The impending release of two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP prompted a huge, global overnight effort at emergency mitigation planning yesterday when news of the vulnerabilities leaked. The PHP team confirmed the upcoming security release shortly afterward, with a public announcement and patch expected today (October 21) at 14:00 UTC. Naturally, upon seeing the leaked info, a thousand LLMs were immediately pointed at PHP source code.
PHP has now published vulnerability information on what the community has inevitably christened "PHP2shell":
- CVE-2026-109618: RCE via OOM corruption (GHSA-w8hw-w9fx-j79w). Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp). Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
VulnCheck research observations
The VulnCheck research team independently reproduced what we believe to be CVE-2026-109618 and CVE-2026-109619 late the evening of October 20. The team's early analysis is that the vulnerabilities can be exploited for RCE successfully on ARM64 systems and x86 systems without ASLR. ASLR should therefore somewhat reduce the available attack surface area.
Dozens of proof-of-concept repos have popped up on GitHub, which our team is reviewing as they come in. Only a very small number have what we believe to be the correct exploit mechanism implemented, and none independently bypass ASLR on x86-64 systems. (On ARM64, ASLR can be bruteforced relatively easily.) We expect to see widespread exploit attempts with public PoCs, irrespective of whether the PoC code is functional or the target is exploitable.
Our Initial Access team is working on an exploit and detections. We also expect to be able to share VulnCheck Canary observations later today.
Mitigation guidance
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive supplier-provided patches. PHP's suggested mitigations for those who cannot apply patches immediately are in the advisory and reproduced below:
RCE via OOM corruption (CVE-2026-109618)
Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.
Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.
RCE via stale global state (CVE-2026-109619)
Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.
On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only. Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help.
Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.
About VulnCheck
VulnCheck empowers organizations to transcend the challenges of vulnerability prioritization. Our suite of solutions provides product managers, PSIRT teams, and threat hunters with the tools required for accelerated, high-precision operations and infinite efficiency.
Recognizing the industry-wide necessity for superior data velocity and accuracy, we deliver high-fidelity insights to the market. We remain committed to surfacing critical intelligence on vulnerability exploitation and emerging trends, leveraging our unique dataset to support the practitioner community.
To deepen your understanding of these threats, VulnCheck Exploit & Vulnerability Intelligence provides comprehensive coverage of global threat actors. Register for a demo to explore our intelligence today.