1. Executive Summary & Impact
On 21 October 2026, the official PHP project released security updates addressing two critical vulnerabilities tracked under the common industry name PHP2Shell:
Out-of-Memory Handling & Partially Initialized Request State
Flaw in out-of-memory handling and partially initialized request state during request parsing. In affected configurations, an allocation failure during request intake leaves request structures in an inconsistent state, leading to memory corruption and potential unauthenticated code execution.
Authority: php.net/archive/2026.php →Stale Request-Owned Global State After Backing Memory Free
Memory safety vulnerability involving stale request-owned global state after backing memory is freed during stream boundary or request termination, enabling heap use-after-free corruption and process execution under affected SAPI configurations.
Authority: php.net/archive/2026.php →2. Affected Web-Serving Environments
Exploitability does not affect all PHP installations equally. Exposure is contingent on how the web server communicates with the PHP engine and how request streams are buffered:
-
•
Apache mod_php: High direct exposure due to shared in-process execution without SAPI process boundary isolation.
-
•
PHP-FPM (Nginx / Apache FastCGI): Risk depends on fastcgi parameter buffering, socket timeout configuration, and worker memory allocation limits.
-
•
php-cgi / Legacy Wrappers: Exposed when query string or header arguments are interpreted by the CGI binary wrapper.
-
•
LiteSpeed & FrankenPHP: Require verification of embedded libphp runtime versions and LSAPI handler patches.
3. Minimum Fixed Versions Matrix
To remediate CVE-2026-109618 and CVE-2026-109619, your PHP runtime must be at or above the following minimum fixed releases:
| Branch | Status | Minimum Fixed Version | Action Required |
|---|---|---|---|
| PHP 8.5 | Active Support | ≥ 8.5.12 | Apply standard update package. |
| PHP 8.4 | Active Support | ≥ 8.4.27 | Apply standard update package. |
| PHP 8.3 | Security-Only | ≥ 8.3.36 | Update immediately; schedule 8.4 roadmap. |
| PHP 8.2 | Reaches EOL End 2026 | ≥ 8.2.35 | Apply emergency patch; plan active migration. |
| PHP 8.1 & Older | End of Life (EOL) | No Upstream Fix | Verify OS vendor backport (RHEL/Ubuntu ESM) or urgent migration. |
4. Step-by-Step Remediation Checklist
php -v from the CLI, but also verify the web SAPI version by inspecting response headers or a protected diagnostic file. FastCGI pool processes may run a different binary than the CLI.
rpm -q --changelog php | grep CVE-2026-109618 or equivalent apt changelog.
systemctl restart php-fpm.
Critical Engineering Caveats
- A WAF is not a complete mitigation: Web application firewalls can block known signatures, but payload obfuscation and stream chunking can bypass heuristics. Patching the runtime is mandatory.
- Remote scans cannot determine PHP version reliably: Header suppression (e.g.
expose_php = Off) hides version strings from unauthenticated remote scanners. True verification requires authorized server access. - No exploit steps published: In accordance with responsible disclosure, adronSoft does not publish proof-of-concept exploit code or weaponized attack steps.
Official Upstream References & Citations
Need Expert Assistance Upgrading Your Servers?
Our senior PHP infrastructure team provides rapid audit, staging verification, and structured maintenance patching for clients worldwide.