Back Support.Hpe PHP2Shell: Unauthenticated Remote Code Execution in PHP (CVE-2026-109618, CVE ...
On October 21, two vulnerabilities in PHP was disclosed by PHP Group. These vulnerabilities have been named PHP2Shell (CVE-2026-109618, CVE-2026-109619).
The vulnerabilities are as follows:
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
HPE has been evaluating these vulnerabilities in HPE products since their disclosure. This alert will be updated if any products are found to be vulnerable.
For additional information, see the following links:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
