Dave Does Cyber Security

Updates to PHP Vulnerability

Queen City Cyber Consulting

Threat Intelligence Briefing: PHP2Shell Vulnerability Analysis & Comprehensive IOC Framework

Author: David Biser, Lead Cybersecurity Consultant
Organization: Queen City Cyber Consulting, Cumberland, MD
Classification: Operational Threat Advisory
Date: October 2026

1. Executive Summary

Critical remote code execution (RCE) vulnerabilities in the PHP engine—designated CVE-2026-109618 and CVE-2026-109619 and collectively tracked as PHP2Shell—enable unauthenticated attackers to execute arbitrary code with the privileges of the affected PHP worker process [cite: 1.1.2, 1.2.4]. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical) [cite: 1.1.2, 1.2.4] and affect all PHP installations processing web requests (including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed) [cite: 1.1.2, 1.2.1].

2. Vulnerability Breakdown

  • CVE-2026-109618 (RCE via Out-of-Memory Corruption): Triggered when PHP encounters an out-of-memory condition during request initialization, leaving internal request data partially initialized. Subsequent request cleanup treats invalid pointers as valid, allowing memory corruption and RCE via crafted multipart form requests (specifically leveraging PHP_SESSION_UPLOAD_PROGRESS) [cite: 1.1.5, 1.2.1, 1.2.3].
  • CVE-2026-109619 (RCE via Stale Global State): Involves persistent PHP workers retaining references to memory from finished requests. A subsequent request processed by the same worker triggers a use-after-free (UAF) condition through session upload handling or fatal-error backtraces [cite: 1.1.5, 1.2.1].

3. Comprehensive Indicators of Compromise (IOCs & TTPs)

A. Network & IP Indicators (Observed in Threat Intel & Honeypot Telemetry)

  • 109.71.252.97 (IPv4) [cite: 1.1.1]
  • 221.14.159.134 (IPv4 — Associated with exploitation probes) [cite: 1.1.1]
  • 91.90.123.25 (IPv4) [cite: 1.1.1]
  • 95.217.98.37 (IPv4 — Identified in MadPot exploitation monitoring) [cite: 1.2.5]
  • Note: The above IP addresses include shared anonymization and proxy infrastructure; investigate rather than block outright [cite: 1.2.2].

B. User-Agent Signatures

  • php2shell-scan/109618 [cite: 1.1.1]
  • Mozilla/5.0 (php2shell-poc) [cite: 1.1.1]

C. Request & Application Log Signatures

  • Multipart Form Injections: High-volume or malformed multipart POST requests targeting .php endpoints containing PHP_SESSION_UPLOAD_PROGRESS [cite: 1.2.3, 1.2.5].
  • File Disclosure Probes: GET requests attempting to read session files via wrappers, such as /download.php?file=php://filter/… targeting session files (sess_* under session.save_path) [cite: 1.1.1].
  • Anomalous Cookies: PHPSESSID cookies exhibiting high entropy, encoded heap-like data, or unexpected strings indicating memory disclosure attempts [cite: 1.2.3].
  • HTTP Status Anomalies: Spikes in HTTP 500 or 404 responses correlating with unexpected fatal errors or parse errors on upload, import, or session paths [cite: 1.1.1, 1.2.3].

4. Threat Hunting & Detection Engineering

Security Operations Center (SOC) analysts should deploy the following telemetry rules:

  1. Process Spawning Detection: Alert on web server worker daemons (httpd, nginx, php-fpm) spawning unexpected shell interpreters (/bin/sh, /bin/bash, cmd.exe).
  2. Session File Lock Monitoring: Inspect persistent file locks (flock) on session files in session.save_path via /proc/locks [cite: 1.2.3].
  3. SIEM Log Query (Splunk / Elastic):

index=web_logs (uri=”*.php” AND (http_method=”POST” OR uri_query=”*PHP_SESSION_UPLOAD_PROGRESS*”)) (status=200 OR status=500)

5. Immediate Remediation & Hardening Checklist

  • uncheckedUpgrade PHP Runtimes: Immediately patch to fixed versions PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 [cite: 1.1.1, 1.1.3]. Note: End-of-life versions (PHP 8.1 and earlier) receive no official vendor patches and require complete architecture migration or isolation [cite: 1.1.1, 1.2.1].
  • uncheckedConfigure Memory Limits: Set post_max_size appropriately (e.g., 32M for upload-heavy apps, 8M otherwise) and enforce memory_limit=-1 via php_admin_value as an interim mitigation where patching is delayed [cite: 1.1.1, 1.2.3].
  • uncheckedService Restart: Restart Apache/PHP-FPM services and rebuild container images to clear vulnerable state from active worker memory [cite: 1.2.3].
  • uncheckedSecret Rotation: Rotate all database credentials, API keys, and session tokens on servers exposed prior to patching, as worker memory leakage may have exposed sensitive tokens [cite: 1.2.1].

Published by Queen City Cyber Consulting — Lead Consultant David Biser, Cumberland, MD.

Leave a Reply