On October 21, 2026, the PHP project released fixes for two critical RCE flaws. They are tracked under two CVE IDs: CVE-2026-109618 and CVE-2026-109619. The PHP advisories rate each at 9.2 on the CVSS scale, and an attacker needs no login to use them.
Security teams now ask which of their tools detect affected PHP. This post covers what two modules in MetaDefender™ Core detect: File-Based Vulnerability Assessment (FBVA) and Software Bill of Materials (SBOM)
Root Cause: A Fatal Error That Skips Cleanup
PHP caps how much memory each request can use. When a request goes over that cap, PHP raises a fatal error and abandons the request on the spot. Internally, it jumps out of the running code instead of returning normally. Any task in progress stops midway, and the cleanup routines that would normally tidy up never run.
That is safe only if every piece of code expects to be interrupted. Both PHP2Shell CVEs come from code that did not. PHP runs this code while it reads the incoming request, before its extensions, such as session handling, start up and before your application runs. Your authentication, routing, and framework code never get a chance to help.
CVE-2026-109618: a crafted POST request pushes PHP into an out-of-memory error while its internal state is only half built. The cleanup step then trusts that incomplete state and works on corrupted memory. An attacker can turn that corruption into code that runs on the server, with no login.
CVE-2026-109619: the flaw works across requests. A fatal error leaves internal state pointing at memory that PHP has already freed. A later request on the same worker process reuses that state before PHP resets it. That request then reads and writes memory that no longer belongs to it. An attacker can steer this into code that runs on the server, with no login.
Either flaw can give an attacker code execution as the web server account, according to the 2026 PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
Google Cloud reports that PHP versions 5.4 through 8.5.11 are affected. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. End-of-life branches such as PHP 8.1 received no regular release. Teams that run them need a vendor backport, a source backport, or an upgrade (CERT-EU, 2026).
It’s confirmed attackers can run code against WordPress, Drupal, and Joomla in their latest container images. It also showed memory disclosure that does not depend on the application. Further PHP applications, including MediaWiki, Magento, phpMyAdmin, and Nextcloud are also at risk of attacks.
Several research confirmed the following scenarios are possible:
- Code execution on affected servers without authentication, which can lead to server control, access to sensitive data, lateral movement, or website defacement
- Reads of PHP process memory, including passwords, authentication tokens, API keys, and certificates that belong to other requests or the server
- Data theft through memory disclosure without code execution, which can be harder to detect with tools that watch for malicious code
Incident Timeline
- August 11: Calif reports the first flaw to the PHP project
- August 24: Wiz Research reports further attack vectors
- October 17: AWS logs the first exploitation attempt, 4 days before public disclosure
- October 20: The CVE IDs leak online, and PHP moves its release up by one day
- October 21: PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and AWS sees more attempts from several sources using different payloads
Acoperirea OPSWAT
Where PHP2Shell exposure sits | OPSWAT Technology | What it detects |
|---|---|---|
PHP for Windows binaries ( | File-based Vulnerability Assessment (FBVA) | Both CVEs on vulnerable versions |
Inventory that lists the PHP source package ( | Software Bill of Materials (SBOM) | Both advisories, with the fixed versions |
What File-Based Vulnerability Assessment Detects
FBVA is a module in MetaDefender Core that checks binaries for known vulnerabilities before deployment. It reads the file itself, without an agent, an inventory, or a running system.
OPSWAT added fingerprints for the official PHP for Windows builds. FBVA recognizes php.exe, php-cgi.exe, and the PHP core DLL directly from the file, then reports CVE-2026-109618 and CVE-2026-109619 on vulnerable versions. That covers PHP on servers, inside uploaded archives, and in software packages that pass through a scan.
What SBOM Detects
SBOM identifies open-source and third-party components. It cross-references each component against NVD (National Vulnerability Database), GHSA (GitHub Advisory Database), and EUVD (EU Vulnerability Database). Results export as SPDX (Software Package Data Exchange) and CycloneDX reports.
Both PHP2Shell advisories are in the GHSA data. SBOM reports them when the inventory lists the PHP source package (php-src) at an affected version.
What to Do This Week
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply a vendor backport
- Scan PHP binaries on Windows servers and in incoming software packages with FBVA
- List php-src and its version in your software inventory so SBOM can match it to the advisories
- Ask vendors whether their appliances and products bundle PHP, and when updates arrive
- Review logs for large multipart uploads followed by memory errors, shell-spawning PHP processes, and POST requests containing
PHP_SESSION_UPLOAD_PROGRESS
The PHP advisories name updating as the only complete fix. Configuration changes cut exposure on specific paths.
Both FBVA and SBOM are modules of MetaDefender Core™. For teams that build software, MetaDefender Software Supply Chain™ brings SBOM generation, validation, and software composition analysis into CI/CD pipelines. Security gates in those pipelines let teams check components before a release.
