The PHP project issued emergency updates fixing two critical remote code execution flaws collectively tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Discovered in PHP’s core runtime engine, the vulnerabilities affect branches 5.4 through 8.5. CVE-2026-109618 stems from allocator memory corruption during out-of-memory disruptions under memory_limit boundaries. CVE-2026-109619 involves dangling pointers within global state following unhandled request termination, enabling subsequent HTTP requests on the same persistent worker to corrupt heap structures or read process memory.

Because the flaws trigger at the SAPI boundary before userland scripts initialize, deployments using Apache mod_php, PHP-FPM, and LiteSpeed allow unauthenticated remote code execution without targeting application logic. Following a public technical leak, threat actors initiated automated internet-wide exploitation campaigns. The PHP team released emergency patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, noting that daemon restarts are required and unsupported legacy releases (PHP 8.1 and earlier) require vendor backports or network isolation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: SAPI-level runtime memory corruption bypasses all web application firewalls and input sanitization, granting unauthenticated adversaries arbitrary code execution and credentials access before any userland application code or framework security filters execute.
• Bullet 2 — Strategic & Defender Imperative: Administrators must deploy runtime patches across PHP-FPM and web servers immediately and restart worker pools to flush contaminated memory state, while isolating legacy, end-of-life installations that lack upstream binary updates.