Tencent Cloud Notices > Notice Details
【Security Advisory】PHP "php2shell" Remote Code Execution Vulnerability (CVE-2026-109618, CVE-2026-109619)
2026-10-21 22:00:00
Dear Tencent Cloud User,
Summary
Tencent Cloud Security Center has detected that PHP has been disclosed to contain remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". These vulnerabilities could allow an unauthenticated remote attacker to send specially crafted multipart POST requests to trigger memory corruption and ultimately achieve remote code execution, thereby gaining full control of the server.
To avoid impact on your business, Tencent Cloud Security recommends that you promptly conduct a security self-assessment. If your systems fall within the affected scope, please update and remediate them in a timely manner to prevent exploitation by external attackers.
Technical Details
PHP is an open-source general-purpose scripting language designed to allow web developers to quickly write dynamic pages. It has a wide range of applications and can run on most servers and operating systems.
1.PHP Remote Code Execution Vulnerability (CVE-2026-109618):
In PHP, the handling of out-of-memory (OOM) errors uses longjmp() to exit the current context prematurely. In certain contexts, request memory becomes accessible before it is fully initialized. If memory allocation fails at this point, PHP fails to properly handle the premature exit, leaving the request memory in an invalid state. An attacker can craft a multipart request containing a large number of headers, nested field names, or empty file controls to exhaust memory_limitand trigger an OOM, while seemingly staying within the post_max_size limit. In SAPIs such as Apache mod_php that unconditionally invoke the request shutdown process, the shutdown process processes these invalid states, ultimately leading to memory corruption and remote code execution.
2.PHP Remote Code Execution Vulnerability (CVE-2026-109619):
In PHP, worker processes retain global state pointing to the previous request's memory (such as error, session, object, and extension state), but this state is not fully reset before the request memory is freed, resulting in a use-after-free condition. When certain input, configuration, session, or error-handling operations run before the next request is properly initialized, they access this stale, unreset state. An attacker can craft a specific heap layout to exploit this cross-request lifecycle vulnerability (e.g., a fatal error causing state not to be reset, or subsequent diagnostic information repopulating a cleared error state), acting as both producer and consumer across two requests handled by the same worker process, ultimately achieving unauthenticated heap use-after-free, memory disclosure, or remote code execution.
Risk level
High
Vulnerability Risks
An unauthenticated remote attacker exploiting this vulnerability can execute arbitrary code on the server under the identity of the web worker account, potentially leading to full server compromise, sensitive data leakage, or malware implantation.
Affected Products and Versions
5.x <= PHP < 8.2.35
8.3.0 <= PHP < 8.3.36
8.4.0 <= PHP < 8.4.27
8.5.0 <= PHP < 8.5.12
Secure Products and Versions
PHP >= 8.2.35
PHP >= 8.3.36
PHP >= 8.4.27
PHP >= 8.5.12
Remediation & Action Required
1. For branches still maintained by the official vendor, the official patches and fixed versions have been released. Please assess whether your business is affected and upgrade to a secure version.
2. For branches that have reached end of life, the official vendor will no longer provide fixed versions. Please assess whether your business is affected and upgrade to an officially maintained secure version.
[Note]: It is recommended that you back up your data before upgrading to avoid any unexpected issues.
Vulnerability Reference
Tencent Cloud Security Solutions
- Tencent T-Sec Host Security now supports detection of this vulnerability.
- Tencent T-Sec Web Application Firewall now supports protection against this vulnerability.
- Tencent T-Sec Cloud Firewall now supports protection against this vulnerability.
