# Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

PHP core OOM-during-parse memory corruption and stale serializer-state use-after-free yield unauthenticated RCE, worst under mod_php, fixed in 8.5.12/8.4.27/8.3.36/8.2.35.

- Payout: Research
- Severity: critical
- Program: PHP
- Found by (vendor credit): Ryan at Calif.io, Wiz, OpenAI
- Disclosed: 2026-10-27
- CVE: CVE-2026-109618, CVE-2026-109619
- Write-up quality: 7/10
- Original: https://bishopfox.com/blog/responder-guidance-for-php2shell
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-responder-guidance-for-php2shell
- Tags: area:oss domain:oss impact:dos impact:rce kind:research platform:research sev:critical tech:php technique:chained technique:source-review vuln:dos vuln:memory-corruption vuln:rce

**Target:** PHP core request parser and request-scoped serializer state (mod_php/FPM/cgi SAPIs)
**Root cause:** CVE-2026-109618: PHP's OOM handling interrupts parsing while internal request data (e.g. $_POST) is only partially initialized, and request cleanup treats that invalid data as valid. CVE-2026-109619: request-scoped serializer state is freed on mid-request death while something still points at it, and a later request on the same worker reuses the dangling state before per-request init resets it.
**Steps:**
1. CVE-2026-109618: send a request crafted to exhaust memory during parsing, e.g. a multipart POST flooding the parser with a large number of per-part header lines
2. OOM interrupts parsing with $_POST partially initialized; cleanup treats the invalid data as valid, yielding a corrupted-memory primitive
3. Groom the primitive into attacker-controlled execution; on mod_php this fires before any application code runs
4. CVE-2026-109619: force a request to die partway (attacker-induced fatal error or timeout) so serializer state is freed while still referenced
5. Send a later request to the same worker that reaches the dangling state via session.upload_progress
6. Turn the use-after-free into a forged object in session data that the engine dereferences into attacker-controlled execution
7. Defeat ASLR using the display_errors early-output leak (spills memory into a cookie) or blind brute force
**How found:** Built on public research from Calif.io and Wiz; vendor demonstrated pre-application trigger on mod_php; researchers reproduced RCE in lab across stock Docker images and mapped which config factors (SAPI, opcache, display_errors, memory_limit, session handling) gate exploitability.
**Exploitation:** Unauthenticated attacker reaches the bug pre-application on mod_php: OOM path via oversized multipart header flood, or UAF path via forced mid-request death plus session.upload_progress on the same worker. ASLR defeated via display_errors early-output memory leak into a cookie or brute force (Apache prefork workers inherit parent layout, so randomization is constant per master). Full RCE reproduced with ASLR on, HTTP only, no debugger against stock php:8.3/8.4/8.5 mod_php Docker images; opcache-enabled real apps require recalibration.
**Escalation:** Chains memory corruption/UAF into code execution; ASLR bypass via display_errors leak or prefork layout reuse; per-target re-tuning for opcache and architecture (x86-64 vs ARM).
**Insight:** Engine-level bugs are reachable regardless of app features: the OOM-during-parse window means any parser that allocates per-input before completing initialization is a corruption candidate, and request-scoped state freed on abnormal termination can persist into the next request on a reused worker — check session.upload_progress and fatal-error paths as delivery vectors.

## Write-ups of the same bug (oldest first)
- 2026-10-21: [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-php2shell-php-rce) — Wiz Research
- 2026-10-27: [Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-responder-guidance-for-php2shell) (this one)
- 2026-10-27: [php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit](https://bugbountylibrary.com/r/blog%3Apraetorian-com-blog-php2shell) — Michelle Rhodes