Back Sploitus

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Sploitus • October 23, 2026

**php2shell CVE-2026-109618 CVE-2026-109619** is an advisory pack. php2shell, cve php2shell, php2shell cve, php2shell vulnerability, php cve 2026, cve php 2026, php cve patch, php cve rce, php security.

This repo is for patching and inventory. It does not ship an exploit, PoC, or attack request.

- CVE-2026-109618: RCE via out-of-memory corruption during request cleanup (CVSS 9.2)

- CVE-2026-109619: RCE via stale request-owned global state on a reused worker (CVSS 9.2)

- Highest risk on mod_php. Also PHP-FPM, php-cgi, FrankenPHP, LiteSpeed

PHP 8.1 and older need a vendor backport or a move to a supported line.

CISA and PHP say an update is the only complete fix. Until then, take internet-facing PHP offline where you can. Temporary knobs (not a fix): `session.upload_progress.enabled=0`, review `memory_limit` / `post_max_size`, restart workers. See php.net archive 21 Oct 2026.

1. Inventory PHP and SAPI (mod_php, FPM, cgi).

2. Apply the vendor package or the versions above.

Both IDs: CVE-2026-109618 and CVE-2026-109619.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 274 sources 73

Extracted Entities

Exploit for Improperly Controlled Sequential Memory Allocation in Php

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Domains (1)

Platforms (5)