The "php2shell" Emergency: Unpacking the Critical Unauthenticated RCE Flaws in Core PHP Memory Management

A major cybersecurity emergency has unfolded across the global web hosting ecosystem. The PHP Security Team and cybersecurity agencies including CISA have issued urgent directives regarding two unauthenticated Remote Code Execution (RCE) vulnerabilities tracking as CVE-2026-109618 and CVE-2026-109619, collectively designated in the security research community as "php2shell".

Both flaws affect the underlying Zend Engine memory manager and carry a critical CVSS v4.0 base score of 9.2. Unlike typical application-level bugs that depend on vulnerable WordPress plugins or unsanitized database input, these vulnerabilities reside entirely within the core interpreter runtime, meaning properly coded, modern PHP applications remain vulnerable simply by accepting incoming HTTP requests on unpatched binaries.

Anatomy of the Out-Of-Memory (OOM) Corruption Vector

The first vector, CVE-2026-109618, exploits the C-runtime error unwinding architecture within the PHP interpreter. Historically, PHP utilizes the POSIX longjmp() routine to prematurely terminate request processing whenever an unexpected memory exhaustion condition occurs. While this non-local jump safely prevents process crashes under memory pressure, researchers identified that several execution contexts fail to reset Zend Engine internal pointers before jumping.

As a consequence, when the PHP worker cleans up allocations prior to serving the next request, it encounters dangling, half-initialized memory descriptors. Attackers can deliberately trigger memory ceiling thresholds through concurrent requests with tailored payload lengths, tricking the garbage collector into treating arbitrary memory blocks as valid zval containers. This produces deterministic heap corruption, which weaponized exploits quickly translate into shell command execution.

The Stale Global State and Use-After-Free Flaw

The companion vulnerability, CVE-2026-109619, targets persistent global states maintained across persistent worker processes. In long-running worker architectures like PHP-FPM, variables related to active extensions, custom error handlers, and output buffers must be strictly purged before the worker binds to the subsequent client request. In unpatched releases, edge cases in multi-part form data boundary parsing cause global pointers to linger after individual request pools are freed, generating a classic Use-After-Free (UAF) condition.

By sending a specially crafted sequence of HTTP POST headers followed by a premature connection reset, an attacker can manipulate the heap layout so that user-supplied input occupies the exact memory address previously pointed to by internal Zend function dispatch tables.

# Upstream Patch Verification Command
$ php -v
# Ensure your runtime reports one of the patched releases:
# PHP 8.4.27+, PHP 8.3.36+, PHP 8.2.35+, or PHP 8.5.12+

# Verify PHP-FPM processes have restarted completely:
$ sudo systemctl restart php8.3-fpm
$ sudo systemctl restart nginx # or httpd / apache2

Mandatory Remediation Steps for Systems Administrators

Because this vulnerability lives below the application layer, Web Application Firewalls (WAF) can only offer partial signature-based filtering. The only complete defense requires updating system packages to patched releases immediately:

• Update Core Binaries: Upgrade to PHP 8.3.36, PHP 8.2.35, or PHP 8.4.27 without delay.
• Mandatory Service Restart: Updating packages via apt, yum, or cPanel WHM replaces disk binaries but leaves existing worker processes running in RAM. You must restart PHP-FPM and your web server to flush memory pools.
• Audit Unsupported Branches: Systems running end-of-life PHP versions (PHP 8.1, 8.0, and 7.4) do not receive upstream security patches. These workloads must either be migrated immediately or isolated behind restricted internal reverse proxies.