PHP2Shell – A Pair of Critical PHP Vulnerabilities
A few days ago, a major announcement was made. PHP, the software that powers many websites on the Internet, had two major vulnerabilities.
The PHP vulnerabilities are designated as: CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 Critical).
In a nutshell, the vulnerabilities allow attackers to exploit flaws in PHP’s memory handling by sending specially crafted web requests that cause out-of-memory conditions or fatal errors on the victim’s server. This can leave internal data uninitialized, or cause PHP workers to retain pointers to memory that has already been freed.
When PHP later accesses this invalid memory, attackers may manipulate its contents to redirect program execution, potentially achieving unauthenticated RCE with the privileges of the affected web-server process.
PHP has released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Updating is highly recommended.
These vulnerabilities are excellent examples of an open-source project not being inherently secure, just because it is open source. For the record, I do not assume closed-source is inherently secure either.
Visit the links below to get more information:
- https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/
- https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- https://en.wikipedia.org/wiki/PHP2Shell
- https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/
Posted in Cloud, Computers, General, Internet and Servers, Operating Systems, Programming, Security, Software