PHP2Shell: Critical Remote Code Execution and Memory Leaks in Core PHP - Actions & Customer Reporting Guide

PHP2Shell: Critical Remote Code Execution and Memory Leaks in Core PHP - Actions & Customer Reporting Guide

Unauthenticated remote code execution and Heartbleed-style memory disclosure flaws have been disclosed in core PHP engine, impacting 70% of websites across the globe.

On 21 October 2026, the PHP core team released official emergency security updates resolving a series of critical memory-safety vulnerabilities in the core engine (tracked under CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Uncovered by Wiz Research with assistance from frontier AI models (Gemini 4 Argon and GPT-5.6 Sol), the flaws allow unauthenticated attackers to execute arbitrary code remotely or read live process memory belonging to other HTTP requests and internal application processes.

Because the vulnerability lives inside the PHP runtime engine itself—rather than in higher-level application logic—deployments of WordPress, Drupal, Joomla, MediaWiki, and proprietary PHP microservices are vulnerable even when their own application code is completely bug-free.

Here is what technology leaders, CISOs, and engineering teams need to understand about the flaw, what immediate actions to take today, and how to communicate with customers if your systems have suffered an incident.

---

1. What Is PHP2Shell? The Technical Breakdown

PHP powers roughly 70% of all websites in the world, serving as the foundation for modern content management systems, e-commerce backends, and financial customer portals.

The vulnerabilities disclosed in PHP2Shell date back over a decade to PHP 5.4, remaining dormant because discovering and exploiting them required an exceptionally complex chain of memory manipulation. Frontier AI models changed that dynamic, turning what was previously considered a purely theoretical issue into scalable, automated exploits within hours.

The Core Flaws: How the Engine Fails

All reported issues stem from how PHP handles fatal execution errors—specifically out-of-memory (OOM) conditions—during the earliest stages of request handling:

#### A. RFC1867 Multipart Pre-Initialization & Memory Leak

When a client sends an HTTP POST request containing "multipart/form-data", PHP starts parsing the payload during request startup before normal module initialization finishes.

1. PHP session upload-progress initializes session state at this early stage and publishes an internal pointer in "PS(id)".
2. An attacker triggers an out-of-memory error by sending crafted multipart chunks, causing PHP to abort the request.
3. PHP destroys the request heap, but fails to reset the executor global "PS(id)".
4. A subsequent HTTP request handled by the same worker reaches the upload-progress cleanup path before session initialization resets the pointer.
5. PHP trusts the stale pointer and length as a valid "zend_string", URL-encodes the reclaimed heap contents, and sends it directly back in the "PHPSESSID" response cookie.

This primitive works even if the target application never calls "session_start()". The response cookie directly leaks raw worker memory—including session tokens, database passwords, environment variables, API secrets, and sensitive customer data processed in recent requests.

#### B. Cross-Worker Use-After-Free & OPcache Confusion

In CVE-2026-109619, PHP retains the backtrace of the fatal error in "EG(last_fatal_error_backtrace)". When an OOM occurs, the request heap is freed without clearing the global pointer. When a new request triggers a diagnostic or error log before executor reinitialization, PHP references the dangling pointer in attacker-controlled memory, achieving arbitrary memory write.

Furthermore, OPcache persists compiled scripts in shared memory across worker processes. An allocation failure during persistence creates a type confusion between local worker pointer tables and shared OPcache structures, allowing attackers to corrupt shared execution state and execute shell commands without authentication.

---

2. Immediate Actions: What Engineering Teams Must Do Now

Because this executes beneath the application layer, traditional web application firewalls (WAFs) looking for SQL injection or typical PHP payloads will not catch this exploit.

