SK Shieldus flags critical PHP2Shell flaws allowing remote code execution

SK Shieldus has published a security report on two PHP memory-management vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, which it says allow remote code execution, according to the company's report. The flaws were disclosed in October 2026.

Both issues stem from abnormal request termination during out-of-memory (OOM) conditions in PHP's memory management. CVE-2026-109619 exploits a use-after-free condition in which leftover memory state from an earlier request is reused by a follow-up request on the same PHP worker, with the session.upload_progress file-upload progress feature, enabled by default, used as the attack path. CVE-2026-109618 triggers during the shutdown of a request that failed to initialize after running out of memory.

SK Shieldus said it reproduced the flaw in a test environment running PHP 8.4.26 on the Apache web server, obtaining a reverse shell with web server privileges without authentication.

Affected versions and fix

Affected releases are PHP 8.2.34 and below, 8.3.35 and below, 8.4.26 and below, and 8.5.11 and below, along with end-of-life PHP 8.1 and earlier. Patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later. SK Shieldus recommends upgrading PHP and restarting all PHP workers.

On November 3, Kaspersky published an analysis citing internet asset search company Censys, finding that 29 million of 46 million vulnerable PHP services detected online were still running vulnerable versions after patches were released. W3Techs data from October 23 showed that 69.3% of websites with an identifiable server-side language used PHP.