PHP2Shell
Vulnerability, Detection, Investigation & Remediation Report
1. Executive summary
PHP2Shell is the nickname for two critical vulnerabilities in the PHP runtime: CVE-2026–109618 and CVE-2026–109619. They can permit unauthenticated remote code execution (RCE) in vulnerable web-facing PHP deployments. Research and government advisories also describe potential disclosure of sensitive PHP worker memory. Because the defects are in PHP itself, updating WordPress, Drupal, Joomla or another application alone does not fix the runtime vulnerability.
Severity: CVSS v4.0 9.2 for each CVE, according to the published advisories.
· Priority: identify every web-serving PHP runtime, patch urgently, and investigate activity from before the fix.
· Risk: successful code execution may allow activity with the privileges of the PHP/web service, including data access, malware execution and follow-on compromise.
· Important distinction: a vulnerable version indicates exposure; a suspicious request indicates possible probing/attempt; neither alone proves successful compromise.
2. Vulnerability details
CVE
Technical summary
Potential impact
CVE-2026–109618
Out-of-memory (OOM) handling can leave request state unsafe during cleanup; researchers describe an upload-progress-related use-after-free path.
Potential unauthenticated RCE and memory disclosure.
CVE-2026–109619
Stale global/request state can refer to memory after it has been freed; the next request may use that state before it is safely initialized.
Potential unauthenticated RCE.
These are memory-safety issues in core PHP. Exploitability depends on the exact runtime build, configuration and deployment. PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP and LiteSpeed deployments should be inventoried. PHP has stated that the demonstrated pre-application-code path makes Apache mod_php especially important to prioritize.
3. Who discovered it?
· Calif: Ryan Austin is credited with discovering critical PHP flaws in August 2026 and initiating coordinated disclosure.
· Wiz Research: Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz independently discovered and reported the vulnerabilities.
· OpenAI: Amy Burnett / OpenAI Codex Security contributed vulnerability research through the Patch the Planet initiative.
· PHP Security Team: coordinated the maintainer response and released security fixes; it is the vendor/maintainer, not the discoverer of every reported issue.
Attribution and dates above reflect the public research/disclosure accounts available as of 26 October 2026. For formal attribution, use the researchers’ original write-ups and PHP’s security advisories.
4. What can happen after exploitation?
· Remote commands may execute with the permissions of the PHP worker or web service account.
· Application files, configuration, database connection strings, API keys or cloud credentials accessible to that account may be exposed.
· An attacker may attempt to write a web shell, download tools, establish persistence or use the server as a foothold.
· Memory disclosure may expose session tokens or other secrets even if no obvious shell, file or child process is created.
· The impact depends on service privileges, network segmentation, secret handling, application permissions and additional controls.
5. Detection strategy
Use layered detection. No single indicator is definitive, and the exploit may execute inside PHP without spawning a child process. Correlate reverse-proxy/WAF, web-server, PHP/PHP-FPM, endpoint, network, filesystem and identity/cloud telemetry.
Telemetry source
What to look for
How to interpret
WAF / HTTP / reverse proxy
Unusual POST/multipart requests, malformed request patterns, repeated probes, request bursts and unusual response behavior.
Potential probing/attempt; multipart alone is normal.
PHP / PHP-FPM logs
Fatal errors, memory exhaustion, worker exits/restarts, unexpected warnings, repeated 500/502/503 responses.
Correlate with request time; errors can have benign causes.
EDR / process telemetry
PHP/web worker launching shell, download utility, scripting interpreter or unfamiliar binary.
Strong suspicious behavior; establish parent process and command-line context.
Network telemetry
Unexpected outbound DNS/HTTP(S), downloads, new destinations or traffic from a server that normally has limited egress.
Possible post-exploitation or unrelated application behavior; validate destination and timing.
Filesystem / integrity
New or changed PHP files, web shells, files in upload/temp directories, altered cron/systemd/configuration or unexpected executables.
Potential persistence or tampering; check file provenance and deployment records.
HTTP response headers
Unusual PHP session-cookie/header size or anomalous session behavior where captured.
May support a memory-disclosure hypothesis; not a standalone proof.
Identity / cloud audit
Unexpected use of database credentials, API keys, cloud identities or administrative accounts available to the PHP process.
Can reveal downstream impact or credential misuse.
6. What should an analyst look for?
A. Web and request logs
· Unusual POST requests to endpoints that do not normally accept uploads.
· Repeated multipart/form-data requests, abnormal request sizes, or malformed/repeated fields.
· The PHP_SESSION_UPLOAD_PROGRESS field when request-body telemetry is available; its presence alone is not malicious.
Get Cyberchithapu’s stories in your inbox
Join Medium for free to get updates from this writer.
· Suspicious requests followed by PHP errors, worker instability or an unexpected response pattern.
· Requests from the same source followed by outbound connections, file changes or suspicious child processes.
B. Process tree
nginx / apache2 / httpd
└── php-fpm / php-cgi / PHP worker
└── sh / bash / curl / wget / python / perl / other unexpected process
This is an illustrative chain, not a required exploit artifact. Some exploit paths may not spawn a shell. Check parent/child relationships, command lines, user identity, executable path, hashes, timestamps and network connections. On Windows, Sysmon Event ID 1 can help where configured; on Linux, use EDR, auditd, process accounting and relevant service logs.
C. Persistence and impact
· Unexpected PHP/PHTML files, especially in writable upload or temporary paths.
· New cron entries, systemd services, SSH keys, user accounts or modified application code.
· Unexpected use of curl/wget or other download utilities and connections to unfamiliar external hosts.
· Reads of .env files, application configuration, database credentials, cloud metadata or secrets stores.
