Open Veils · Answer
What is this PHP vulnerability that I’m hearing about in the news?
PHP2Shell is not a niche or suppressed story — it is a legitimate, documented critical infrastructure crisis. Two unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) affect every PHP installation serving web requests, meaning a vast proportion of the global web is exposed. The risk is highest for mod_php, where exploit chains can fire before a single line of application code runs. Patch immediately or take systems offline.
Evidence
- Per the PHP security team's emergency advisory (October 21, 2026), both flaws share a root cause: PHP can leave memory in a corrupted state when a request ends abnormally.
- CVE-2026-109618 chains out-of-memory corruption weaknesses to achieve remote code execution as the web worker account — unauthenticated.
- CVE-2026-109619 exploits stale global state to enable heap use-after-free, memory disclosure, and full RCE, again requiring no credentials.
- Researchers from Calif, OpenAI, and Wiz jointly discovered the flaws, which affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed — essentially the entire PHP deployment surface.
- CISA (alert dated October 21, 2026) confirmed no observed active exploitation at time of publication but warned that internet-facing systems are the priority target.