Description of PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

Vulnerability overview

Detection by Kaspersky solutions

On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC.

The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP, allegedly affecting all versions starting with PHP 5.4.0.

The vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619. Shortly after the post appeared, researchers confirmed the existence of the vulnerabilities. Along with the leak of details, an exploit unofficially named PHP2Shell appeared online. In the leaked demo video, the exploit is shown in action on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS — platforms that power many modern websites. The authenticity of the demonstration and the exact behavior of the exploit had not been independently verified at the time of publication.

According to the researcher who published the PoC, the vulnerabilities are related to the handling of the multipart/form-data MIME type in conjunction with the session upload progress mechanism ( session.upload_progress ) in the PHP core and fall under the categories of use-after-free and memory corruption. This means that the flaws cannot be patched via application code, and the only possible fix is to update PHP on the server. The attack works without authentication: an attacker with network access to a PHP application can execute arbitrary code on behalf of the PHP process without needing to authenticate. Security advisories issued by PHP on October 21 confirm this information.

The vulnerabilities affect PHP versions 5, 6, 7, and 8. As of this publication, branches from 8.2 to 8.5 are supported. Older branches, including PHP 8.1, 8.0, 7.x, and 5.x, have reached the end of their lifecycle; however, due to the critical severity of the vulnerabilities, backported patches have also been released for versions 7.4, 8.0, and 8.1.

Sansec experts estimate that widespread exploitation could begin within 15 minutes of the update’s release. We strongly recommend that administrators responsible for publicly accessible PHP web servers take the following steps before the patch is available:

Conduct an inventory of all PHP-based systems in the infrastructure (including web servers, control panels, third-party software, etc.).

Disable upload-progress: set session.upload_progress.enabled = Off using the php_admin_flag in PHP-FPM pools.

Block multipart requests on nginx and Apache servers.

Consider temporarily isolating PHP applications that connect to the Internet until fixes are released.

Ensure readiness to install the patch immediately upon its release.

Plan to migrate servers running unsupported versions (8.1 and earlier) to the latest PHP branch.

Kaspersky solutions detect the described malicious activity at various stages of the attack. Possible detection scenarios are listed below.

When an attempt is made to exploit these RCE vulnerabilities, Kaspersky Endpoint Detection and Response promptly alerts the user to suspicious actions performed in the context of a web server, on both Linux and Windows machines. This activity is detected by the following rules:

creating_windows_shell_from_a_web_servers_process ;

possible_web_shell_creating_via_exploit ;

spawning_process_from_webserver_more_filters_linux ;

webserver_interpreter_execution_linux ;

executable_file_in_www_folder .

Detection of the PHP2Shell vulnerability exploit by KEDR

Exploitation of the PHP2Shell vulnerability in network traffic is detected by Kaspersky Anti Targeted Attack (KATA) . This solution detects such activity with the following verdicts: Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C .

Detection of the PHP2Shell vulnerability exploit by KATA

Our Kaspersky Endpoint Security solution, now available as Kaspersky Next , also detects malicious post-exploitation activity using the Behavior Detection component , such as PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.

Vulnerabilities and exploits

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

This site uses Akismet to reduce spam. Learn how your comment data is processed.

漏洞概述

卡巴斯基解决方案的检测

2026年10月20日，PHP安全团队发布了一份初步通知，宣布即将发布紧急补丁，修复两个严重漏洞（CVSS评分均为9.2）。补丁于2026年10月21日星期三14:00 UTC发布。

由于漏洞信息在原定禁令解除前泄露，导致补丁发布速度加快。在 Hacker News 上，一位用户报告了 PHP 中的两个远程代码执行 (RCE) 漏洞，据称影响 PHP 5.4.0 及更高版本。

此次泄露的漏洞编号为 CVE-2026-109618 和 CVE-2026-109619。文章发布后不久，研究人员便证实了这些漏洞的存在。与此同时，一个名为 PHP2Shell 的非官方漏洞利用程序也出现在网络上。在泄露的演示视频中，该漏洞利用程序在运行 WordPress、MediaWiki、phpBB、Magento、Joomla、Laravel、Symfony、Drupal 和 WHMCS 等平台的 Web 服务器上进行了演示——这些平台是许多现代网站的基础。截至发稿时，该演示的真实性和漏洞利用程序的具体行为尚未得到独立验证。

据发布该概念验证（PoC）的研究人员称，这些漏洞与 PHP 核心中对 multipart/form-data MIME 类型的处理以及会话上传进度机制（session.upload_progress）有关，属于释放后使用（use-after-free）和内存损坏两大类。这意味着这些缺陷无法通过应用程序代码进行修复，唯一的解决方法是在服务器端更新 PHP。该攻击无需身份验证：攻击者只要拥有对 PHP 应用程序的网络访问权限，即可代表 PHP 进程执行任意代码，而无需进行身份验证。PHP 于 10 月 21 日发布的安全公告证实了这一点。

这些漏洞影响 PHP 5、6、7 和 8 版本。截至本文发布时，8.2 至 8.5 版本分支均受支持。包括 PHP 8.1、8.0、7.x 和 5.x 在内的较旧版本分支已停止维护；然而，由于这些漏洞的严重性，也已发布了针对 7.4、8.0 和 8.1 版本的向后移植补丁。

Sansec专家估计，该漏洞可能在更新发布后15分钟内被广泛利用。我们强烈建议负责公共PHP Web服务器的管理员在补丁发布前采取以下步骤：

对基础设施中所有基于 PHP 的系统（包括 Web 服务器、控制面板、第三方软件等）进行清点。

禁用上传进度：在 PHP-FPM 池中使用 php_admin_flag 设置 session.upload_progress.enabled = Off。

阻止 nginx 和 Apache 服务器上的多部分请求。

考虑暂时隔离连接到互联网的 PHP 应用程序，直到修复程序发布为止。

请确保在补丁发布后立即安装。

计划将运行不受支持版本（8.1 及更早版本）的服务器迁移到最新的 PHP 分支。

卡巴斯基解决方案可在攻击的各个阶段检测到所述恶意活动。可能的检测场景如下所示。

当有人试图利用这些远程代码执行漏洞时，卡巴斯基端点检测与响应 (Kaspersky Endpoint Detection and Response) 会立即向用户发出警报，提醒其在 Linux 和 Windows 机器上的 Web 服务器环境中执行的可疑操作。该活动通过以下规则进行检测：

从 Web 服务器进程创建 Windows Shell；

可能通过漏洞利用创建 webshel​​l；

spawning_process_from_webserver_more_filters_linux ;

webserver_interpreter_execution_linux；

可执行文件位于 www 文件夹中。

KEDR 检测到 PHP2Shell 漏洞利用

卡巴斯基反定向攻击（KATA）检测到网络流量中存在利用 PHP2Shell 漏洞的行为。该解决方案检测到此类活动，并给出以下判定：Exploit.CVE-2026-109618.HTTP.C&C 和 Exploit.CVE-2026-109619.HTTP.C&C 。

KATA 检测到 PHP2Shell 漏洞利用

我们的 Kaspersky Endpoint Security 解决方案（现已更名为 Kaspersky Next）还可以使用行为检测组件（例如 PDM:Exploit.Linux.Generic 和 PDM:Exploit.Win32.Generic）检测恶意后渗透活动。

漏洞和利用

PHP 中存在严重远程代码执行漏洞（CVE-2026-109618、CVE-2026-109619）

本网站使用 Akismet 来减少垃圾邮件。了解您的评论数据如何处理。