(Updating LIVE) php2shell – Censys ARC Tracking Dashboard
>>> Find live updates global exposure to php2shell. <<<
Vulnerability Description
On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The PHP security advisory says both “can allow unauthenticated remote code execution” and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
CVE-2026-109618: “RCE via OOM corruption”
According to the PHP advisory, “PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state.” The PHP project describes several ways a request can drive PHP to that out-of-memory point during multipart body parsing while staying within its configured limits. On Apache mod_php this happens before any application code runs.
CVE-2026-109619: “RCE via stale global state”
According to the PHP advisory, “PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request.” Some operations that run before the next request is initialized can then use that stale state after its memory has been freed, a use-after-free (CWE-416) vulnerability. Exploitation needs one request that leaves the stale state behind and a later request handled by the same worker that consumes it.
Confirmation
The PHP project has confirmed working attacks for each flaw on different server setups.
For CVE-2026-109618, it validated full remote code execution against Apache mod_php with default PHP input and memory limits. It considers FrankenPHP likely susceptible and PHP-FPM susceptible from source analysis, without a demonstrated exploit, and describes exploits against LSAPI as “likely but unvalidated.”
For CVE-2026-109619, it confirmed remote code execution against mod_php on PHP 8.5 with the fatal_error_backtraces setting enabled, and against both mod_php and PHP-FPM through the session upload progress feature, which is enabled by default. The PHP-FPM case, according to PHP, “depends on a suitable application operation.”
Impact
According to the PHP project, the confirmed impact of both flaws is unauthenticated remote code execution with the privileges of the web server’s PHP worker account. That account can typically read the application’s source, configuration files, and stored credentials such as database passwords and API keys, so the exposure extends to the databases and services those credentials reach. PHP states that updating is the only complete fix, and that the configuration measures it lists only reduce exposure to specific attack paths. A PHP host that was reachable from the internet while unpatched warrants a review for signs of compromise in addition to the upgrade, and its stored credentials should be rotated if any sign is found.
Details
| CVE ID | CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, critical, per the PHP project |
| Date of Disclosure | PHP advance notice: October 20, 2026. PHP release: October 21, 2026. NVD: not yet published |
| Affected Assets | PHP serving web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed |
| Vulnerable Software Versions | PHP before 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and earlier get no official release; PHP published source backports for 7.4, 8.0, and 8.1 |
| PoC Available | VulnCheck lists multiple unverified public proof-of-concept repositories for CVE-2026-109618 as of October 21, 2026 |
| Exploitation Status | No exploitation reported by the PHP project as of October 21, 2026 |
| Patch Status | Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026 |
Censys Queries
Platform: Found: 6,292,667 hosts* and 115,000,393 web properties*
host.services.software: (vendor="php" and product="php") or web.software: (vendor="php" and product="php")
ASM:
host.services.software.product="PHP" or web_entity.instances.software.product="PHP"
*Note: Web property and host values have been updated as of 2:25pm EST on Oct 21, 2026. Due to the developing nature of this advisory, these numbers may be updated again. Query results may differ as we continue to incorporate new signals.