PHP2Shell: Exploitation Attempts Began Four Days Before the Patch

The Vulnerabilities

CVE-2026-109618: Out-of-Memory Corruption

PHP enforces a per-request memory ceiling via memory_limit. When a request exhausts that limit, PHP raises a fatal error and begins cleanup. The bug is in that cleanup routine: it can be interrupted mid-way, leaving internal PHP request structures partially initialized. The cleanup routine then processes that incomplete state as if it were valid, a confused-deputy scenario where the error handler trusts data it should never have touched.

The consequence is unauthenticated remote code execution. An attacker crafts an HTTP POST request designed to exhaust memory at a precisely controlled point in PHP's initialization sequence. No authentication check, no WAF rule, no application firewall can stop it. The payload is processed entirely within PHP's own internals before a single line of your application code runs.

CVE-2026-109619: Stale Global State Reuse

PHP workers in persistent deployment modes (PHP-FPM, mod_php, LiteSpeed) serve multiple requests on the same worker process. Between requests, PHP is supposed to reset internal global state. CVE-2026-109619 is a failure of that reset: under specific conditions, request-scoped internal PHP state survives after its backing memory is freed. A subsequent request on the same worker reaches into that freed memory, achieving code execution.

Known trigger paths:

• PHP Session Upload Progress: enabled by default (session.upload_progress.enabled=On). A multipart POST to any PHP endpoint triggers the stale-state reuse without requiring an application handler.
• Fatal-error backtraces in PHP 8.5: a separate code path reaching the same condition. PHP's interim guidance for 8.5 is to set fatal_error_backtraces=0.

Why application-layer defenses don't apply to either CVE: Both vulnerabilities fire during PHP runtime initialization, before the request reaches any router, middleware, or authentication handler. WordPress, Drupal, Laravel, custom apps with full input validation: all equally exposed. The attack surface is PHP itself.

Scope & Affected Configurations

AWS lists PHP 5.4 through 8.1 as affected end-of-life branches, so the vulnerable code dates back roughly 14 years.

The EOL Problem Is Worse Than It Looks

PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are the fixed releases. That covers currently supported branches only:

• PHP 7.4, 8.0, 8.1: minimal source backports only, for people who build from source. No official tarballs or binaries.
• Amazon Linux: Amazon's advisory marks the AL2 core php package and AL2023 php8.1 as No Fix Planned. AL2023 php8.2 through php8.5 and the AL2 php8.2 extra are marked Fixed.
• Other distributions and LTS vendors may ship backports for older branches. Check your vendor's advisory.

Security vendor Mallory counted Shodan banners on October 20 and found about 59% of hosts that advertise a PHP version are on a branch that gets no official patch. Forrester repeated the figure in its briefing. These are banner counts, not confirmed vulnerable systems, and some of those hosts run backported packages.

The Embargo Collapse

Coordinated disclosure was originally set for October 22, 14:00 UTC. After details leaked, the PHP Foundation moved the release forward one day to October 21.

Exploitation in the Wild

Status as of October 23, 2026:

• watchTowr reports exploitation attempts seen in its honeypots. CISA and the Dutch NCSC said they had not observed active exploitation as of October 21.
• Millions of attempts have been reported, but no confirmed breach so far. These bugs can leave few traces, so a quiet log is not proof of safety.
• Cloudflare saw attackers changing payloads to get around its rules and kept updating them.

What To Do

What Does Not Work

• Application-level authentication: the exploit fires before your code runs
• WAF rules alone: attackers change payloads to evade rules, and a WAF does nothing if your origin can be reached directly
• Multipart POST filtering toolkits: useful as a stopgap, but the maintainers of tools such as syhunt/php2shell-protection say in their own README that they are not a complete mitigation
• IP blocking: observed attempts came through anonymization networks
• session.upload_progress.enabled=0 alone: closes one confirmed CVE-2026-109619 path; does nothing for CVE-2026-109618, and PHP warns other variants exist

The Bigger Picture

PHP2Shell is not a new class of bug. Cleanup running on half-initialised state and request state surviving between requests are memory-safety issues that C runtimes have dealt with for decades.

The attack surface is the runtime, not the application. Most PHP security reviews look at application code. These bugs sit in the interpreter, so a well-written application on an unpatched runtime is still exposed.

The vulnerable code is old. It reaches back to PHP 5.4 and survived many major versions. Age and wide use are not the same as correctness.

The disclosure timeline did not hold. Leaks forced an early release, and attempts were recorded before patches existed. For software that runs a large part of the web, that is worth planning for: assume the window between leak and exploit can be hours.