---
title: "Security Advisory: PHP2Shell – PHP Core Remote Code Execution Vulnerabilities (CVE-2026-109618, CVE-2026-109619)"
url: "https://docs.indusface.com/en/article/php2shell-critical-php-rce-cve-2026-109618-cve-2026-109619"
language: "en"
last_updated: "2026-10-21T18:14:44.544Z"
---

# Security Advisory: PHP2Shell – PHP Core Remote Code Execution Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

### **Disclaimer**

This security advisory is shared with all Indusface customers for general awareness. It does not constitute a confirmation of risk to your specific application, environment, or deployment architecture.

Threat conditions, exploitability, and impact may vary based on application design, exposure, and configuration. Customers are advised to continue monitoring Indusface Security Bulletins and blogs for the latest updates on detections, mitigations, and coverage.

CVE-2026-109618 and CVE-2026-109619 (together known as PHP2Shell) are critical remote code execution vulnerabilities identified in the PHP core interpreter.

### **Summary**

**Vulnerability Type:** Remote Code Execution (memory corruption / use-after-free)

**Attack Vector:** Remote / Network, Unauthenticated

**Impact:** Arbitrary code execution and memory disclosure on the web server

**Affected Component:** PHP core runtime (request handling after out-of-memory and fatal errors); affects PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed deployments

### **Description**

PHP2Shell consists of two related flaws in how the PHP runtime manages request state after an error. CVE-2026-109618 affects out-of-memory handling: if PHP runs out of memory while it sets up request data, that data can be left partially initialised, and request cleanup may then treat it as valid. CVE-2026-109619 occurs because PHP can retain request-specific state after the memory behind it has been freed. In both cases, a remote, unauthenticated attacker may be able to trigger the condition through crafted web requests and achieve code execution or memory disclosure. PHP rates both vulnerabilities CVSS v4.0 9.2 (Critical) and advises that updating is the only safe choice.

#### **Affected / Vulnerable Versions**

The following versions are reported as vulnerable based on currently available vendor and community disclosures:

**PHP (core interpreter)**

**Vulnerable: all releases before PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12**

**End-of-life branches (PHP 5.x, 7.x, 8.0 and 8.1): affected, no fix will be released**

**Fixed: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 October 2026)**

Please refer to the official vendor advisory for authoritative and continuously updated information:

[**https://www.php.net/ChangeLog-8.php**](https://www.php.net/ChangeLog-8.php) **(PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp)**

#### **Exploitation Status**

Public Disclosure: Yes

Known Proof-of-Concept (PoC): Limited

Observed In-The-Wild Attacks: Yes

### **Indusface Coverage Status**

The vulnerable functionality is reachable from the internet.

#### **WAF / WAAP Coverage**

Indusface has validated protection against currently known exploit patterns associated with this vulnerability. Relevant detection and mitigation rules are enabled by default for customers operating in Block Mode. Additional hardening and rule enhancements will be released as applicable.

**Note:** WAF-based protection significantly reduces risk but cannot guarantee complete mitigation for all exploitation techniques, especially for zero-day or application-logic-specific attack paths.

#### **Scanner Coverage**

At present, the Indusface automated vulnerability scanner does not actively detect this specific vulnerability. Scanner detection support is under development and will be announced via the Indusface Security Bulletin once available.

**Platform Impact**

Indusface infrastructure and managed security services are not directly impacted by this vulnerability.

**Indusface Recommendation**

Indusface recommends the following actions to reduce risk:

**Immediate Actions Related to AppTrana**

-   Ensure all internet-facing applications are protected by Indusface WAF in Block Mode
-   Enable Origin Protection to prevent direct access to application servers

**Vendor Suggested Actions & Best Practices**

-   Review your application stack to identify usage of affected frameworks or components
-   Apply vendor-recommended mitigations or configuration workarounds, if available
-   **Patch or upgrade** to fixed versions as advised by the vendor
-   Follow secure deployment practices for server-side rendering and dynamic components
-   Periodically review exposed application endpoints and attack surface

**Additional Notes**

-   Zero-day vulnerabilities may evolve rapidly as new exploit techniques emerge.
-   Indusface Signature Labs continues to monitor threat intelligence feeds, exploit activity, and vendor disclosures to enhance protections as required.

For further assistance or clarification, please contact Indusface Support @ [support@indusface.com](mailto:support@indusface.com) or your Customer Success/Account Manager.