Diff — The Elephant's Glass Jaw: Architecture and Fallout of the PHP2Shell RCE Collapse

{{infobox

| event = Disclosure of two critical PHP RCE vulnerabilities

| CVEs = CVE-2026-109618 · CVE-2026-109619

| CVSS = 9.2 (v4.0), each — Critical

| disclosed = 21 October 2026

| fixed_in = 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 (source backports for 7.4, 8.0, 8.1)

| discovered_by = Wiz Research, with LLM-assisted exploit development

| impact = Unauthenticated RCE; cross-request memory disclosure

}}

{{date|2026-10-21}}

**PHP2Shell** is the collective name for two critical remote-code-execution vulnerabilities in the PHP engine — **CVE-2026-109618** (out-of-memory corruption) and **CVE-2026-109619** (stale global state / use-after-free) — disclosed and patched on 21 October 2026. Both carry a CVSS v4.0 score of 9.2, both permit unauthenticated remote code execution, and both live in code that every PHP web request touches: memory management and fatal-error handling.[[cite: PHP Foundation, ["Today's PHP Security Release, and How We're Strengthening PHP Security"](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), 21 October 2026]][[cite: CISA, ["Critical Vulnerabilities in PHP Require Immediate Patching"](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), 21 October 2026]]

# What happened

Public exploit code appeared the same day — repositories demonstrating multiple attack chains against mod_php and PHP-FPM, including a pre-authentication RCE against Apache's mod_php using a single multipart POST.[[cite: [php2shell public proof-of-concept repository](https://github.com/ikow/php2shell-poc), released 21 October 2026]] At the time of the CISA alert, no in-the-wild exploitation had been confirmed, but public working code against 70% of the web is not a situation that stays quiet.

# Thirty-one years of PHP

To understand how the web's most-deployed runtime ended up here, you have to look at what PHP is built out of.

Rasmus Lerdorf wrote the first version in 1994–95 as a set of C programs for his personal home page — *PHP/FI*, the "Personal Home Page / Forms Interpreter," released publicly in June 1995. It was CGI in the literal sense: a C binary the web server invoked fresh for each request. Andi Gutmans and Zeev Suraski rewrote it into PHP 3 (1998) and then built the **Zend Engine** that has powered every release since — Zend Engine 1 in PHP 4 (2000), Zend Engine 2 in PHP 5 (2004), Zend Engine 3 in PHP 7 (2015). PHP 8.0 (2020) added a JIT; 8.4 and 8.5 continued the line.[[cite: [PHP: History of PHP and related projects](https://www.php.net/manual/en/history.php.php)]]

The engine has always been C. Hundreds of thousands of lines of reference-counted `zval` structures, hand-maintained `HashTable` buckets, per-request memory arenas managed by the Zend Memory Manager — and, at the center of today's CVEs, `zend_bailout`: a `setjmp`/`longjmp` pair that PHP uses to abandon a request on fatal error, including memory-limit exhaustion.

Two performance decisions made three decades ago define the blast radius today:

- **Persistent workers.** PHP abandoned the CGI model — one fresh process per request, total isolation — because it was too slow. mod_php embeds the interpreter inside Apache; PHP-FPM keeps workers alive across hundreds of requests. That is exactly what makes a cross-request use-after-free possible: there has to be a *next* request on the same worker for the stale state to poison.[[cite: Datadog Security Labs, [CVE-2026-109619 mechanics](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

- **Shared engine globals.** The engine tracks per-request and per-process state through macro-globals — `EG()` (executor globals), `BG()` (basic globals) — which the public exploit chains corrupt to reach function pointers like `zif_system`.[[cite: [php2shell PoC — attack chain documentation](https://github.com/ikow/php2shell-poc)]]

This is not PHP's first engine-level escape. In June 2024, CVE-2024-4577 — an argument-injection flaw in PHP-CGI on Windows — was exploited in the wild within days of disclosure, including by ransomware operators. The pattern recurs because the architecture that produces it hasn't changed: a C codebase with manual memory discipline, non-local error handling, and a process model that reuses workers indefinitely.[[cite: [CVE-2024-4577 — PHP-CGI argument injection](https://www.tenable.com/cve/CVE-2024-4577)]]

# Anatomy of the two flaws

Both CVEs are the *same shape of bug*: a fatal error interrupts PHP mid-operation, and the engine later treats the incomplete state as valid. They differ in where the interrupted operation happens.