· Unusual database queries, outbound data transfers, lateral movement or follow-on authentication anomalies.
7. Example detection queries
Splunk: suspicious multipart POST activity
index=web_logs earliest=”10/17/2026:00:00:00"
| eval src_ip=coalesce(client_ip,src_ip,src)
| eval method=upper(coalesce(http_method,method))
| eval content_type=lower(coalesce(content_type,request_content_type,””))
| eval status=tonumber(coalesce(status,http_status,sc_status))
| where method=”POST” AND like(content_type,”%multipart/form-data%”)
| bin _time span=5m
| stats count AS requests
count(eval(status>=500)) AS server_errors
values(uri_path) AS paths
by _time src_ip host
| where requests>=5 OR server_errors>=2
| sort — server_errors — requests
Use only as a starting hunt. Field names vary; adjust indexes, thresholds and time zones to your environment. This query detects patterns, not PHP2Shell itself.
Splunk: PHP runtime errors and worker instability
index=php_logs earliest=”10/17/2026:00:00:00"
(“Allowed memory size” OR “Fatal error” OR “segmentation fault”
OR “SIGSEGV” OR “child exited on signal” OR “Maximum execution time”)
| bin _time span=5m
| stats count AS events values(source) AS sources
values(_raw) AS sample_events by _time host
| where events>=3
| sort — events
Tune to a baseline and correlate with HTTP and EDR telemetry. A successful exploit may not produce an error.
Microsoft Defender XDR: unexpected child processes
DeviceProcessEvents
| where Timestamp >= datetime(2026–10–17)
| where InitiatingProcessFileName in~ (
“php”, “php.exe”, “php-cgi”, “php-cgi.exe”,
“php-fpm”, “apache2”, “httpd”, “w3wp.exe”)
| where FileName in~ (
“sh”, “bash”, “dash”, “curl”, “wget”, “python”,
“python3”, “perl”, “nc”, “ncat”, “socat”,
“cmd.exe”, “powershell.exe”)
| project Timestamp, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, ReportId
| order by Timestamp desc
This is behavior-based and not a CVE signature. Validate legitimate automation and application behavior. Linux telemetry may use a different schema or product.
8. Investigation workflow
1. Identify affected assets: inventory PHP versions, SAPI/integration, operating system packages, container images and bundled PHP in third-party products.
2. Determine exposure: internet-facing status, reachable endpoints, upload/session features, service privileges and network egress.
3. Preserve evidence: export web/WAF, PHP, system, EDR, network, authentication and cloud audit logs before retention expires.
4. Build a timeline in UTC: suspicious request → PHP/runtime event → process/network/file activity → credential or data access.
5. Assess both execution and memory disclosure: absence of a shell does not rule out exposed secrets or in-process exploitation.
6. Scope beyond one host: review shared credentials, application deployments, neighboring services, cloud identities and downstream authentication.
7. Classify findings as scanning, attempted exploitation, confirmed compromise or inconclusive, and document the evidence for the chosen classification.
9. Remediation
Required actions
· Upgrade to a fixed supported PHP release. The published fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Confirm the correct vendor package and any security backport.
· Prioritize internet-facing PHP services, but inventory internal systems, containers, appliances, CI images and bundled runtimes as well.
· Verify the actual web-serving runtime is patched; `php -v` may only report the CLI runtime.
· Restart or replace relevant PHP workers/services and roll out rebuilt container images so old vulnerable workers are not left running.
· If patching cannot be completed promptly, follow the PHP/vendor advisory for temporary mitigations. Consider isolating or taking vulnerable internet-facing services offline if risk cannot be reduced adequately.
· Review `session.upload_progress.enabled` and other configuration only according to current vendor guidance. Configuration changes are temporary risk reduction, not a substitute for a fixed release.
· After suspected compromise, contain the host, preserve evidence, remove persistence, rebuild from trusted sources when appropriate, and rotate secrets/tokens accessible to the affected process.
· Validate application behavior, patch state, container/image inventory, and monitor for repeat attempts after remediation.
10. Important related issue
CVE-2026–115560 is a separate PHP session upload-progress issue reported after the original PHP2Shell fixes. Government guidance says the October 21 fixes do not address it and gives a temporary mitigation for the relevant configuration/application condition:
session.upload_progress.enabled=0
Treat this as a separate vulnerability and confirm the latest PHP/vendor advisory before applying configuration changes. Do not assume that patching CVE-2026–109618 and CVE-2026–109619 closes CVE-2026–115560.
11. checklist
· Inventory all PHP runtimes, including bundled and containerized installations.
· Confirm fixed release/vendor backport status and prioritize internet-facing assets.
· Start patching; isolate exposed assets that cannot be promptly mitigated where appropriate.
· Hunt historical telemetry from 17 October 2026 UTC onward, extending the window as needed.
· Correlate web requests, PHP errors, process trees, network connections and file changes.
· Review potential memory disclosure and exposed session/application/cloud secrets.
· Investigate persistence and downstream credential use if compromise is suspected.
· Rebuild or clean affected systems as warranted; rotate potentially exposed secrets.
· Verify runtime patch state and document residual telemetry gaps.
12. References
· PHP2Shell research hub: https://www.php2shell.com/
· Wiz Research — PHP2Shell technical research: https://www.wiz.io/blog/php2shell-php-rce
· Sansec — PHP2Shell analysis and discovery timeline: https://sansec.io/research/php2shell
· Official PHP security announcements: https://www.php.net/security
· Canadian Centre for Cyber Security advisory: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
· NHS England Digital advisory: https://digital.nhs.uk/cyber-alerts/2026/cc-4875/cc-4875
· OpenAI — Patch the Planet coordinated disclosure: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
· Palo Alto Networks Unit 42 updated threat brief: https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
