[Security Advisory Update] Official Patches Released for Critical PHP "PHP2Shell" RCE Vulnerabilities (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2)

Advisory ID: LUCKVM-SA-2026-1022 (Update to LUCKVM-SA-2026-1021)

Last Updated: October 22, 2026

Severity: Critical — CVSS v4.0 9.2

Identifiers: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)

Status: Official Patches Released / Active Exploitation in the Wild

[cite: 4, 6]

1. Executive Summary

The PHP development team and major Linux distribution maintainers have officially released emergency security updates addressing CVE-2026-109618 and CVE-2026-109619 (collectively tracked as PHP2Shell), two critical memory-safety flaws in the PHP core engine rated CVSS v4.0 9.2.

Multiple threat intelligence teams—including Amazon Threat Intelligence (via MadPot sensors) and the Cyber Security Agency of Singapore (CSA)—have confirmed widespread exploitation attempts in the wild alongside publicly available proof-of-concept (PoC) exploits. Upgrading to a patched PHP release is the only complete remediation for both vulnerabilities. LuckVM has synchronized all regional package mirrors and OS templates across our 40+ global data centers and urges all customers operating Cloud VPS, Dedicated Servers, and Bulk-IP Proxmox / VMware hosts to patch internet-facing workloads immediately.

2. Newly Disclosed Root Cause & Technical Mechanics

With the release of the official patches, full technical details regarding the underlying flaws in Zend (the core C engine in Zend/ that powers every PHP build) have been published:

Shared Mechanism (_zend_bailout() & longjmp()): Both vulnerabilities stem from how the Zend Memory Manager (Zend MM) and HashTable structures handle fatal errors. When PHP encounters a fatal error or memory exhaustion, _zend_bailout() executes a C longjmp() out of the current call stack without unwinding intermediate caller state.
CVE-2026-109618 (RCE via Out-of-Memory Corruption): When a memory allocation crosses the configured limit during request processing, an out-of-memory (OOM) condition interrupts PHP via longjmp() while internal request data structures (such as HashTable entries) are only partially initialized and still hold stale heap data. The subsequent request-cleanup routine treats this uninitialized memory as valid and branches on those bytes, enabling unauthenticated Remote Code Execution (RCE).
CVE-2026-109619 (RCE via Use-After-Free / Stale Global State): In specific fatal-error scenarios, module-level global state that temporarily points into per-request heap memory is not properly reset (or is repopulated after reset) even after the per-request heap is freed during shutdown. A subsequent request handled by the same persistent PHP worker process reads or branches on that freed memory (Use-After-Free) before normal initialization resets it, resulting in unauthenticated RCE.
High-Risk Targets: Researchers have demonstrated working exploits against standard installations of WordPress, Drupal, and Joomla. Furthermore, PHP identifies Apache deployments using mod_php as particularly at risk because demonstrated exploits can trigger before application code even executes.

3. Affected Versions & Official Patched Releases

Vulnerable Versions: All versions of PHP from 5.4 through 8.5.11.
Official Upstream Patched Versions (php.net):
- PHP 8.5: Fixed in 8.5.12
  
  [cite: 4, 5]
- PHP 8.4: Fixed in 8.4.27
  
  [cite: 4, 5]
- PHP 8.3: Fixed in 8.3.36
  
  [cite: 4, 5]
- PHP 8.2: Fixed in 8.2.35
  
  [cite: 4, 5]
End-of-Life (EOL) Branches (PHP 8.1 and earlier): The PHP project is not releasing upstream fixes for PHP 8.1, 8.0, 7.x, or 5.x. However, major Linux distributions—including Ubuntu, Debian, and Alpine Linux 3.24—have published vendor-maintained backported fixes in their respective package repositories. Workloads on unmaintained EOL runtimes without vendor backports must be migrated to PHP 8.2+ immediately.

4. LuckVM Remediation Plan & Customer Action Checklist

Step 1: Create a Pre-Upgrade Snapshot

Log in to the LuckVM Dashboard and create an instant Snapshot of your Cloud VPS (or verify backups on your Dedicated / Proxmox hosts) prior to applying runtime upgrades, ensuring a clean rollback path if legacy extensions encounter compatibility issues.

Step 2: Patch Host Packages & Rebuild Container Images Immediately

Virtual Machines & Bare-Metal Servers: Update your PHP packages via your distribution package manager (apt update && apt upgrade on Ubuntu/Debian, dnf update on Rocky/AlmaLinux, or apk upgrade on Alpine) to upgrade to 8.5.12, 8.4.27, 8.3.36, 8.2.35, or your distro's patched release. Restart all PHP worker processes (php-fpm) and web servers (nginx, apache2, httpd) immediately after installation.
Docker, Kubernetes & Containerized Workloads (Critical): Updating the host OS does NOT update PHP runtimes bundled inside container images. You must pull updated base images containing the patched PHP binaries (8.2.35+ / 8.3.36+ / 8.4.27+ / 8.5.12+ or patched Alpine 3.24 / Debian layers), rebuild your container images, and redeploy all pods/containers.
Third-Party & Bundled PHP Check: Audit servers for hidden PHP installations used by secondary components, control panels, or monitoring tools, even if your primary web stack does not use PHP.

Step 3: Interim Exposure-Reduction & WAF Controls (While Awaiting Patch Window)

If operational constraints prevent immediate patching on specific nodes, apply the following official exposure-reduction controls recommended by PHP, F5, Google Cloud, and Fortinet (Note: These measures only restrict specific attack vectors and do not replace upgrading PHP):

Enforce Conservative post_max_size & Request Body Limits: Because CVE-2026-109618 relies on triggering out-of-memory (OOM) conditions—often via oversized payloads—PHP recommends setting a conservative backend post_max_size: 8M where file uploads are unnecessary, or 32M where uploads are required. Enforce matching request body size limits at your reverse proxy (Nginx client_max_body_size) or WAF so oversized payloads never reach the PHP backend.
Restrict multipart/form-data & Input Complexity: For applications or endpoints that do not require file uploads or multipart submissions, block requests with Content-Type: multipart/* at your WAF or web server before they reach PHP's multipart parser. Additionally, tighten limits on maximum input parameters, headers, and nesting depth.

Step 4: Post-Exploitation Threat Hunting

Before returning previously exposed systems to full production, inspect web access logs and system telemetry for anomalous oversized POST requests, unexpected PHP worker crashes/OOM events, unexplained child process execution (sh, bash, curl, wget), or unauthorized modifications to application files and databases. If compromise is suspected, isolate the instance via firewall rules and use the LuckVM VNC / IPMI console for forensic investigation.

Need a Staging Instance for PHP 8.2/8.3 Migration? If you are migrating legacy applications off EOL PHP 7.x/8.1 and want to test compatibility without risking production uptime, you can spin up an isolated LuckVM Cloud VPS (70GB NVMe storage, starting at $8.80/mo in Hong Kong/US or $4.93/mo in Europe) in seconds via the LuckVM Portal.

For assistance with snapshots, network filtering, or infrastructure upgrades, please contact our 24/7 engineering team via the LuckVM Support Portal.

LuckVM Infrastructure & Security Team