A pair of critical memory-safety vulnerabilities in the core PHP runtime engine, collectively tracked as 'php2shell' under CVE-2026-109618 and CVE-2026-109619, have put web infrastructure worldwide on high alert. Rated with a CVSS v4.0 severity score of 9.2, the flaws reside deep within the PHP runtime rather than in application code, affecting popular content management systems and custom frameworks alike.
The Mechanics of the Runtime Flaws
According to security advisories and research breakdowns, the vulnerabilities stem from flawed error and memory management during request processing. Specifically, CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, leading request cleanup to treat that incomplete data as valid. Meanwhile, CVE-2026-109619 highlights request-owned state surviving after its memory has been freed, allowing a subsequent request handled by the same worker to utilize stale state before normal initialization resets it. This breaks the fundamental 'shared-nothing' assumption of PHP's request lifecycle in long-lived worker environments.
Ecosystem Impact and Precautionary Takedowns
Because the vulnerabilities exist within the core engine, applications do not need to contain coding errors to be at risk. Wiz demonstrated unauthenticated remote code execution and memory disclosure against default container images of WordPress, Drupal, and Joomla, noting that even a simple script can be exposed. The severity of the exposure prompted several Government of Canada websites, along with the STM and SAQ portals, to temporarily take their systems offline as a precautionary measure. Edge security providers like Cloudflare also reported observing active attack traffic and payload mutations shortly before public disclosure.
Immediate Mitigation and Patching Requirements
Mitigating the issue requires upgrading the PHP runtime itself rather than updating individual applications like WordPress, Drupal, or Laravel. Upstream fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, alongside backported packages from vendors. Security teams stress that simply upgrading package binaries is insufficient unless every active worker process is fully restarted. While interim configuration settings and Web Application Firewall rules offer supplementary defense layers, experts emphasize that they do not substitute for patching the underlying runtime.
The AI Factor and Security Implications
The discovery and exploitation of php2shell mark a significant inflection point in cybersecurity, illustrating how frontier artificial intelligence models are altering threat dynamics. While the underlying memory-safety flaws had reportedly lingered in the PHP codebase for over a decade, human researchers faced immense barriers in chaining the complex components required for reliable exploitation. Security firms Wiz and independent researchers disclosed that frontier models such as Gemini 4 Argon and GPT-5.6 Sol were instrumental in analyzing failures, adapting exploit chains to varying memory layouts, and automating complex debugging tasks across different versions. This acceleration drastically shortens the window between vulnerability identification and active exploitation in the wild. For engineering teams, the incident underscores a broader architectural lesson regarding long-lived worker pools and execution runtimes: cleanup routines that rely solely on successful execution paths leave systems vulnerable when unexpected fatal errors occur halfway through a lifecycle. Organizations must therefore maintain rigorous runtime inventories, ensure rapid patch deployment capabilities, and critically evaluate how state isolation is enforced across all underlying system components.
Editorial graphic and headline text by Signal Titans.
Source: php2shell: a request that fails halfway still leaves state behind · PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
SIGNAL TITANS
Leave a Reply