{"id":2139,"date":"2026-10-22T07:19:04","date_gmt":"2026-10-22T00:19:04","guid":{"rendered":"https:\/\/vncybers.vn\/hieu-php2shell-hai-lo-hong-rce-nghiem-trong-php\/"},"modified":"2026-10-22T07:19:04","modified_gmt":"2026-10-22T00:19:04","slug":"understanding-php2shell-critical-php-rce-flaws-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hieu-php2shell-hai-lo-hong-rce-nghiem-trong-php\/","title":{"rendered":"Understanding PHP2Shell: Two Critical PHP RCE Flaws Demand Immediate Updates"},"content":{"rendered":"

PHP has released emergency patches for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and reside in the PHP engine itself, so the risk does not depend on whether an application runs WordPress, Joomla, Drupal, or custom code.<\/p>\n

\"Server
Web servers running PHP must be inventoried and updated urgently. Image: 123net\/Wikimedia Commons, CC BY-SA 3.0<\/figcaption><\/figure>\n

The PHP team confirms that every deployment model serving web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is considered highest for mod_php because a demonstrated exploit allows an unauthenticated request to trigger the flaw before application code begins running.<\/p>\n

What Is PHP2Shell?<\/h2>\n

PHP2Shell is the collective name for two state and memory management flaws that arise when PHP handles a web request that ends abnormally. Rather than originating in a specific plugin or content management system, the flaws reside in a runtime used by millions of websites. This broadens the response scope: administrators must verify the actual PHP version on every server, container, and managed service.<\/p>\n

Both vulnerabilities can lead to code execution with the privileges of the web worker account. That account may not be root, but it is often sufficient to read source code, steal application secrets, access databases with configured privileges, modify website content, or establish a foothold for movement through the infrastructure.<\/p>\n

CVE-2026-109618: Memory Corruption at the Limit<\/h2>\n

CVE-2026-109618 concerns how PHP handles an out-of-memory condition. An out-of-memory error can interrupt initialization while internal request data is only partially complete. Subsequent cleanup may treat invalid data as a valid structure, corrupting memory and opening a path to code execution.<\/p>\n

Crucially, an attacker can influence memory consumption through HTTP input. Because the flaw occurs beneath the application layer, updating CMS code or checking authentication does not remove the root cause.<\/p>\n

CVE-2026-109619: Stale State Outlives Its Memory<\/h2>\n

CVE-2026-109619 is a stale global state flaw. Request-owned state can remain after its underlying memory has been freed. If the same web worker handles another request before the state is reset normally, PHP may use an invalid reference.<\/p>\n

Consequences can include heap use-after-free, memory disclosure, and ultimately remote code execution. The reusable worker model of web servers makes this flaw especially notable: one request can prepare the condition and a later request can complete the exploitation chain.<\/p>\n

Patched Versions and Inventory Scope<\/h2>\n

The safe releases published by the PHP project on October 21, 2026 are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Servers on the corresponding branches must upgrade to at least these versions or install a backported package from their Linux distribution or LTS vendor.<\/p>\n

PHP 8.1 and older are no longer supported by the main project. The PHP team has provided minimal source backports for 7.4, 8.0, and 8.1 as an exceptional measure, but the sustainable path remains migration to a supported branch. PHP 8.2 is also scheduled to reach end of life on December 31, 2026, so organizations using it should plan a further upgrade rather than stopping at the emergency patch.<\/p>\n

Why Is a Web Application Firewall Not a Complete Fix?<\/h2>\n

Some vendors have deployed WAF rules to block known exploit patterns. However, the PHP team emphasizes that no mitigation offers complete protection. HTTP-layer rules can recognize only known manifestations, while the root cause lies in runtime memory management and exploitation paths can change.<\/p>\n

A WAF remains useful as a temporary risk-reduction layer and a telemetry source for hunting suspicious requests. It should not, however, justify delaying a PHP update or returning an unpatched server to the internet.<\/p>\n

Temporary Measures When an Update Is Not Yet Possible<\/h2>\n

For CVE-2026-109618, the official advisory recommends setting memory_limit=-1<\/code> at a layer applications cannot override, while reducing post_max_size<\/code> and limiting request size at the proxy or web server. This removes one controllable out-of-memory path but cannot prevent every allocation failure.<\/p>\n

For CVE-2026-109619, administrators can disable session.upload_progress.enabled<\/code> and restart every worker. On PHP 8.5, disabling fatal_error_backtraces<\/code> also blocks one confirmed path. These settings only reduce the attack surface; patching remains the only complete remedy.<\/p>\n

Priority Response Workflow for Administrators<\/h2>\n
    \n
  1. Inventory:<\/strong> list PHP versions across physical servers, virtual machines, containers, CI\/CD images, standby environments, and third-party managed services.<\/li>\n
  2. Prioritize internet-exposed systems:<\/strong> handle mod_php servers, upload portals, APIs accepting large inputs, and websites storing high-value secrets first.<\/li>\n
  3. Update and restart:<\/strong> install the patched package, restart every worker, and verify the version actually used by the web process, not only the CLI version.<\/li>\n
  4. Hunt for indicators:<\/strong> review unusual requests, out-of-memory errors, worker crashes, strange child processes, new files in web directories, and abnormal outbound connections.<\/li>\n
  5. Rotate secrets when needed:<\/strong> if compromise is evident, isolate the server and replace API keys, database passwords, session tokens, and credentials readable by the web account.<\/li>\n<\/ol>\n

    Defensive Lessons from a Runtime-Layer Flaw<\/h2>\n

    PHP2Shell shows that vulnerability management cannot stop at plugins and application code. Runtimes, web servers, system libraries, and container images are all parts of the attack surface. Asset inventories must record the running version, package source, accountable owner, and available patch window.<\/p>\n

    For CVE-2026-109618 and CVE-2026-109619, the proper sequence is to update immediately, verify that workers loaded the new release, and then assess additional defenses. When a flaw can occur before application code runs, fixing the application or adding a blocking signature cannot replace removing the flaw from PHP.<\/p>\n

    VNCyberS<\/strong> compiled from the PHP Security Team and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    PHP v\u1eeba ph\u00e1t h\u00e0nh c\u00e1c b\u1ea3n v\u00e1 kh\u1ea9n c\u1ea5p cho hai l\u1ed7 h\u1ed5ng th\u1ef1c thi m\u00e3 t\u1eeb xa kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c, CVE-2026-109618 v\u00e0 CVE-2026-109619, \u0111\u01b0\u1ee3c g\u1ecdi chung l\u00e0 PHP2Shell. C\u1ea3 hai \u0111\u1ec1u \u0111\u01b0\u1ee3c ch\u1ea5m 9,2 theo CVSS v4.0 v\u00e0 n\u1eb1m trong ch\u00ednh b\u1ed9 m\u00e1y PHP, v\u00ec v\u1eady r\u1ee7i ro kh\u00f4ng ph\u1ee5 thu\u1ed9c v\u00e0o vi\u1ec7c […]<\/p>\n","protected":false},"author":2,"featured_media":2138,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[997,994,995,996,993,853,36,212],"class_list":["post-2139","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-bao-mat-may-chu","tag-cve-2026-109618","tag-cve-2026-109619","tag-php","tag-php2shell","tag-quan-ly-lo-hong","tag-rce","tag-thuc-thi-ma-tu-xa"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2139"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2139\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2138"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}