Outbreak Alert: PHP2Shell Remote Code Execution Vulnerabilities

Description

The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management behavior that can be triggered when handling malicious requests. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0).

• CVE-2026-109618 - RCE via out-of-memory corruption: An out-of-memory condition can interrupt PHP while internal request data is only partially initialized. Subsequent request-cleanup operations may incorrectly process this invalid data, potentially enabling remote code execution.
• CVE-2026-109619 - RCE via stale global state: Internal request state can persist after its associated memory has been freed. A later request handled by the same worker may access this stale state before normal initialization resets it, potentially enabling remote code execution.

Successful exploitation could compromise the PHP application process and potentially provide access to sensitive server resources, application data, or databases, depending on the permissions of the affected process and the surrounding environment.

CVEs

CVE-2026-109618, CVE-2026-109619, CVE-2026-115560

Severity

Critical

Posted On

Oct 22, 2026

Outbreak Report Link

https://www.fortiguard.com/outbreak-alert/php2shell