PHP2Shell: The Critical PHP Core Memory Corruption & Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)

Executive Summary

In late October 2026, security researchers at Wiz Research and partnered intelligence units disclosed PHP2Shell, an urgent collective advisory identifying two critical vulnerabilities in the core engine of PHP (CVE-2026-109618 and CVE-2026-109619).

Unlike typical application-level bugs found in WordPress plugins, Drupal modules, or bespoke Laravel controllers, PHP2Shell resides directly in the PHP runtime C codebase. As a consequence, internet-facing servers can be compromised regardless of how defensively the downstream PHP application code was written.

The Anatomy of PHP2Shell Flaws

The vulnerability cluster is comprised of two distinct memory-management flaws:

1. 1CVE-2026-109618 (Out-of-Memory State Inconsistency): When a web server processes requests that exceed configured resource constraints (e.g., `memory_limit`), PHP executes an emergency mid-flight abort. Due to an unchecked teardown routine in Zend's memory allocator (`Zend/zend_alloc.c`), internal heap pointers can be left in an uninitialized state. Subsequent memory sweeps during garbage collection trigger memory corruption that can be leveraged to hijack control flow.
2. 2CVE-2026-109619 (Stale Session Upload Progress Pointer): By manipulating standard multipart file uploads while leveraging PHP's built-in session upload progress feature (`session.upload_progress.enabled`), global state pointers outlive the request heap. When a subsequent HTTP request is served by the same worker process, the attacker can steer stale pointers, resulting in Use-After-Free (UAF) and arbitrary memory write primitives.

The Role of Frontier AI in Discovery & Weaponization

A prominent finding highlighted in Wiz's research is that modern frontier AI reasoning models were leveraged to reverse-engineer and accelerate the synthesis of working exploit chains. Complex memory layouts that historically took weeks of manual debugging were mapped in hours, underscoring the urgent necessity of AI-assisted defensive tooling.

Exploitation in the Wild & Threat Landscape

Within 48 hours of initial disclosure, global honeypots and telemetry detected automated scanning campaigns probing for exposed PHP-FPM and Apache mod_php workers. The exploit payloads target common endpoints accepting file uploads or high-volume parameter sets designed to force out-of-memory aborts.

Defensive Playbook & Remediation

Organizations running PHP workloads must execute the following remediation steps immediately:

• Upgrade Core PHP Runtimes: Deploy official upstream releases immediately (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).
• Disable Session Upload Progress: If patching cannot be executed immediately, disable session upload progress in `php.ini` via `session.upload_progress.enabled = Off` as a temporary mitigation.
• Tune Worker Memory Limits: Ensure `memory_limit` in `php.ini` provides sufficient headroom to prevent artificial out-of-memory triggers by malicious clients.
• Deploy Web Application Firewall Signatures: Inspect multipart upload requests with anomalous lengths or malformed boundary headers.