CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

CrowdStrike reports two critical PHP core vulnerabilities, collectively called PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, which each carry a CVSS score of 9.2 and can enable unauthenticated remote command execution through HTTP requests. The flaws arise from PHP’s fatal-error handling, which can abruptly abandon execution without completing cleanup, leaving either uninitialized request memory or stale pointers in process-level state that attackers may manipulate. Because the issues occur while PHP is processing request data before application code or extensions run, exposure is independent of the hosted application, framework, or plug-ins, and attacks may return normal HTTP responses with little evidence beyond a memory-exhaustion error in server logs. Affected versions include PHP 7.x and 8.x, although practical exposure depends partly on configurations that allow request bodies large enough to exhaust PHP memory limits, particularly in persistent-worker environments. CrowdStrike recommends applying PHP or vendor security updates as the complete remediation and describes Falcon capabilities for identifying affected installations, detecting suspicious PHP and web-server behavior, and monitoring startup-phase memory exhaustion events associated with potential exploitation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.