PHP core use-after-free (PHP2Shell) gives unauthenticated RCE, exploitation reported

CVE-2026-109619 is a use-after-free in the PHP core runtime. It lets an unauthenticated remote attacker disclose memory and execute code with the privileges of the web worker account ¹. PHP disclosed it on 2026-10-21 together with sibling CVE-2026-109618 and shipped fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ^2,3. Researchers call the pair PHP2Shell ⁷. Wiz demonstrated pre-authentication code execution against WordPress, Drupal and Joomla. It also showed memory disclosure that works regardless of the application and can expose secrets from other requests ⁸.

PHP says all installations that serve web requests are at risk, naming PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed ². It rates the risk highest for mod_php, where an unauthenticated request can start the attack before any application code runs ². The technical advisory describes FPM and LSAPI as conditionally exposed through early configuration paths, and says FrankenPHP showed no equivalent default path but is not immune ¹. PHP's advisory lists ranges only for the four supported branches ¹. Wiz says every PHP version back to 5.4 is affected by at least one of the two PHP2Shell CVEs, Google Cloud reports older releases affected, and the NCSC says all versions may be affected ^8,4,6. Siemens says RUGGEDCOM APE1808 devices running PAN-OS are affected ⁵. BleepingComputer cites a VirusTotal estimate of more than 5.1 million PHP hosts exposed online ⁹.

watchTowr says its honeypots observed in-the-wild exploitation of both CVEs on 2026-10-21, but it published no request details or counts ⁷. Per BleepingComputer, Cloudflare CTO Dane Knecht said Cloudflare saw early attacks against the two flaws before the patches shipped ⁹. Neither source says which CVE was used. PHP's advisory does not report observed exploitation ². A proof-of-concept tool named PHP2Shell surfaced before the embargo ended, and watchTowr confirmed the leaked flaws were real ⁷. Wiz built its own exploit script and demonstrated it against current WordPress, Drupal and Joomla container images ⁸.

PHP keeps global state that points into memory owned by a single request ¹. If that state is not reset before the request heap is freed, a later request served by the same persistent worker can use the dangling pointer ¹. The state can survive in two ways ¹: - A fatal error, including out-of-memory or an execution timeout, abandons an operation before its reset runs. - A diagnostic raised during shutdown repopulates state that was already cleared. The advisory tags CWE-416 along with CWE-755, CWE-824, CWE-1325 and CWE-1419 ¹.

PHP confirms two paths ¹: - The PHP 8.5 fatal-error backtrace feature, which is the basis of the confirmed mod_php RCE. - The session upload-progress lifecycle, validated against mod_php and FPM. Upload progress is enabled by default and works without the application calling session_start(), though exploitation still needs an interrupted request and a follow-up request on the same worker ¹. PHP describes other error, exception, object and extension state as conditionally reachable, and the patch resets that wider state too ¹. Wiz says the vulnerable code is more than a decade old and that likely untracked variants exist ⁸. Hiding warnings with error_reporting, display_errors or @ does not protect ^1,2.

The attack spans multiple requests that must reach the same PHP worker ¹. More workers and worker recycling lower the success rate per request but do not remove the condition ¹. PHP rates the issue CVSS v4.0 9.2, with high attack complexity and attack requirements present ¹. The CVSS v3.1 score shown here is 8.1 (AC:H). Early claims of a 10.0 score ¹⁰ are contradicted by PHP's rating. Wiz maps the individual bugs to the two CVE IDs differently from PHP ⁸. This brief follows the vendor mapping, in which CVE-2026-109619 covers the stale global state issue ¹.

1. 1

   Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. PHP says this is the only reliable fix and that no complete configuration workaround exists ¹.

2. 2

   On Google Cloud ⁴: - App Engine standard (PHP 8.2+) is patched automatically. - Cloud Run and Cloud Run functions are patched only if automatic base image updates are enabled. - Flexible environments and custom containers must be redeployed. - Unsupported runtimes will not be patched.

3. 3

   For PHP 8.1 and older, use one of the following, then confirm the patched binary is the one serving web traffic ^2,7: - a distribution or LTS vendor package; - PHP's source backports for 7.4, 8.0 or 8.1; - an upgrade to a supported branch.

4. 4

   Can't patch yet? Apply PHP's partial stopgaps, then restart all workers ^1,2: - Set session.upload_progress.enabled=0 in php.ini, FPM pool or server config, not ini_set() or .user.ini. - On 8.5, set fatal_error_backtraces=0. - Remove invalid per-request INI settings and fix reachable fatal errors. - Consider pm.max_requests=1. watchTowr considers .ini mitigations ineffective ⁷.