Follow this prioritization hierarchy:

Step 1: Apply the Upstream PHP Core Security Patches (Mandatory)

Upgrading PHP is the only complete remediation. On 21 October 2026, the PHP security team released official security updates fixing both critical vulnerabilities:

• PHP 8.5: Upgrade to 8.5.12 or later
• PHP 8.4: Upgrade to 8.4.27 or later
• PHP 8.3: Upgrade to 8.3.36 or later
• PHP 8.2: Upgrade to 8.2.35 or later *(Note: PHP 8.2 reaches End of Life on 31 December 2026)*

If you run containerized environments (Kubernetes, AWS ECS, Docker):

Pull the latest official container images rebuilt with the security release (e.g., php:8.3.36-fpm-alpine or php:8.4.27-fpm) and verify with php -v.

End-of-Life PHP Versions (PHP 8.1, 8.0, and 7.4):

PHP 8.1 and older no longer receive active upstream releases from the PHP Project. However, given the extraordinary severity of these vulnerabilities:

1. Official Minimal Source Backports: The PHP security team took the exceptional step of providing direct source backports for PHP 7.4, PHP 8.0, and PHP 8.1 on GitHub.
2. Linux Distributions & LTS Vendors: Ubuntu, Debian, Red Hat, and cloud LTS providers received patches in advance and have published updated distribution packages.
3. Remi Repository Warning: The PHP team noted that volunteer-maintained rpms.remirepo.net does not receive advance coordinated patches; users relying on Remi should switch to distribution packages or build from source immediately.

---

Step 2: Emergency Workarounds (If You Cannot Patch Immediately)

The PHP development team explicitly notes that there are no complete mitigations; updating is the only safe choice. However, if immediate patching is delayed by change control windows, the official PHP advisory recommends the following specific interim measures to reduce exposure to known attack paths:

Mitigations for CVE-2026-109618 (RCE via OOM Corruption):

1. Set memory_limit = -1: Preferably enforce this in a way applications cannot override (such as php_admin_value[memory_limit] = -1 in your FPM pool or Apache configuration), ensuring no pool, .htaccess, or user directory puts a finite limit back. This removes the controllable PHP memory-limit threshold failure (though system allocator limits can still trigger the path).
2. Enforce Low Request and File Size Limits: Set post_max_size = 8M (or 32M if uploads are strictly necessary), and ensure upload_max_filesize is strictly below post_max_size. At the reverse proxy or WAF (Nginx/Cloudflare), enforce limits on multipart part count, header count, decoded request size, and nesting depth, including requests lacking a Content-Length header.
3. Use Container/cgroup Limits: Apply container memory limits that terminate only the individual misbehaving worker rather than relying on RLIMIT_AS or RLIMIT_DATA (which cause vulnerable allocation failures).

Mitigations for CVE-2026-109619 (RCE via Stale Global State):

1. Disable Upload Progress Globally: Set session.upload_progress.enabled = 0 in php.ini or FPM pool configuration (not via ini_set() or .user.ini) and restart all workers.
2. Disable Fatal Error Backtraces (PHP 8.5): If running early PHP 8.5 builds, set fatal_error_backtraces = 0 and restart workers.
3. Clean Up Deprecation Diagnostics: Remove invalid or deprecated per-request settings that emit warnings before initialization completes (suppressing them via error_reporting or @ does not prevent the vulnerable path). Fix any application-level timeouts and fatal errors in upload or import handlers.

---

Step 3: Threat Hunting: Detecting Active Exploitation Attempts

Review web server, ingress controller, and PHP-FPM access and error logs for the following indicators:

1. Abnormal PHPSESSID Cookie Lengths: Normal PHP session IDs are 26 or 32 hexadecimal/base64 characters. Under memory disclosure attacks, the response Set-Cookie: PHPSESSID=... will be unusually long (hundreds or thousands of characters) containing URL-encoded binary or memory fragments.
2. Bursts of Fatal Out-of-Memory Errors: Search your PHP-FPM error logs for repeated patterns such as PHP Fatal error: Allowed memory size exhausted in Unknown on line 0. The in Unknown on line 0 indicates the failure occurred during internal request startup rather than inside a specific user script.
3. Repeated HTTP 500 Responses Followed by Successful 200 Requests: Attackers calibrate memory layout by deliberately sending crashing requests, followed immediately by requests to collect leaked pointers.

