PHP2Shell: Critical RCE Vulnerabilities in the PHP Runtime

Two critical vulnerabilities. One vulnerable runtime. Potential remote code execution.

CRITICAL · CVSS 4.0: 9.2

CVE-2026-109618 · CVE-2026-109619

PHP2Shell refers to two reported PHP runtime vulnerabilities involving unsafe memory handling. Under exploitable conditions, they can potentially allow an unauthenticated attacker to execute code on a vulnerable server.

How the attack works

Attacker | | Crafted HTTP request v Vulnerable PHP Runtime | +----------------------+ | | v v Memory Corruption Use-After-Free | | +----------+-----------+ | v Potential Remote Code Execution

Two vulnerabilities. Two failure modes.

01 — CVE-2026-109618

Memory corruption

An out-of-memory condition triggers vulnerable error-handling behaviour. Incorrect handling of internal state can corrupt memory and potentially enable code execution.

02 — CVE-2026-109619

Use-after-free

PHP accesses memory that has already been released through a stale reference. This can cause unsafe memory access and potentially enable code execution.

What is at risk?

Server execution: Code may run with the PHP worker's privileges.

Credentials: Database passwords, API keys, and application secrets may be exposed.

Sensitive data: Patient records and other protected information may be at risk.

The actual impact depends on the deployment, process permissions, and accessible resources.

Remediation

1. Identify

Check PHP versions on hosts, in containers, and across production services.

php -v

2. Patch

Apply the appropriate security update from PHP or your operating-system vendor. Verify vendor advisories for distribution-managed and legacy installations.

3. Verify

Restart affected workers and confirm that the running runtime uses the patched package.

4. Investigate

Review logs and system activity for suspicious behaviour, especially if the server was exposed while vulnerable.

Important: Updating your application does not necessarily patch the PHP interpreter.

The takeaway

Application security extends beyond application code. Runtime integrity, memory safety, least-privilege execution, and timely patching are equally important.

Patch the runtime. Verify the deployment. Protect the data.

References

PHP security announcements

Ubuntu security guidance

Cloudflare technical analysis

Canadian Centre for Cyber Security advisory