
    PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

    The Hacker News · News
11. 11
    Amazon says PHP2Shell exploitation began 4 days before patches

    BleepingComputer · News · Oct 22, 2026
12. 12
    Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

    The Register · News · Oct 22, 2026
13. 13
    PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619

    VulnCheck · Research
14. 14
    Proof-of-concept exploit released for PHP vulnerabilities

    Sophos · Research
15. 15
    PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

    The Hacker News · News
16. 16
    Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

    The Hacker News · News · Oct 22, 2026