CVE-2026-109618: out-of-memory corruption
PHP's authoritative advisory covering the OOM vulnerability class, affected branches, fixed releases and the limits of configuration workarounds.
PHP security teamSOURCES / ATTRIBUTION & FURTHER READING
References.
Primary advisories, independent research, public PoCs, and infrastructure documentation. Technical guidance is paraphrased here; original findings and credit belong to the linked authors.
How sources are used
The current PHP advisories take precedence over early reports and community README files. Some linked research predates the final release. External publications may contain vendor messaging; inclusion is attribution, not endorsement.
51 references
CVE-2026-109619: stale global state
PHP's authoritative advisory on state surviving across requests, confirmed attack paths and the complete state-reset fix.
PHP security team21 October 2026 security release
Release announcement for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with update instructions and partial mitigation guidance.
PHP projectPHP downloads
Official release downloads and verification information. Distribution users should also check their vendor's security packages and backport notices.
PHP projectSupported PHP branches
Upstream maintenance timelines for active support, security fixes and end of life.
PHP projectPHP 7.4 minimal source backport
Exceptional source backport linked by the PHP security announcement. PHP 7.4 remains end of life; this does not restore normal support.
PHP projectPHP 8.0 minimal source backport
Exceptional source backport linked by the PHP security announcement for maintainers building their own packages. PHP 8.0 remains end of life.
PHP projectPHP 8.1 minimal source backport
Exceptional source backport linked by the PHP security announcement. Check vendor packages or migrate to a supported branch; PHP 8.1 remains end of life.
PHP projectOriginal PHP2Shell disclosure site
Research overview, demonstrations, release matrix and coordinated disclosure references. A source for the technical context summarized on this independent site.
PHP2Shell research collaboratorsPHP2Shell technical research
Original research publication linked by the disclosure site, covering the PHP vulnerability family and exploitation research.
Wiz ResearchPHP2Shell: discovery and technical analysis
Ryan Austin's research into interrupted PHP operations, multipart processing and request lifecycle state, including distinctions between mod_php and FPM.
CalifCoordinated disclosure of critical vulnerabilities
Coordinated disclosure publication linked by the original PHP2Shell site.
OpenAICritical remote code execution vulnerabilities in PHP core
Security research publication linked by the original disclosure site. Consult the publisher for its current detection and mitigation guidance.
AkamaiPHP2Shell vulnerability updates
Provider publication on PHP2Shell linked by the disclosure site, with updates for its customers.
ImpervaPHP vulnerabilities and WAF protection
WAF response publication linked by the disclosure site. Provider rules address particular request patterns and do not replace a runtime update.
CloudflarePHP2Shell detection before disclosure
Detection research publication linked by the original PHP2Shell disclosure site.
CorelightResponse to the PHP RCE vulnerabilities
Provider response publication linked by the original disclosure site. Check the source for current product coverage and investigation guidance.
CrowdStrikeCVE-2026-109618 and CVE-2026-109619 analysis
Security analysis and response publication linked by the original PHP2Shell disclosure site.
Palo Alto Networks Unit 42Early PHP2Shell incident-response guidance
Early disclosure context and examples of suspicious processes launched by PHP workers. Pre-release statements should be checked against the final PHP advisories.
HuntressHistorical context: PHP bug #78876
A 2019 multipart allocation and temporary-file cleanup report, referenced by later research. This is a separate historical issue, CVE-2019-11048.
PHP bug trackerHistorical context: the 2024 PHP security audit
OSTIF's April 2025 account of Quarkslab's 2024 PHP audit. Background research referenced by Calif, separate from the October 2026 advisories.
OSTIF / Quarkslabphp2shell-CVE-2026-109618-CVE-2026-109619-PoC
Community repository containing mitigation examples, helper scripts and research material. Individual snippets are partial controls, not substitutes for the official fix.
enessphp2shell-poc research and lab
Independent lab and verification material for several session-related chains. Requirements differ between examples; repository claims are not independent validation of both CVEs.
Qi Deng / ikowCVE-2026-109618 validation bundle
Community mirror of a session upload-progress research bundle. Its README describes the CVE association as presumed; use it as research material rather than an authoritative advisory.
Zer061 and credited contributorsprocess-watcher
Linux process monitoring for investigating programs launched by services. It cannot detect every PHP2Shell path, including memory disclosure or activity contained within PHP.