## CVE-2026-109618 — the out-of-memory corruption

PHP turns a form submission into `$_POST` by inserting each field into a `HashTable`. In the vulnerable versions, the insertion helper `_zend_hash_str_add_or_update_i()` ran its steps in a fatal order — incrementing the table's bucket counters *before* allocating the key:

```c

idx = ht->nNumUsed++;

ht->nNumOfElements++;

p = ht->arData + idx;

p->key = key = zend_string_init(str, len, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);

```

If that `zend_string_init` allocation pushes the request over `memory_limit`, PHP raises a fatal error and `zend_bailout`'s `longjmp()` abandons the request — leaving the counters already advanced over a bucket whose key and value were never initialized.[[cite: Datadog Security Labs, [exploitation walkthrough, stage 1](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

The request is dead, but the engine still has to *clean it up*. When request shutdown destroys the array, it walks every counted bucket — including the phantom — and interprets whatever stale heap bytes it finds there as a PHP value. Datadog demonstrated the full chain: an attacker times the allocation failure, sprays the heap so the unfinished bucket lands on controlled data, and the cleanup routine calls a fabricated destructor pointer — `pDestructor` overwritten to reach `zif_system` — executing a command as the web worker.[[cite: Datadog Security Labs, [stages 2–3: heap spray to function pointer](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

On Apache with mod_php the OOM trigger is reliable with default settings — an unauthenticated request, no application bug required. On PHP-FPM, RCE was confirmed through application-level code paths. The same bugs also yield unauthenticated **memory disclosure** — reading passwords, session tokens, API keys, and certificates out of the worker's heap, including credentials belonging to *other requests*. A PHPSESSID-based technique supplies the memory addresses needed to defeat ASLR.[[cite: PHP Foundation, [security release post](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)]][[cite: Datadog Security Labs, [memory disclosure and PHPSESSID technique](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

## CVE-2026-109619 — the stale global state

The second flaw crosses the request boundary. A fatal error mid-request can leave module-level global pointers — engine state expected to be per-process — still aimed at per-request heap that request shutdown has already freed. The next request handled by the same PHP-FPM worker touches those stale references before normal initialization resets them: a textbook use-after-free, unauthenticated, carrying over from one anonymous visitor to the next.[[cite: NCSC, [vulnerability descriptions](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)]][[cite: Datadog Security Labs, [stale-state mechanics](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

Wiz grouped four exploitable bug instances under the two CVEs: an upload-progress unserializer use-after-free and a remote memory-disclosure under 109618; a fatal-error backtrace use-after-free and an OPcache type-confusion under 109619. Demonstrated results: pre-authentication RCE on current WordPress, Drupal, and Joomla container images, plus application-agnostic remote memory read. Wiz also noted there are *other tracked and likely untracked variants* of the pattern in the codebase — the patch addresses the root mechanism, not just the four instances.[[cite: Wiz Research, [vulnerability table and variant note](https://www.wiz.io/blog/php2shell-php-rce)]]

A note on exploitability, because precision matters: these are not point-and-shoot bugs. The OOM chain requires the attacker to calibrate request size against the target's `memory_limit`, keep the worker alive through the failed request, and defeat ASLR with a memory-disclosure step — the PHPSESSID technique — before the destructor call lands. Datadog documented each requirement separately, and the public PoC's own documentation is frank that the remote chain is version- and configuration-specific. "Exploitable" and "automatically exploitable everywhere" are different claims; the first is proven, the second is not — which is the difference between "patch today" and "the web is already down."[[cite: Datadog Security Labs, [exploit requirements and limitations](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]][[cite: [php2shell PoC — universal? no](https://github.com/ikow/php2shell-poc)]]

# Why this was allowed to exist

The architectural critique writes itself once you list the preconditions. Every element of the bug is a design decision:

**`longjmp()` across initialization boundaries.** C's non-local jump abandons a stack mid-construction. Everything between "operation started" and "operation complete" — half-incremented counters, half-copied strings, half-built structures — is left exactly where the jump found it, for the cleanup path to trip over. PHP uses this mechanism for every fatal error and every OOM event in every request.

