PHP2Shell: Critical PHP flaws hit mod_php servers hardest

PHP pulled its security release forward to Wednesday, October 21, at 2 p.m. UTC after details of two flaws leaked on Hacker News a day earlier. The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both bugs are in the interpreter itself rather than in a CMS. PHP's advisories for CVE-2026-109618 and CVE-2026-109619 rate each one 9.2 under CVSS 4.0 and confirm unauthenticated remote code execution with the privileges of the web worker.

Out-of-memory handling leaves memory half initialized

The first flaw comes down to how PHP handles out-of-memory errors. On OOM, the interpreter uses longjmp() to leave the current context, even when request memory is only partly initialized at that moment. The shutdown procedure then reads that state as valid. An attacker can force the OOM with a multipart request that stays under post_max_size, for example through an unlimited number of headers per part, empty file fields that don't count against max_file_uploads, or nested field names. The patch replaces longjmp() with a soft OOM at the next VM safe point and a hard _exit() above a second, higher threshold.

The second flaw involves global state that outlives a request. If a fatal error aborts an operation before it resets its state, a global field keeps pointing at freed heap memory. When the next request on the same worker reads that value before normal initialization, the result is a use-after-free. PHP lists two confirmed paths, the fatal_error_backtraces setting in PHP 8.5 and session upload progress, which is enabled by default and doesn't require the application to call session_start().

Why mod_php is the most exposed

Apache with mod_php calls the request shutdown procedure even when request startup has already failed. Running out of memory while PHP parses the request body is enough, and no application code has to run. PHP validated full code execution against mod_php with default memory and input limits. PHP-FPM kills a child whose startup fails, which blocks the direct path. For the second flaw, PHP still confirmed an exploit against a normal FPM pool, although it depends on a suitable operation in the application. Source analysis suggests FrankenPHP behaves like mod_php, while LSAPI is a conditional candidate. The high attack complexity in the CVSS vector reflects that the PHP build and heap layout affect reliability.

Exploit attempts and the role of AI

watchTowr says it is observing active exploitation attempts against both flaws, and Cloudflare told The Hacker News that it saw early attacks before the patch shipped. No successful compromise has been confirmed so far. Dutch government services including DigiD and MijnOverheid still went offline as a precaution, and the UK's NCSC advises taking unpatched systems offline if no other option is available.

Wiz Research found the bugs and reported them on August 24. According to Wiz, Gemini 4 Argon and GPT-5.6 Sol helped with discovery, exploit development and patch validation, especially with tuning the exploit for each target. Wiz also credits OpenAI and Calif with help on discovery and coordination. It fits what Anthropic recently wrote about self-copying AI targeting cheap TV boxes, where models also lower the bar for attacks.

What admins should do now

Updating is the only complete fix. Linux distributions and LTS vendors got the patches in advance and often backport them under older version numbers, so check the changelog for the CVE IDs rather than the version string. The unsupported 7.4, 8.0 and 8.1 branches only get minimal source backports. If you can't update right away, PHP recommends setting memory_limit=-1 administratively, because a predictable per-request limit is what makes the confirmed OOM exploit work. Add session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, then restart every worker. If your application doesn't use multipart forms, block them at the frontend. None of these settings is a complete fix. On shared hosting or a NAS with a web server, check which PHP version your provider ships.