---

3. Incident Management & Customer Reporting Playbook

If your telemetry shows evidence of successful exploitation—such as abnormal worker memory dumps, altered files on disk, unexpected shell processes spawned by www-data, or leaked session cookies—treat this as a high-severity data breach.

Because PHP2Shell allows reading process memory, it can expose:

• In-memory database passwords and cloud API keys.
• Active customer sessions, bearer tokens, and JWTs.
• Sensitive customer data (PII, transaction details, financial records) processed by co-located requests.

Immediate Containment Steps

1. Isolate the Affected Nodes: Detach compromised instances or pods from your load balancer. Preserve RAM snapshots and disk images for digital forensics.
2. Invalidate Active Sessions Globally: Purge Redis/Memcached session stores and force user re-authentication across your platform.
3. Rotate All Infrastructure Secrets: Immediately cycle database passwords, JWT signing keys, payment gateway API credentials, and cloud service account tokens configured on the server.

---

How to Report the Incident to Customers

Under data privacy regulations (GDPR Article 33/34, SEC cyber disclosure rules, CCPA, and EU DORA), an incident involving potential exposure of personal data or credentials triggers mandatory reporting timelines (frequently 72 hours from confirmation).

When communicating with customers, clarity, transparency, and actionable instructions are critical to maintaining trust.

#### Customer Notification Template

```text

Subject: [Security Advisory] Important Security Update Regarding Your [Company Name] Account

Dear Customer,

We are writing to provide transparent information regarding a security incident and the decisive measures our team has implemented to safeguard your data.

1. What Happened

On 21 October 2026, the security community and the PHP Development Team disclosed critical vulnerabilities affecting core PHP runtimes worldwide (CVE-2026-109618 and CVE-2026-109619). During our proactive threat monitoring, our security operations team identified abnormal execution patterns affecting a subset of our web application servers on [Date/Time UTC].

1. What Data Was Involved

Our forensic investigation indicates that an unauthorized third party exploited this runtime vulnerability, which may have allowed transient access to web server process memory. The data that may have been accessible includes:

• User session tokens and account profile identifiers
• [Specify any customer data or PII, e.g., names, email addresses, order histories]

We have confirmed that our core customer databases and encrypted password vaults were NOT breached directly.

1. Actions We Have Taken Immediately

• Applied the official vendor security patches (PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) to all production systems and verified container immutability.
• Terminated and invalidated all active user session tokens across our platform.
• Rotated all backend service credentials, database connection strings, and API secrets.
• Deployed enhanced edge-filtering rules to block malicious multipart payloads.
• Engaged external digital forensics experts to conduct a comprehensive audit.

1. What You Should Do

• Password Reset: Although passwords are stored using salted cryptographic hashes, as an added precaution, please reset your password by visiting [Link].
• Enable Multi-Factor Authentication: If you have not already enabled MFA, please enable it in your account settings.
• Review Account Activity: Check your recent account transactions and notify our security team at [[email protected]] if you observe any unauthorized actions.

We take the responsibility of protecting your data with utmost seriousness. A dedicated FAQ and updates page is available at [Link].

Sincerely,

[Name / Chief Information Security Officer]

[Company Name]

```

---

4. Key Questions to Ask Your Vendors and Hosting Providers

Even if your in-house application is built in Go, Node.js, or Java, many organizations rely on third-party marketing sites, blogs, customer support portals, or billing platforms that run on PHP (such as WordPress or Magento).

Send these questions to your IT partners and managed service providers today:

1. Runtime Verification: *"Do any public-facing portals or internal services in our environment utilize PHP? If so, what exact version is deployed, and has the October 21 security update been applied?"*
2. Mitigation Status: *"If an immediate upgrade is pending maintenance windows, have temporary mitigations (disabling upload progress and deploying WAF rules for multipart requests) been enabled?"*
3. Forensic Log Review: *"Have your SOC teams reviewed web server and PHP-FPM error logs for out-of-memory crashes on Unknown:0 or anomalous PHPSESSID response headers between October 21 and today?"*