DEV Community

Cover image for Auditing PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Pre-Auth RCE Mechanics, SAPI Exposure & Zero-Dependency Fleet Hardening
Aria Technology Group (AriaWave) profile image Andrew Jennings
Andrew Jennings for Aria Technology Group (AriaWave)

Posted on

Auditing PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Pre-Auth RCE Mechanics, SAPI Exposure & Zero-Dependency Fleet Hardening

#cybersecurity #infosec #php #security

On October 20–21, 2026, two critical unauthenticated Remote Code Execution (RCE) vulnerabilities in the PHP runtime—collectively tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2)—were publicly disclosed alongside emergency upstream patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).

Because both vulnerabilities reside in PHP's core request lifecycle and rfc1867 multipart upload handling rather than application-layer code, standard application-level auth checks, CSRF tokens, and routing middleware do not block exploitation. Worse, on persistent worker SAPIs like Apache mod_php, exploitation can trigger before a single line of userland PHP executes.

To give infrastructure, SecOps, and enterprise IT teams an immediate, deterministic way to audit exposure and deploy temporary hardening while patch windows are scheduled, Aria Technology Group (AriaWave) open-sourced the AriaWave PHP2Shell Readiness & Mitigation Scanner (ariawave-php2shell-scanner).

1. Anatomy of PHP2Shell: Why CVE-2026-109618 and CVE-2026-109619 Are Different

Most PHP vulnerabilities live in framework dependencies or unsafe userland primitives (unserialize, eval, template injection). PHP2Shell operates below userland in the C runtime's request startup, multipart upload parsing (main/rfc1867.c), and request shutdown/cleanup paths:

CVE-2026-109618 — Out-of-Memory (OOM) Request Cleanup Corruption (CVSS 9.2)

  • Mechanism: When a PHP worker process hits an Out-of-Memory (OOM) condition during multipart upload or request processing, an uninitialized/corrupted pointer state during request cleanup can be leveraged for arbitrary code execution.
  • The Apache RLimitMEM Amplifier: Environments that enforce OS-level address-space ceilings via Apache's RLimitMEM (RLIMIT_AS / RLIMIT_DATA) or allow large post_max_size payloads make it trivial for an unauthenticated remote attacker to force the worker into the vulnerable OOM cleanup path.
  • Pre-Script Execution on mod_php: Under Apache mod_php, multipart form parsing and memory allocation occur before the target .php script is invoked.

CVE-2026-109619 — Use-After-Free via Stale session.upload_progress State (CVSS 9.2)

  • Mechanism: When session.upload_progress.enabled is active (the upstream default in most distributions), an interrupted or crafted multipart upload can leave stale request-owned pointers in global state (rfc1867 upload progress tracking).
  • Worker Reuse Exploitation: On any persistent worker SAPI (mod_php, php-fpm, FrankenPHP, LiteSpeed), the next request handled by that same worker process can trigger a Use-After-Free (UAF) against the dangling upload progress structure.

2. Patched PHP Release Matrix (Published October 21, 2026)

If your fleet runs any version below the fixed release threshold for its branch, treat it as exposed:

  • PHP 8.5: 8.5.0 – 8.5.11 vulnerable → Upgrade to 8.5.12+
  • PHP 8.4: 8.4.0 – 8.4.26 vulnerable → Upgrade to 8.4.27+
  • PHP 8.3: 8.3.0 – 8.3.35 vulnerable → Upgrade to 8.3.36+
  • PHP 8.2: 8.2.0 – 8.2.34 vulnerable → Upgrade to 8.2.35+
  • PHP <= 8.1 (8.1.x, 8.0.x, 7.4.x): End-of-Life upstream — requires verified OS vendor/LTS security backports (Debian/Ubuntu/RHEL/CloudLinux/cPanel EasyApache 4).

3. Hidden Configuration Traps That Silently Undo Global Mitigations

During incident response across multi-tenant servers, containerized microservices, and cPanel/EasyApache 4 fleets, simply dropping a setting into /etc/php.ini often fails for three reasons:

  1. Lexicographical php.d Load Order: An earlier .ini file in conf.d/ or php.d/ can be overridden by a later file loaded alphabetically after it.
  2. Per-Directory .htaccess & .user.ini Overrides: A single php_flag session.upload_progress.enabled On or php_value post_max_size 256M inside a tenant's .htaccess or .user.ini re-opens the attack surface on that route.
  3. PHP 8.5 fatal_error_backtraces Information Leak: On PHP 8.5 runtimes, leaving fatal_error_backtraces = On during OOM/crash probing leaks heap and call-frame telemetry back to the caller.

4. Automated Auditing with ariawave-php2shell-scanner

We built ariawave-php2shell-scanner as a single-file, zero-dependency Python 3.10+ CLI tool and autonomous agent skill (SKILL.md) so defenders can run it immediately on air-gapped production hosts, CI/CD runners, and container images without installing third-party packages.

Strictly Defensive by Design: The scanner performs zero active exploitation and sends no malicious payloads. It inspects local runtimes, Dockerfiles, Apache/FPM/INI trees, and (optionally) passive HTTP response headers on authorized endpoints.

Quickstart Commands 

# Clone the zero-dependency scanner
git clone https://github.com/AIjennings/ariawave-php2shell-scanner.git
cd ariawave-php2shell-scanner

# 1. Run the built-in 7-check deterministic self-test suite
python scripts/php2shell_scanner.py --selftest

# 2. Audit a specific PHP version string
python scripts/php2shell_scanner.py --version "8.4.26"

# 3. Scan an entire server config tree (/etc/php, /etc/apache2, /var/www) or repo
python scripts/php2shell_scanner.py --scan-dir /etc/php

# 4. Generate the lexicographically-last temporary php.d drop-in mitigation
python scripts/php2shell_scanner.py --emit-dropin --post-max 32M > /etc/php.d/zzzzzzzz-cve-2026-109618-109619.ini
Enter fullscreen mode Exit fullscreen mode

5. Immediate Defense-in-Depth Playbook (While Scheduling Patch Windows)

Until every runtime is upgraded to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and all worker pools are restarted, apply these four mitigations immediately:

  1. Deploy the zzzzzzzz-cve-2026-109618-109619.ini Drop-In: Prefixing with zzzzzzzz- guarantees the hardening rules load last in php.d/: 
   ; Temporary mitigation for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell)
   ; Generated by AriaWave PHP2Shell Readiness Scanner (https://ariawave.tech)
   session.upload_progress.enabled = 0
   post_max_size = 32M
   upload_max_filesize = 32M
   fatal_error_backtraces = 0
Enter fullscreen mode Exit fullscreen mode
  1. Eliminate Apache RLimitMEM: Remove RLimitMEM directives from Apache virtual hosts and global configs so OS-level RLIMIT_AS / RLIMIT_DATA constraints do not force PHP workers into the vulnerable OOM cleanup code path.
  2. Migrate Off mod_php: Transition legacy Apache mod_php (LoadModule php_module) deployments to isolated php-fpm worker pools with bounded pm.max_requests.
  3. Enforce Edge WAF Request Body Limits: Cap multipart request body sizes at your reverse proxy, SASE edge, or cloud WAF before traffic reaches origin PHP workers.

Resources & Official Advisories

Authored by **Andrew Jennings* — Founder & Principal Systems Engineer at Aria Technology Group (AriaWave) (andrew@aria.net) and Senior Technology Advisor at Utel USA (ajennings@utelusa.com · 313-232-0138). Need an enterprise SASE/WAF edge audit, multi-carrier redundancy review, or autonomous security toolchain deployment? Connect on LinkedIn or visit ariawave.tech.*

Top comments (0)