PHP2Shell – Critical Vulnerabilities in PHP Core (CVE

* CVE-2026-109618 and CVE-2026-109619 are use-after-free vulnerabilities found in PHP core versions 5.4 and onward.
* These vulnerabilities stem from issues in memory management and state handling components of PHP core.
* An unauthenticated attacker can cause remote code execution via these flaws.
* CVE-2026-109618 is associated with the longjmp() function and zendhashstraddorupdatei() in PHP core versions after v5.4.
* CVE-2026-109619 involves longjmp() and fatalerrorbacktraces related to session upload progress components and other state handling.
* Exploitation requires inducing an Out-Of-Memory (OOM) error on the webserver.
* One method to induce OOM is using a crafted HTTP multipart request with no Content-Length header, coupled with a nested file upload without a filename.
* The memory management flaw allows the execution to proceed after the memory region has been freed, leading to potential remote code execution and memory disclosure.
* Exploitation requires running PHP versions between 5.4 and specific high versions up to 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
* Detection methods include monitoring HTTP multipart requests and searching error logs for memory exhaustion messages.

The narrative demonstrates a clear progression from memory exhaustion to arbitrary code execution through subtle flaws in low-level language constructs like memory management within the PHP engine. The core pattern is that intentional, albeit crafted, system failures (OOM errors) are leveraged not as an error state, but as a mechanism to bypass normal security checks by corrupting the temporal state of memory operations. This shifts the attack surface from traditional input validation flaws to exploiting the internal consistency of the runtime environment itself. The focus on use-after-free vulnerabilities rooted in function calls like longjmp() highlights a systemic risk where control flow integrity is compromised based on resource availability, rather than simple input validation failure. The implication for agency centers on the difficulty of detecting these exploits because they occur pre-application execution, requiring deep system-level monitoring to catch patterns that appear legitimate, such as memory exhaustion errors. This suggests a necessary paradigm shift in security focus: moving beyond application-layer checks to rigorously verifying runtime memory invariants across request lifecycles.
Bridge Questions: If system-level memory integrity becomes the primary attack vector, what new auditing tools are required to monitor for transient state corruption within interpreter execution? How can defensive architectures be designed to inherently resist reliance on C-level error handling when processing external input? How does the industry balance the need for rapid patching against the inherent difficulty in detecting these deep semantic vulnerabilities across diverse software stacks?