PHP2Shell Alert: Critical PHP RCE Flaws Hit Web | KDN

Global Cybersecurity Alert "PHP2Shell": Hackers Launch Millions of Attacks Targeting Critical PHP Flaws Across 70% of the Web

By: Khmer Digital News Editorial Team
Published: October 24, 2026

📌 Key Takeaways:

• Two critical vulnerabilities in the core PHP interpreter—CVE-2026-109618 and CVE-2026-109619, collectively dubbed "PHP2Shell"—enable unauthenticated Remote Code Execution (RCE).

• Affecting PHP versions 5.4 through 8.5 across nearly 70% of commercial websites worldwide, the flaws have triggered precautionary site takedowns and millions of automated exploit attempts.

• Engineering teams must immediately upgrade to patched versions (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35) and disable session.upload_progress.enabled in php.ini.

Global cybersecurity agencies have issued emergency directives following the disclosure and active exploitation of "PHP2Shell"—a pair of critical remote code execution vulnerabilities embedded within the core PHP programming language. With PHP powering approximately 70% of active websites worldwide, security analysts have dubbed the crisis "Black October," warning that threat actors are leveraging AI-assisted scanning tools to launch millions of exploitation attempts against unpatched servers.

1. Technical Anatomy of PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

Unlike application-layer vulnerabilities confined to specific content management plugins, PHP2Shell resides directly inside the core PHP engine across versions 5.4 to 8.5:

• CVE-2026-109618 (Out-of-Memory Request Corruption): An out-of-memory handling defect interrupts PHP while internal request structures are only partially initialized, corrupting memory during request cleanup.

• CVE-2026-109619 (Use-After-Free in Session Upload Progress): A critical use-after-free vulnerability triggered via the php_session_rfc1867_callback handler in ext/session/session.c. Because PHP parses multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS before executing application scripts—a setting enabled by default since PHP 5.4—attackers can achieve arbitrary code execution without authentication.

• CVE-2026-115560: A third related session-handling RCE vector disclosed on October 23, 2026, compounding risks for non-standard configurations.

By transmitting specially crafted multipart POST payloads, unauthenticated remote attackers can compromise the underlying host, deploy persistent webshells, exfiltrate database credentials, and move laterally across shared hosting environments.

2. Global Impact and Precautionary Shutdowns

Following an early leak of technical details on Hacker News on October 20, 2026, the PHP development team accelerated its emergency patch rollout on October 21. Government portals, statistical agencies, and enterprise platforms across Europe, North America, and Asia temporarily took internet-facing systems offline to apply patches before automated botnets could breach their perimeters.

3. Immediate Remediation and Hardening Protocol

Cybersecurity authorities including CISA, UK NCSC, and CERT-EU mandate three immediate defensive actions for system administrators and DevOps teams:

• Immediate Version Patching: Upgrade all production environments to PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, or PHP 8.2.35 without delay.

• Configuration Mitigation (php.ini): Where immediate binary patching is impossible, set session.upload_progress.enabled = 0 inside php.ini and restart PHP-FPM or Apache/Nginx workers to neutralize the primary multipart exploit vector.

• WAF Deployment and Compromise Assessment: Enable managed Web Application Firewall (WAF) rules (such as Cloudflare's PHP2Shell mitigations) to inspect inbound multipart POST requests, and audit server logs using CISA's published SIGMA rules for unauthorized webshell creation.

Frequently Asked Questions (People Also Ask):

• Question: Are WordPress, Laravel, and Symfony applications vulnerable to PHP2Shell?
  Answer: Yes; because the flaw is triggered inside the PHP interpreter during multipart request parsing prior to script execution, any framework running on an unpatched PHP runtime is exposed.

• Question: Does setting session.upload_progress.enabled = 0 break modern web applications?
  Answer: Rarely; modern web applications typically handle file upload progress bars on the client side via JavaScript (XMLHttpRequest or Fetch) rather than relying on legacy PHP session progress tracking.

• Question: What should organizations running End-of-Life PHP 7.x versions do?
  Answer: Unsupported PHP 7.x branches do not receive official upstream patches; administrators must immediately disable session.upload_progress.enabled, place applications behind strict WAF inspection, and prioritize migration to PHP 8.2+.

Official Sources: CISA Official Alert, UK National Cyber Security Centre (NCSC), CERT-EU Security Advisory 2026-018, Datadog Security Labs Analysis