CVE-2026-109619: Remote Code Execution in PHP Core via Stale Global State Memory Corruption (PHP2Shell)

Vulnerability ID: CVE-2026-109619
CVSS Score: 9.2
Published: 2026-10-21

CVE-2026-109619 (PHP2Shell) is a critical Use-After-Free vulnerability in the core PHP engine caused by improper global state cleanup during out-of-memory exception handling across persistent worker requests.

TL;DR

Unauthenticated remote code execution vulnerability in persistent PHP worker processes caused by stale global pointers retained after out-of-memory longjmp bailouts.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-416
• Attack Vector: Network
• CVSS v4.0: 9.2 (Critical)
• EPSS Score: 5.76% (93.05th percentile)
• Impact: Remote Code Execution
• Exploit Status: Proof of Concept Available
• KEV Status: Not Listed

Affected Systems

• PHP-FPM worker pools
• Apache mod_php web server modules
• Persistent PHP CGI / FastCGI worker processes
• PHP: 8.2.0 - 8.2.34 (Fixed in: 8.2.35)
• PHP: 8.3.0 - 8.3.35 (Fixed in: 8.3.36)
• PHP: 8.4.0 - 8.4.26 (Fixed in: 8.4.27)
• PHP: 8.5.0 - 8.5.11 (Fixed in: 8.5.12)

Code Analysis

Commit: 31c0ea7

Fix stale global state retention during bailout exception handling and implement fallible allocations.

Exploit Details

• GitHub (eness): Proof of concept exploit script for CVE-2026-109618 and CVE-2026-109619
• GitHub (ikow): Proof of concept demonstration repository
• GitHub (Assetnote): Scanner tool for detecting vulnerable PHP deployments

Mitigation Strategies

• Upgrade PHP engine to a fixed release version immediately
• Enforce maximum request body size limits in web server frontends
• Disable session upload progress tracking if not required
• Configure aggressive worker process recycling limits in PHP-FPM

Remediation Steps:

1. Identify all deployed PHP instances using package managers or runtime version checks
2. Update PHP 8.2 environments to version 8.2.35 or higher
3. Update PHP 8.3 environments to version 8.3.36 or higher
4. Update PHP 8.4 environments to version 8.4.27 or higher
5. Update PHP 8.5 environments to version 8.5.12 or higher
6. Restart PHP-FPM worker pools and web server daemons to load patched runtimes

References

• PHP Security Advisory GHSA-6wmf-4rv5-p3rp
• PHP Security Advisory GHSA-w8hw-w9fx-j79w
• PHP Release Announcement 2026-10-21
• Official Security Patch Commit
• Wiz Blog Analysis: PHP2Shell
• Wiz Vulnerability Database Entry
• OSS-Security Discussion 2026/10/21/16
• OSS-Security Discussion 2026/10/21/17
• OSS-Security Discussion 2026/10/21/23
• OSS-Security Discussion 2026/10/21/7
• OSS-Security Discussion 2026/10/22/14
• OSS-Security Discussion 2026/10/22/15
• OSS-Security Discussion 2026/10/22/16
• OSS-Security Discussion 2026/10/22/19
• OSS-Security Discussion 2026/10/22/2
• OSS-Security Discussion 2026/10/22/20
• Public PoC Repository - eness
• Public PoC Repository - ikow
• PHP2Shell Scanner Tool

Read the full report for CVE-2026-109619 on our website for more details including interactive diagrams and full exploit analysis.