PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core

PHP2Shell, comprising CVE-2026-109618 and CVE-2026-109619, refers to four critical memory-safety flaws in PHP core that allow unauthenticated attackers to potentially disclose memory contents and execute code through HTTP requests, affecting web-serving PHP installations dating back to PHP 5.4. The vulnerabilities stem from PHP workers retaining stale pointers after out-of-memory errors destroy request memory, enabling use-after-free conditions in session upload progress and fatal-error backtraces as well as OPcache type confusion. Exploitation activity was observed before public disclosure and patches, while proof-of-concept exploits circulated after vulnerability details leaked. Supported PHP branches were fixed in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, while older versions require vendor-patched packages or upgrades. Because the flaws operate beneath application code and can run before authentication or application filtering, affected sites may expose credentials, session tokens, API keys, and potentially allow attackers to compromise containers or move toward hosts. Recommended defenses include promptly updating and restarting all PHP workers, using temporary configuration mitigations and edge restrictions where patching is delayed, auditing internet-facing systems for compromise since October 17, rotating exposed secrets, and monitoring runtime behavior such as web-server processes spawning shells or suspicious commands.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.