Latest / The Digital Warfare Podcast / EP. 187: PHP2Shell Gives Attackers a Direct Shot at Internet-Facing Web Servers
Transcript
- riverside edit 02 6ada259931bb14ca1126eefc 0 final padding digital warfare's s: If your PHP server is exposed to the internet and still running a vulnerable build, attackers may not need a password, a stolen session, or a user mistake. They may only need the server itself. Welcome to the Digital Warfare Daily Brief. Today's threat is being called PHP2 Shell. It refers to two critical vulnerabilities in the core PHP runtime. CVE-2026-109618 and CVE-2026-109619 both carry a CVSS score of 9.2, and both can allow an unauthenticated remote attacker to reach one of the most damaging outcomes in web security: remote code execution. Let's break down why. CVE-2026-109618 Targets PHP's handling of out-of-memory conditions. PHP uses a control flow mechanism called long jump when a request runs into a fatal memory condition. The problem is that some internal request state may be left only partially initialized. Cleanup then continues as if that memory is valid. It is not. That creates a memory corruption condition. And with enough control over the heap, an attacker can turn that corrupted state into code execution. Now, CVE-2026-109619 attacks a different internal weakness. PHP stores global state that can temporarily point into memory owned by a request. If that request ends and the global pointer is not correctly reset, later requests can end up touching stale memory that has already been freed. That is a classic use-after-free style condition. And again, the result can be remote code execution, different root cores. Same nightmare. An attacker on the internet sends crafted web requests. The PHP runtime corrupts its own internal memory state, and the attacker gains execution on the server. That is why this matters far beyond one application. PHP sits underneath an enormous number of websites, APIs, content management systems, and business applications. Researchers have already demonstrated successful exploitation paths involving platforms such as WordPress, Drupal, and Joomla. And national cyber authorities are warning organizations that internet-facing PHP servers are at heightened risk. NCSCNZ. Now the most important update. Reports of active exploitation are already emerging. That changes the priority immediately. NCSCNZ. This is not a vulnerability you put into next month's patch queue. This is a vulnerability you deal with now. Affected environments include systems using PHP FPM. Apache with mod underscore PHP, PHP CGI, FrankenPHP, and Lightspeed. And the vulnerable version range is broad. All PHP versions from 5.4 through 8.5.11 are affected, according to the current technical guidance. Google Cloud. So here are today's defensive orders. Find every PHP runtime. Not just the obvious production web servers. Check containers. Check appliances. Check edge devices. Check embedded platforms. Check anything running PHP under the hood. Then patch. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you are still running PHP 8.1 or older, understand the problem clearly. You are on unsupported code and there is no project patch coming. That means. Upgrade or isolate. Then investigate. Review access logs for unusual request patterns. Look for unexpected child processes spawned by web services. Check temporary directories. Inspect recent file changes. Look for new web shells, unknown binaries, suspicious outbound connections, or activity that should never originate from the PHP worker. And if you suspect exploitation, do not just update PHP and move on. Treat the server as compromised. Because once remote code execution happens, the attacker is no longer limited to the vulnerability. They can drop payloads, steal credentials, modify applications, pivot internally, or erase evidence. PHP2 shell delivers one of the clearest warnings defenders will get this week: a widely deployed runtime, two critical memory safety flaws, unauthenticated remote code execution, and reports that exploitation is already happening. Patch the runtime. Hunt the server and do not leave an exposed system waiting for somebody else to prove the exploit works. This has been the Digital Warfare Daily Brief. Stay secure and stay ahead.