What happens inside PHP
Request shutdown can free memory without clearing every global reference to it. Another request may use that reference during early processing.
The patch resets state at safe lifecycle boundaries and changes affected session and extension handling. The selected executor diff on the Overview page is only one part of the fix.
Read the upstream code changes ↗
Affected versions & patch status
Update PHP deployments that serve untrusted web requests. Supported branches below the first fixed releases need an update or a vendor-confirmed complete backport. End-of-life branches require separate vendor review and a migration plan.
First fixed upstream releases for CVE-2026-109619| Branch | Affected upstream builds | First fixed release |
|---|
| PHP 8.2 | Before 8.2.35 | 8.2.35 |
| PHP 8.3 | Before 8.3.36 | 8.3.36 |
| PHP 8.4 | Before 8.4.27 | 8.4.27 |
| PHP 8.5 | Before 8.5.12 | 8.5.12 |
Older PHP: upstream and community backport links →
This table covers the named CVE. It does not establish coverage for CVE-2026-115560.
Respond to this CVE
- Install a fixed build from a trusted package or image source. Vendor backports can retain older version numbers; verify the exact package advisory.
- Restart or replace every serving worker and container. A patched executable on disk does not prove an existing process has loaded it.
- PHP 8.1 and older are end of life. Exceptional source backports do not restore regular upstream support.
Compensating controls — partial coverage
- Disabling upload progress before request parsing blocks the confirmed session routes. It does not repair the broader stale-state vulnerability.
- For PHP 8.5, disabling fatal_error_backtraces covers the confirmed fatal-backtrace route only. Restart every worker.
- Do not rely on runtime ini_set() or FPM .user.ini for a control that must apply before multipart parsing.
; Set in the serving runtime configuration, before request parsing.
session.upload_progress.enabled = Off
; PHP 8.5 only: covers the confirmed fatal-backtrace path.
fatal_error_backtraces = Off
Patch guide → · Runtime and infrastructure controls →
Verify on your own systems
- Inventory the actual web SAPI, package or image digest, FPM pools, Apache modules, containers and replicas. CLI PHP may be a different installation.
- Check package provenance and live runtime version against the advisory, then verify worker replacement.
- An HTTP status, a crash, ordinary upload-progress metadata or a failed public PoC is not a universal vulnerability verdict.
Local Linux inventory helper · Private web-runtime verification
Monitoring ideas
- Correlate unusual multipart requests, fatal errors, execution timeouts and worker reuse.
- Malformed session cookies or session-decode errors warrant investigation but are not conclusive signatures.
Open the detection and monitoring guide →
PoCs & related research
These links are source-reviewed examples and related research. No exploit was executed for this site. Read each repository’s prerequisites and limitations before using an isolated lab.
Session-file injection and serializer-mismatch verification scripts, a deserialization UAF reproducer, and research notes. The described RCE chains require additional conditions such as application LFI, unsafe deserialization or a usable gadget.
Source inspected; scripts not executed. The lab generator uses a floating PHP image, publishes HTTP and FastCGI on all interfaces, and enables privileged mode with seccomp disabled. Review and isolate it before use; the supplied setup is not a safe localhost-only recipe.
Pinned source links & review notes →Research bundle with claimed exploit implementations, a framework and validation notes. The repository credits J4ck3LSyN, Andrew Dorman and Arch&Yuki; reproduction claims remain attributed to its authors.
Source inspected; nothing executed. All four Python files in this reviewed snapshot fail syntax parsing at line 1 because uncommented prose precedes the shebang. The README also refers to directories absent from the snapshot. This is not a verified runnable package. Historical review: the public repository returned HTTP 404 on 24 October 2026 and is currently unavailable; the pinned links may no longer resolve.
Pinned source links & review notes →Upload/session research lab with pinned PHP images, nginx/FPM targets, a WordPress example and an AddressSanitizer build scaffold. Useful for controlled observation and build comparisons.
Source reviewed, not executed. The harness does not return a reliable vulnerability verdict; normal progress metadata is not proof of either CVE. Top-level port bindings require loopback correction. The separate impact payload assumes code execution rather than demonstrating how to obtain it.
Pinned source links & review notes →Apache prefork exploit research for the original PHP2Shell flaws, with x86_64 and aarch64 profiles and published author run logs. The current production-INI path differs from its archived 8M/display-errors-on experiments.
Source inspected; not executed. Build-specific profiles remain necessary. The driver holds most worker slots and sends memory-intensive requests, so it can disrupt a service. Its local success check depends on a proof file shared with the supplied container; author success rates are not independent validation.
Pinned source links & review notes →Local Docker trigger labs for multipart memory exhaustion and stale fatal-error state. The trigger scripts report HTTP responses, worker identity and follow-up health; they do not attempt controlled code execution.
Source inspected; not executed. An OOM, disconnect or healthy follow-up is not a reliable CVE verdict. The stale-state control disables the relevant setting on the same vulnerable build; it is not a matched patched-build comparison. Its separate ASLR lab wraps 9bie's code and is not an independent exploit.
Pinned source links & review notes →Comparative research with an author-reported server/build matrix, production-INI and legacy Apache chains, and separate application-dependent session/deserialization examples.
Selected source inspected; not executed. The published matrix is the author's evidence, not independent validation. Current profiles are build-specific. The reviewed pure_off.py returns success after sending OOB attempts without checking receipt; a zero exit code in that mode is not proof of command execution.
Pinned source links & review notes →Published CVSS vector
This is PHP’s published CVSS v4.0 vector for this CVE. A score does not establish whether an individual deployment is exposed.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Explore the calculator for the original PHP2Shell pair →
Primary sources & provenance
Source snapshot: 2026-10-24. Documentary review only; no exploit or infrastructure validation performed. Structured CVE data · All references.
