[
  {
    "group": "Original PHP2Shell disclosure",
    "published_on": "2026-10-21",
    "reviewed_on": "2026-10-24",
    "score": "9.2",
    "score_label": "Critical · CVSS v4.0",
    "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
    "status": "Patch available",
    "fixed_releases": [
      {
        "branch": "8.2",
        "fixed": "8.2.35"
      },
      {
        "branch": "8.3",
        "fixed": "8.3.36"
      },
      {
        "branch": "8.4",
        "fixed": "8.4.27"
      },
      {
        "branch": "8.5",
        "fixed": "8.5.12"
      }
    ],
    "affected_summary": "Update PHP deployments that serve untrusted web requests. Supported branches below the first fixed releases need an update or a vendor-confirmed complete backport. End-of-life branches require separate vendor review and a migration plan.",
    "patch_notes": [
      "Install a fixed build from a trusted package or image source. Vendor backports can retain older version numbers; verify the exact package advisory.",
      "Restart or replace every serving worker and container. A patched executable on disk does not prove an existing process has loaded it.",
      "PHP 8.1 and older are end of life. Exceptional source backports do not restore regular upstream support."
    ],
    "verification": [
      "Inventory the actual web SAPI, package or image digest, FPM pools, Apache modules, containers and replicas. CLI PHP may be a different installation.",
      "Check package provenance and live runtime version against the advisory, then verify worker replacement.",
      "An HTTP status, a crash, ordinary upload-progress metadata or a failed public PoC is not a universal vulnerability verdict."
    ],
    "sources": [
      {
        "label": "PHP critical security release, 21 October",
        "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
      },
      {
        "label": "PHP upstream OOM advisory",
        "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
      },
      {
        "label": "Upstream runtime fix, PHP 8.5",
        "url": "https://github.com/php/php-src/commit/31c0ea7d7ff1d1fccb6492e52dab544011628065"
      }
    ],
    "id": "CVE-2026-109618",
    "title": "RCE via out-of-memory corruption",
    "summary": "Interrupted allocation can leave PHP request state incomplete. Later cleanup may treat invalid state as valid, allowing memory corruption and remote code execution.",
    "preconditions": [
      "An affected PHP runtime processes attacker-controlled input through a reachable request path.",
      "The demonstrated pre-application route uses Apache mod_php and an out-of-memory failure. PHP-FPM susceptibility is based on source analysis in the advisory; it did not demonstrate a complete FPM exploit.",
      "A dedicated application upload page is not required for every path. Disabling file uploads does not repair the runtime defect."
    ],
    "mechanism": [
      "PHP can abandon an operation when an allocation fails, before its internal structures are fully initialized. Shutdown and error handling can then encounter the unfinished state.",
      "The upstream fix changes allocation-failure handling and affected callers. Raising a memory limit or filtering one request pattern does not reproduce that complete repair."
    ],
    "anatomy_anchor": "anatomy-oom",
    "mitigation_notes": [
      "Request-size and complexity limits reduce selected triggers but do not close all paths. Place availability boundaries around workers.",
      "The PHP guidance includes removing PHP’s finite memory cap only with appropriate external resource boundaries; an underlying allocation failure can still reach the vulnerable path. Read the full compensating-controls explanation before changing it."
    ],
    "mitigation_snippets": [],
    "monitoring": [
      "Correlate memory-limit failures, worker crashes and unusual request structure by backend, time and process.",
      "Investigate unexpected child processes, network connections or file changes; memory disclosure can occur without a shell process."
    ],
    "poc_ids": [
      "eness",
      "ikow",
      "zer061",
      "slabb",
      "ninebie",
      "jf0x3f",
      "xuehuolll",
      "dinosn-screening"
    ]
  },
  {
    "group": "Original PHP2Shell disclosure",
    "published_on": "2026-10-21",
    "reviewed_on": "2026-10-24",
    "score": "9.2",
    "score_label": "Critical · CVSS v4.0",
    "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
    "status": "Patch available",
    "fixed_releases": [
      {
        "branch": "8.2",
        "fixed": "8.2.35"
      },
      {
        "branch": "8.3",
        "fixed": "8.3.36"
      },
      {
        "branch": "8.4",
        "fixed": "8.4.27"
      },
      {
        "branch": "8.5",
        "fixed": "8.5.12"
      }
    ],
    "affected_summary": "Update PHP deployments that serve untrusted web requests. Supported branches below the first fixed releases need an update or a vendor-confirmed complete backport. End-of-life branches require separate vendor review and a migration plan.",
    "patch_notes": [
      "Install a fixed build from a trusted package or image source. Vendor backports can retain older version numbers; verify the exact package advisory.",
      "Restart or replace every serving worker and container. A patched executable on disk does not prove an existing process has loaded it.",
      "PHP 8.1 and older are end of life. Exceptional source backports do not restore regular upstream support."
    ],
    "verification": [
      "Inventory the actual web SAPI, package or image digest, FPM pools, Apache modules, containers and replicas. CLI PHP may be a different installation.",
      "Check package provenance and live runtime version against the advisory, then verify worker replacement.",
      "An HTTP status, a crash, ordinary upload-progress metadata or a failed public PoC is not a universal vulnerability verdict."