**Count-before-allocate ordering.** The `nNumUsed++` before `zend_string_init` is a two-line ordering bug that survived fourteen years of code review because the failure mode it creates is invisible until you make allocation fail *at that line* — which is precisely what an attacker controlling request size can arrange on demand.

**Destructor chains over partially-initialized state.** Cleanup iterates counted buckets and trusts the count. The count is a claim about memory that was never allocated. The destructor call that follows is the RCE.

**The persistent-worker boundary.** A per-request heap living inside a process that outlives the request is the shared-state boundary both CVEs cross. In 1995, PHP ran one process per request and this bug class *could not exist* — there was no "next request" to inherit stale state, and a corrupted worker died with the request that corrupted it. Every performance optimization since has widened exactly that boundary.

**The pre-authentication parser.** `session.upload_progress` executes during RFC 1867 body parsing — before the application, before authentication, before any defensive code a developer might write. Application-level security cannot reach the vulnerable path; Datadog confirmed this independently.[[cite: Datadog Security Labs, ["application-level authentication can't block an attack"](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

# The AI inflection point

The honest reading of October 21 is not "PHP got unlucky." It is that the economic model of vulnerability research inverted, on a codebase whose defense was partly *that nobody could afford to attack it this way*.

# Could it have been avoided?

Three honest answers, at three different levels.

**At the code level — yes, trivially.** Swap two lines: allocate the key, *then* count the bucket. The 109618 variant dies. Initialize-on-failure or explicit "dirty bucket" flags kill the cleanup path. These are the kinds of bugs a rigorous static-analysis or bounded-model check flags mechanically — which is why the 2024 QuarksLab audit and today's strengthened pipeline matter more than any single patch.[[cite: PHP Foundation, [post-release strengthening measures](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)]]

**At the language level — structurally.** Both CVEs are use-after-free / uninitialized-read patterns (CWE-416 family). In Rust, the borrow checker rejects the code shapes at compile time; in Ada/SPARK, access-type discipline plus proof obligations eliminate the dangling-reference class; in any managed runtime with a GC, the "freed memory reinterpreted as live object" primitive simply isn't available to an attacker. You cannot write `_zend_hash_str_add_or_update_i`'s bug in a language where the count and the allocation are one indivisible operation — which, in a memory-safe language, they are.[[cite: [Tenable — CVE-2026-109618, CWE-416 classification](https://www.tenable.com/cve/CVE-2026-109618)]]

The fair counterpoint is the one PHP cannot escape: seventy percent of the web is written in it, the C engine is what it is, and "rewrite it in Rust" is a 30-year project, not a patch. What PHP *can* do — what it did on October 21 — is fix the mechanism, harden the lifecycle boundary, and fund the audits it skipped for three decades.

# The zero-heap counterpoint

This site maintains [[AdaLogic_BASIC|AdaLogic BASIC]], and the comparison is worth one honest paragraph — not because anyone is migrating their WordPress fleet to ALB, but because these CVEs are a clean illustration of what "memory safety" actually costs and buys at the *language-design* level.

ALB's runtime allocates no per-request heap. State lives in statically-sized structures allocated at initialization; a request — or a tick, or a BBS session — cannot trigger a mid-operation allocation failure because there is no mid-operation allocation. There is no `longjmp` analogue: error paths are structured, local, and cannot leave counters desynchronized from backing memory, because the two are the same object. A "use-after-free across worker requests" like 109619 isn't a bug ALB has patched; it's a bug the design cannot express — the same property SPARK Ada proves formally and Rust enforces through ownership. See [[Ada_vs_Rust_Memory_Safety]] for the deeper comparison.

