PHP2Shell: two critical vulnerabilities enable unauthenticated code execution

Researchers at OX Security analyzed two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both issues stem from improper memory management in the PHP core and can lead to remote code execution without authentication. The vulnerabilities are notable because they affect the PHP interpreter itself rather than individual web applications or CMS platforms.

Exploitation uses the session.upload_progress, which tracks file uploads and processes HTTP request data before the PHP script starts. An attacker sends a specially crafted multipart/form-data POST request that triggers memory management errors. In the case of CVE-2026-109618, memory exhaustion causes request processing to terminate abnormally, followed by access to improperly initialized data. CVE-2026-109619 involves retaining pointers to memory that has already been freed and may be reused while processing subsequent requests. Both errors create conditions for memory corruption and potential control-flow hijacking.

Successful exploitation allows an attacker to execute arbitrary code on the web server without an account, gain access to configuration files, application credentials, and other resources available to the PHP process. This creates a risk of compromising sites running WordPress, Drupal, Magento, and other PHP applications, regardless of whether their own code contains vulnerabilities.

Article: https://www.ox.security/blog/cve-2026-109618-cve-2026-109619-two-vulnerabilities-allow-unauthenticated-rce-in-php/