    ],
    "sources": [
      {
        "label": "PHP critical security release, 21 October",
        "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
      },
      {
        "label": "PHP upstream stale-state advisory",
        "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
      },
      {
        "label": "Upstream runtime fix, PHP 8.5",
        "url": "https://github.com/php/php-src/commit/31c0ea7d7ff1d1fccb6492e52dab544011628065"
      }
    ],
    "id": "CVE-2026-109619",
    "title": "RCE via stale global state",
    "summary": "Request-owned state can outlive its freed backing memory. A later request in the same worker can encounter stale references before normal initialization resets them.",
    "preconditions": [
      "An affected long-lived PHP worker handles the relevant producer and consumer request sequence.",
      "The validated FPM session path requires application-side session activity after successful startup, a fatal error, and a later early upload-progress request in the same worker. FPM kills a child after failed startup, which changes the path compared with mod_php.",
      "The flaw includes more than session upload progress. PHP 8.5 has a confirmed fatal-backtrace path; one disabled feature does not cover every variant."
    ],
    "mechanism": [
      "Request shutdown can free memory without clearing every global reference to it. Another request may use that reference during early processing.",
      "The patch resets state at safe lifecycle boundaries and changes affected session and extension handling. The selected executor diff on the Overview page is only one part of the fix."
    ],
    "anatomy_anchor": "anatomy-state",
    "mitigation_notes": [
      "Disabling upload progress before request parsing blocks the confirmed session routes. It does not repair the broader stale-state vulnerability.",
      "For PHP 8.5, disabling fatal_error_backtraces covers the confirmed fatal-backtrace route only. Restart every worker.",
      "Do not rely on runtime ini_set() or FPM .user.ini for a control that must apply before multipart parsing."
    ],
    "mitigation_snippets": [
      {
        "label": "PHP configuration / confirmed paths only",
        "code": "; Set in the serving runtime configuration, before request parsing.\nsession.upload_progress.enabled = Off\n\n; PHP 8.5 only: covers the confirmed fatal-backtrace path.\nfatal_error_backtraces = Off"
      }
    ],
    "monitoring": [
      "Correlate unusual multipart requests, fatal errors, execution timeouts and worker reuse.",
      "Malformed session cookies or session-decode errors warrant investigation but are not conclusive signatures."
    ],
    "poc_ids": [
      "ikow",
      "zer061",
      "slabb",
      "ninebie",
      "jf0x3f",
      "xuehuolll"
    ]
  },
  {
    "id": "CVE-2026-115560",
    "title": "Session upload-progress serializer mismatch",
    "summary": "A separate session upload-progress issue can create an RCE path when the configured session serializer is changed at runtime. It is not covered by the original PHP2Shell fixes.",
    "group": "23 October follow-up",
    "published_on": "2026-10-23",
    "reviewed_on": "2026-10-24",
    "score": "Pending",
    "score_label": "PHP has not published a CVSS score",
    "vector": null,
    "status": "Mitigation advised · full advisory pending",
    "fixed_releases": [],
    "affected_summary": "PHP’s 23 October notice does not give a complete affected-version range or a fixed release. The original PHP2Shell release numbers must not be used as a clearance test for this separate issue.",
    "preconditions": [
      "The configured session.serialize_handler is php_binary or php_serialize.",
      "Application code uses ini_set() to switch the handler to php before session_start().",
      "session.upload_progress.enabled remains enabled."
    ],
    "mechanism": [
      "Upload-progress tracking uses session serialization before application handling. Changing the serializer for a later read can interpret that stored data differently. A source-reviewed community repository supplies an object-injection lab with a deliberately added gadget; reproduction is reported by its author.",
      "The PHP notice describes an unusual configuration-and-code combination. Applications that never change the serializer at runtime do not meet that described path. The public lab’s command-execution gadget is not evidence that every application has an equivalent chain."
    ],
    "patch_notes": [
      "The reviewed PHP notice schedules the fix and full advisory for the next regular release. No fixed release is identified in that notice as of 24 October.",
      "Keep the original PHP2Shell patches installed. They address CVE-2026-109618 and CVE-2026-109619, not this separate condition."
    ],
    "mitigation_notes": [
      "PHP recommends disabling session upload progress while awaiting the regular fix. Keep it disabled if already applied.",
      "Apply the setting in the web runtime configuration before request parsing, then replace or restart every affected worker. Do not rely on application ini_set() for this directive.",
      "This setting addresses the stated session-progress path for CVE-2026-115560. It remains only a partial control for the original PHP2Shell memory-corruption issues."
    ],
    "mitigation_snippets": [
      {
        "label": "PHP configuration / CVE-2026-115560 mitigation",
        "code": "; Apply in php.ini or the serving SAPI configuration.\n; Restart or replace all PHP workers afterward.\nsession.upload_progress.enabled = 0"
      }
    ],
    "verification": [
      "Read the effective web-runtime serializer and upload-progress settings; CLI configuration alone is insufficient.",
      "Review application and dependency code for runtime changes to session.serialize_handler before session_start(). A text search locates candidates; it cannot prove execution order or absence of dynamic changes.",
      "Check all three prerequisites together. The published scenario does not require an application-facing upload form; inspect what the PHP runtime actually parses.",
      "Confirm the disabled setting on every serving instance. Follow PHP’s next advisory for the eventual fixed-version matrix."
    ],
    "monitoring": [
      "Investigate unexpected concurrent upload/session traffic and session-decode warnings in the same application context.",
      "A session decoding warning can also have benign causes. Pair it with the runtime settings, application code, request logs and host evidence."
    ],
    "sources": [
      {
        "label": "PHP informational advisory, 23 October",
        "url": "https://www.php.net/archive/2026.php#2026-10-23-1"
      },
      {
        "label": "PHP session configuration reference",
        "url": "https://www.php.net/manual/en/session.configuration.php"
      },
      {
        "label": "PHP upload-progress behavior",
        "url": "https://www.php.net/manual/en/session.upload-progress.php"
      },
      {
        "label": "Community reproduction and gadget limitations",
        "url": "https://github.com/googlesky/CVE-2026-115560"
      }
    ],
    "poc_ids": [
      "googlesky-115560"
    ]
  }
]