None of that makes ALB a web-scale PHP replacement — the ecosystems aren't comparable and pretending otherwise would be dishonest. The point is narrower and more useful: the classes of failure in today's CVEs are *choices*, not laws of nature. They were chosen once in 1995 for performance, chosen again every time the audit didn't happen, and re-chosen — correctly, this time, and for the last time in this instance — on October 21, 2026.

# What to do right now

**Patch. Everything else is a stopgap.**

| PHP branch | Affected | First fixed release |

|---|---|---|

| 8.5 | ≤ 8.5.11 | **8.5.12** |

| 8.4 | ≤ 8.4.26 | **8.4.27** |

| 8.3 | ≤ 8.3.35 | **8.3.36** |

| 8.2 | ≤ 8.2.34 | **8.2.35** |

| 7.4 / 8.0 / 8.1 | all | source backports only — check your vendor |

All web SAPIs are in scope: mod_php, PHP-FPM, `php-cgi`, FrankenPHP, LiteSpeed. When building the inventory, count containers and products that bundle their own PHP — the CLI binary's version tells you nothing about what serves the site. After patching, restart or replace every worker still running the old runtime.[[cite: Datadog Security Labs, [fixed versions and remediation steps](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

**If you cannot patch today**, the partial mitigations — partial, not protective:

- For **109618**: enforce `memory_limit=-1` at the administrator level, paired with request-body limits at the frontend and memory caps on the container. Do *not* substitute `RLIMIT_AS`/`RLIMIT_DATA` — process-level limits trigger exactly the allocation failures this bug feeds on. An attacker who exhausts real system memory can still destabilize the host.[[cite: PHP / Datadog, [temporary mitigation guidance](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

- For **109619**: set `session.upload_progress.enabled=0` and, on PHP 8.5, `fatal_error_backtraces=0`, in configuration loaded *before* request parsing — then restart every worker. Hiding the errors does not prevent access to stale state; it only removes the known trigger.[[cite: Datadog Security Labs, [mitigation caveats](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]]

- Put a reverse proxy or WAF in front of PHP — boundary controls that block oversized or malformed request bodies before they reach the vulnerable parser. The coordinated industry partners shipped out-of-box rules today.[[cite: Wiz Research, [industry mitigation coordination](https://www.wiz.io/blog/php2shell-php-rce)]]

- On PHP 8.1 and older: CISA's guidance is blunt — take PHP-based systems offline until patched or upgraded. Source backports exist for 7.4/8.0/8.1, but they land in vendor packages on vendor time.[[cite: [CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)]]

**Detection**: hunt for memory-exhaustion errors during *request initialization* (before app code), unusually large form submissions, and — the tell — PHP worker processes spawning shells or downloading tools. Successful exploitation doesn't necessarily crash the worker.[[cite: Datadog Security Labs, [detection guidance](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)]][[cite: [CISA monitoring guidance](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)]]

One honest caveat for after the patch: public PoC documentation describes additional exploitation paths — application-dependent chains through `unserialize()` sinks, serializer-handler mismatches, and session-injection LFI — reported as still functional on 8.5.12. These are *different* bug classes needing application cooperation, not the CVEs themselves — but the same codebase, the same architecture, and Wiz's warning about untracked variants should temper any sense that today's patch is the end of it.[[cite: [php2shell PoC — post-patch path status](https://github.com/ikow/php2shell-poc)]]

# The read

Patch tonight. Then keep the uncomfortable fact somewhere you'll see it: the language holding up most of the web is written in the one language family where these bugs are always possible, and the difference between "theoretical" and "pre-auth RCE on WordPress" turned out to be a question of who could afford to look hard enough. Now anyone can.

# See also

- [[Ada_vs_Rust_Memory_Safety]] — the memory-safety comparison these CVEs argue for

- [[AdaLogic_BASIC]] — the zero-heap runtime design referenced above

- [[HolyC]] — a different one-man language, a different set of trade-offs

[[Category:News]]

[[Category:Languages]]

[[Category:Reference]]