Florian Roth / Neo23x0PHP-FPM pool configuration
Official reference for FPM pool directives, administrative PHP settings and worker lifecycle options.
PHP manualApache HTTP Server rewrite rules
Official syntax and context reference for the Apache request-filtering example.
Apache HTTP Server projectnginx HTTP map module
Official reference for mapping request headers to variables used by the nginx mitigation example.
nginxAWS WAF web ACL rule specification
AWS CloudFormation reference for WAF rules, statements, actions, priorities and visibility configuration.
Amazon Web Serviceslighttpd access-control implementation
Upstream mod_access implementation supporting the lighttpd access-denial example. Confirm compatibility with the deployed lighttpd version.
lighttpd projectGoogle Cloud Armor rules language
Official CEL expression reference for matching request attributes in Cloud Armor security policies.
Google CloudCloudflare request-header fields
Rules-language reference for request-header arrays used by the Cloudflare custom-rule example.
Cloudflare Developersnginx HTTP access logging
Official reference for access_log and log_format, including escaping, buffering and conditional logging.
nginxApache HTTP Server request logging
Official reference for CustomLog, LogFormat and fields used to record HTTP request and response metadata.
Apache HTTP Server projectSigma rule specification
Upstream specification for portable detection rules, including log sources, selections, conditions and rule metadata.
SigmaHQCloud Armor request logging
Google Cloud documentation for security-policy request logs, logging configuration and interpreting policy decisions.
Google CloudAWS WAF log fields
AWS reference for WAF log records and the fields used to investigate rule matches and request handling.
Amazon Web ServicesPHP2Shell detections for Zeek and Suricata
Open-source HTTP detections and configuration guidance. Findings identify suspicious traffic or potentially affected software; they do not establish successful exploitation.
CorelightPHP logo color source
Official PHP logo assets used as a color-palette reference. php2shell.io is an independent site and is not affiliated with the PHP project.
PHP projectPHP2Shell remote code execution FAQ
Early disclosure FAQ first published on 20 October 2026. Its pre-release patch and exposure statements should be read alongside the final PHP advisories.
watchTowr IntelSplunk aggregate functions
Official SPL reference for aggregate functions used to summarize events in the sample detection query.
SplunkPHP2Shell lab demonstration and remediation notes
Sam Labbe’s community write-up on a local PHP research lab. Some scope and version statements predate the final advisories; feature activation is not confirmed exploitation.
Sam Labbe / DEV CommunityPHP2Shell local lab and WordPress target
Research scaffold with pinned PHP images, an upload-progress harness and sanitizer build support. The reviewed material demonstrates feature exposure, not a verified end-to-end RCE chain.
slabbdev / Sam LabbePHP session upload progress
Official description of upload-progress behavior and session metadata. The presence of progress entries alone is normal feature behavior and does not demonstrate either vulnerability.
PHP manualCloudflare arrays and transformation syntax
Array unpacking syntax used with lower(), header values and any() in the custom-rule example.
Cloudflare documentationCVSS v4.0 specification
The primary definition of CVSS v4.0 metrics, scoring, severity bands, and nomenclature used by the Overview calculator.
FIRST.Org, Inc.CVSS v4.0 reference calculator and scoring source
Pinned BSD-2-Clause source for the official scoring implementation served locally by this site. The complete FIRST calculator also supports Threat and Environmental metrics.
FIRST.Org, Inc.Log4Shell Hell: anatomy of an exploit outbreak
Narrative inspiration for this site's exploit-anatomy walkthrough. This article concerns Log4Shell and is not evidence for PHP2Shell mechanisms, indicators or exploitation.
Sophos / Sean GallagherPHP 8.5: upstream fix for both PHP2Shell CVEs
Pinned upstream commit 31c0ea7d: allocator failure handling, request-state resets, and regression tests. The commit explicitly fixes CVE-2026-109618 and CVE-2026-109619.
PHP projectPHP allocator: pending OOM and VM interruption
Exact added allocator lines shown in the Overview anatomy, pinned to the PHP 8.5 fixing commit. The surrounding implementation is part of the complete runtime update.
PHP projectPHP executor: clear request-owned error state
Pinned shutdown-reset code shown in the Overview anatomy. It clears the fatal backtrace and related executor globals before they can be reused by a subsequent request.
PHP projectReviewed 21 October 2026. This is a static snapshot; verify current vendor guidance before making changes.