5. 5

   Follow the sibling advisory for CVE-2026-109618 as well ^2,3: - Set memory_limit=-1 administratively, in a way applications cannot override. - Use a conservative post_max_size. - Enforce frontend limits on multipart requests. - Avoid RLIMIT_AS and RLIMIT_DATA. After patching, keep upload progress disabled if you do not need it ¹.

6. 6

   Inventory PHP systems and prioritise internet-facing ones. If you can neither patch nor mitigate quickly, consider taking them offline ⁶.

7. 7

   For RUGGEDCOM APE1808 on PAN-OS, contact Siemens support. Apply Palo Alto Networks' workarounds for CVE-2026-109618 ⁵.

8. 8

   Attacks were reported before the patch, so treat exposed hosts as possibly compromised ⁹. Preserve logs and configuration, then hunt for web shells, cron jobs and new accounts ⁷. Check unpatched systems for backdoors ⁶. Rotate credentials, tokens and API keys that PHP handled, since memory disclosure can expose them ⁸.

• Search PHP and web-server logs for unusually large or deeply nested multipart requests. Correlate them with PHP workers that crashed or hit their memory limit ⁷.
• Application logs may show little, because the bugs sit below the application layer ⁸. Wiz's signals are: - multipart requests followed by memory-limit errors or repeated HTTP 500s; - unexpectedly large or malformed PHPSESSID response cookies; - unexplained churn of PHP workers. These signals follow Wiz's bug mapping ⁸.
• Run PHP's audit on an isolated copy. Set log_errors=On, a working error_log and error_reporting=E_ALL in startup config ¹. Then review for: - warnings or deprecations raised before scripts run; - diagnostics from extension or server cleanup; - fatal, parse and uncaught errors; - 'Maximum execution time exceeded'. A clean log is not proof of safety ¹.
• Hunt for post-exploitation signs ⁷: - unexplained files or web shells in web roots; - unexpected cron jobs; - new accounts tied to PHP processes; - unexplained outbound connections from PHP worker processes.
• Validate exposure by checking the PHP version that actually serves web requests (Apache module or FPM). The CLI binary can report a different version ⁷.

1. Aug 19, 2026

   Wiz says it found its first PHP vulnerability in the PHP2Shell family. ⁸

2. Aug 24, 2026

   Wiz reports the vulnerabilities to the PHP security team. ⁸

3. Sep 21, 2026

   PHP acknowledges the reports and begins work on a coordinated fix. ⁸

4. Oct 20, 2026

   Details leak before the embargo ends. PHP pre-announces an emergency release, and watchTowr says it has not yet seen exploitation. ¹⁰

5. Oct 21, 2026

   PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and publishes GHSA-6wmf-4rv5-p3rp. ²

6. Oct 21, 2026

   Cloudflare's CTO says the company is seeing early attacks before the patches ship. ⁹

7. Oct 21, 2026

   watchTowr's honeypot network observes in-the-wild exploitation of both PHP2Shell CVEs. ⁷

8. Oct 21, 2026

   UK NCSC publishes an alert urging inventory, patching and compromise checks. ⁶

9. Oct 23, 2026

   Siemens publishes SSA-566512 for RUGGEDCOM APE1808 running PAN-OS. ⁵

1. 1
   RCE via stale global state (GHSA-6wmf-4rv5-p3rp)

   PHP (php-src) · Vendor · Oct 21, 2026
2. 2
   Security advisory: Critical remote code execution vulnerabilities, update now

   PHP Group · Vendor · Oct 21, 2026
3. 3
   RCE via OOM corruption (GHSA-w8hw-w9fx-j79w, CVE-2026-109618)

   PHP (php-src) · Vendor · Oct 21, 2026
4. 4
   Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

   Google Cloud · Vendor · Oct 21, 2026
5. 5
   SSA-566512: PHP2Shell vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808

   Siemens ProductCERT · Vendor · Oct 23, 2026
6. 6
   Critical security issue affecting PHP

   UK NCSC · Government · Oct 21, 2026
7. 7
   PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619

   watchTowr · Research · Oct 21, 2026
8. 8
   PHP2Shell research write-up

   Wiz Research · Research · Oct 21, 2026
9. 9
   PHP ships emergency patches for critical PHP2Shell flaws

   BleepingComputer · News · Oct 21, 2026
10. 10
    PHP warns admins of two critical flaws, emergency patches coming tomorrow

    BleepingComputer · News · Oct 20, 2026