PHP2Shell (CVE-2026-109618 / 109619): unauthenticated code execution in PHP core

Bottom line

Hayrok Research Lab is tracking two critical, unauthenticated remote code execution flaws in PHP core, together called PHP2Shell. They share one root cause: a fatal out-of-memory error during request startup leaves worker state pointing at freed or half-built memory. They are being exploited now. Patch every PHP install, restart every worker, and prove the serving process is the patched one.

Vulnerability summary

Exploitation status and timeline

Affected and fixed versions

Distributions backport the fix without changing the upstream version, so the version string can look old and still be patched. A patched package still does nothing until every worker restarts.

What to do, in priority order

Observables and hunting queries

No stable file hashes are published. Hunt on exploitation behavior and on unpatched, unrestarted workers.

ps -ef --forest | grep -A3 -E "php-fpm|apache2" | grep -v grep

ps -eo pid,lstart,cmd | grep -E "php-fpm|apache2|httpd" | grep -v grep

Technique mapping

Root cause and attack path

PHP parses the request body during php_request_startup(), before any script runs. A crafted multipart body can exhaust memory_limit during that parse, which calls zend_bailout(), a non-local jump that abandons the rest of startup. Worker globals that should have been reset are left pointing into the request heap.

Request shutdown then frees that heap, but the pointer in the worker global survives because it belongs to the process, not the request. That is the uninitialized pointer access, CWE-824. CVE-2026-109618 is the same request consuming its own invalid state; CVE-2026-109619 is a later request on the same worker consuming state left behind. The upstream fix is commit 506e87fa7d, which resets the state the jump used to leave dangling.

Confirm remediation

A rebuilt package is not a verdict. Each server should end with evidence: patched build running in the serving process, the old worker gone, or not reachable.

php -v
apt changelog php8.3 2>/dev/null | grep -E 'CVE-2026-10961[89]'
rpm -q --changelog php | grep -E 'CVE-2026-10961[89]'

ps -eo pid,lstart,cmd | grep -E 'php-fpm|apache2|httpd' | grep -v grep

# map public PHP endpoints from your edge or proxy config

# approved test only: documented multipart OOM pattern, no payload

ps -ef --forest | grep -A3 -E 'php-fpm|apache2' | grep -v grep

Am I exposed?