/
← Voltar ao feed
critical technology critical infrastructure

PHP2shell: Critical PHP RCE flaws CVE-2026-109618/109619 exploited after Chainguard breaks disclosure embargo

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 20:02 · coletado há 1 hora

PHP maintainers released emergency patches for two critical memory corruption flaws, collectively called PHP2shell (CVE-2026-109618 and CVE-2026-109619), that allow unauthenticated remote code execution. The PHP Foundation accuses Chainguard of breaking the coordinated disclosure embargo on 21 October at 07:41 UTC, more than six hours before the planned release, by publishing built images containing the fix. Chainguard CEO Dan Lorenc does not dispute the timeline. He says rumors, public PoCs and reports of in-the-wild exploitation by other vendors justified shipping early. The bugs were found by researchers at Calif, OpenAI and Wiz using AI models, and Chainguard says it independently found the same flaws with a frontier model. Chainguard honeypots reportedly trapped IPs from China and Russia targeting the flaws on Wednesday, and the full scope of exploitation is unknown.

Entenda a falha

A vulnerabilidade

PHP2shell is two memory corruption flaws in PHP that allow unauthenticated remote code execution. CVE-2026-109618 is out-of-memory corruption: a request that hits memory_limit at the wrong moment leaves partially initialized internal data that PHP later trusts. On Apache with mod_php, an unauthenticated request can trigger it before any application code runs. CVE-2026-109619 is stale state leading to use-after-free: a fatal error at the wrong point leaves state pointing to memory from a previous request. Wiz says every PHP version of the last decade, back to 5.4, is affected by at least one of them. The articles do not give fixed version numbers, only emergency releases and distributor packages. Legacy versions without security fixes stay exposed.

Como funciona

For CVE-2026-109618, a web request reaches PHP and, while it is being processed, consumes memory up to memory_limit. If the limit is hit at exactly the wrong moment, PHP stops while some internal data is only partly initialized. PHP later treats that data as valid, so memory is corrupted. With mod_php this can happen before application code runs. For CVE-2026-109619, a request ends unexpectedly through a fatal error at the wrong point, and internal state is left pointing at memory belonging to that request. A later request handled by the same worker then uses that memory after it was freed. This causes a crash or, if an attacker shapes the memory, memory disclosure or code execution.

Por que é vulnerável

Both flaws come from how PHP handles memory management and error handling when a request ends abnormally. In the first, PHP does not keep its internal data consistent when the memory limit is reached mid-initialization, and later trusts incomplete data. In the second, internal state is not cleaned up after a fatal error, so it outlives the memory it points to and a later request reuses freed memory. The articles do not explain why this went unnoticed for so long. Lorenc said the patches were hard to build and took the maintainers months. The articles do not describe the exact code changes.

Onde está

The articles name no file, function or commit; they cite the advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), and the memory_limit setting and Apache mod_php as the context.

Como foi descoberta

According to the PHP Foundation, researchers at Calif, OpenAI and Wiz found the flaws between August and September, and all three say they used AI models. Chainguard says it independently found the same memory corruption bugs on a Friday with its AI harness and a frontier model, after a researcher told it something was coming in PHP. Disclosure was coordinated, but on 20 October around 15:00 UTC the CVE IDs leaked with wrong release time and CVSS, so the release moved from Thursday to Wednesday. Calif then mistakenly published a PoC video. The PHP Foundation says Chainguard broke the embargo on 21 October at 07:41 UTC by publishing fixed images. Lorenc does not dispute the timeline and cites rumors, public PoCs and exploitation reported by other vendors.

PoC pública

Calif mistakenly published a video of a proof-of-concept exploit with limited additional information, according to the PHP Foundation. Lorenc also said other people posted PoCs on social media. The articles give no address for any of them. For CVE-2026-109619, the reporter demonstrated remote code execution against a real-world application on Apache with mod_php, so working exploitation is shown. Chainguard honeypots reportedly caught IPs from China and Russia targeting the flaws, and other vendors reported exploitation. Patch urgently, because exploit-building is reportedly possible within hours.

Explicação gerada por IA a partir da matéria e dos artigos, em 21/10/2026 22:16.

Detalhes técnicos

  • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory corruption. If a request hits memory_limit at the wrong moment, PHP leaves partially initialized internal data behind and later treats it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs.
  • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): stale state. A fatal error at the wrong point leaves internal state pointing to memory from a previous request, so a later request on the same worker can use freed memory. A use-after-free and worker crash were confirmed, and RCE was demonstrated against a real-world application on Apache with mod_php.
  • Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to 5.4. Both are exploitable remotely, in some cases fairly easily.
  • Leak chronology: on 20 October at about 15:00 UTC the CVE IDs began circulating with incorrect release time and CVSS data, so disclosure was moved from Thursday to Wednesday. Hours later Calif mistakenly published a PoC video with limited details. Mitigation advice given to a few critical infrastructure providers from about 20 October 23:00 UTC may also have leaked.
  • Possible impact per Wiz: server takeover, data theft and website defacement.

Remediação

  • Patch PHP immediately using the emergency releases or distributor packages. Wiz strongly advises immediate patching.
  • Legacy PHP versions without security fixes remain exposed, so prioritize upgrading or isolating them.
  • Review internet-facing PHP servers, especially Apache with mod_php, for signs of exploitation.

Linha do tempo

  1. theregister.com ↗ · pub. 21/10/2026 20:02 · coletado 21/10 22:00 primeiro registro

    PHP2shell: Critical PHP RCE flaws CVE-2026-109618/109619 exploited after Chainguard breaks disclosure embargo

    ler a análise desta fonte

    PHP maintainers released emergency patches for two critical memory corruption flaws, collectively called PHP2shell (CVE-2026-109618 and CVE-2026-109619), that allow unauthenticated remote code execution. The PHP Foundation accuses Chainguard of breaking the coordinated disclosure embargo on 21 October at 07:41 UTC, more than six hours before the planned release, by publishing built images containing the fix. Chainguard CEO Dan Lorenc does not dispute the timeline. He says rumors, public PoCs and reports of in-the-wild exploitation by other vendors justified shipping early. The bugs were found by researchers at Calif, OpenAI and Wiz using AI models, and Chainguard says it independently found the same flaws with a frontier model. Chainguard honeypots reportedly trapped IPs from China and Russia targeting the flaws on Wednesday, and the full scope of exploitation is unknown.

    Technical Details

    • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory corruption. If a request hits memory_limit at the wrong moment, PHP leaves partially initialized internal data behind and later treats it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs.
    • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): stale state. A fatal error at the wrong point leaves internal state pointing to memory from a previous request, so a later request on the same worker can use freed memory. A use-after-free and worker crash were confirmed, and RCE was demonstrated against a real-world application on Apache with mod_php.
    • Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to 5.4. Both are exploitable remotely, in some cases fairly easily.
    • Leak chronology: on 20 October at about 15:00 UTC the CVE IDs began circulating with incorrect release time and CVSS data, so disclosure was moved from Thursday to Wednesday. Hours later Calif mistakenly published a PoC video with limited details. Mitigation advice given to a few critical infrastructure providers from about 20 October 23:00 UTC may also have leaked.
    • Possible impact per Wiz: server takeover, data theft and website defacement.

    Remediation

    • Patch PHP immediately using the emergency releases or distributor packages. Wiz strongly advises immediate patching.
    • Legacy PHP versions without security fixes remain exposed, so prioritize upgrading or isolating them.
    • Review internet-facing PHP servers, especially Apache with mod_php, for signs of exploitation.