Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619

A security advisory describes two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called php2shell, which reportedly affect maintained PHP releases through an engine-level error-handling mechanism that uses zend_bailout and longjmp() to abandon in-progress operations after fatal conditions such as memory exhaustion, timeouts, or disconnected clients. The advisory states that attackers may be able to trigger inconsistent internal state through unauthenticated HTTP requests, potentially leading to denial of service or remote code execution under the web server’s operating-system account, with limited logging beyond routine memory errors. It identifies mod_php configurations, particularly Apache prefork deployments with permissive POST and memory limits, as notable exposure scenarios, while PHP-FPM may also face denial-of-service and some cross-request risks. Patched releases are listed for PHP 8.2 through 8.5, with distributor patches available for some older versions, and organizations are urged to inventory PHP systems, apply updates promptly, and review configurations such as post_max_size, session upload progress, input nesting limits, and PHP-FPM worker recycling. The advisory also recommends monitoring for unusual oversized or deeply nested form submissions, PHP internal out-of-memory errors, segmentation-fault bursts, and PHP worker processes spawning shells, while noting that WAF-based protections and configuration changes are partial mitigations rather than replacements for patching.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.