Black October PHP2Shell Alert: Critical Zero-Day RCE Flaws (CVE-2026-109618 & CVE-2026-109619) Shake 70% of the Web

The global cybersecurity community has been placed on highest alert following the coordinated disclosure and active exploitation of two critical remote code execution (RCE) vulnerabilities residing deep in the engine of the PHP programming language. Tracked collectively as "PHP2Shell", the flaws carry a severity score of 9.2 Critical (CVSS v4.0) and affect installations from legacy PHP 5.4 all the way to current PHP 8.5 releases.

Because PHP currently powers nearly 70% of all websites across the global internet, cloud infrastructure providers, government cyber defense agencies, and enterprise security operations centers (SOCs) are actively scrambling to mitigate weaponized exploitation scans detected at scale.

The Technical Mechanics: longjmp() Memory State Corruption

The root vulnerabilities—cataloged as CVE-2026-109618 and CVE-2026-109619—reside in the error handling subroutines of the Zend Engine when processing fatal out-of-memory (OOM) conditions:

• CVE-2026-109618 (Uninitialized Memory via OOM): When a request triggers an out-of-memory fault, the runtime utilizes low-level C library longjmp() calls to recover execution. However, improper control-flow management leaves internal request buffers uninitialized. An attacker can craft anomalous HTTP requests that deliberately trip memory limits, gaining control over execution registers.
• CVE-2026-109619 (Stale Global State & Use-After-Free): Following fatal memory cleanups, pointers in global state memory continue referencing deallocated memory regions. When subsequent HTTP requests are routed to the same persistent worker thread (standard in PHP-FPM and FrankenPHP environments), arbitrary memory can be read or executed.

"These vulnerabilities represent an architectural blind spot that persisted unnoticed for over a decade. Attackers can trigger reliable remote code execution with the exact permissions of the web server worker without needing prior authentication."

Active In-the-Wild Exploitation & CISA Warning

Global threat intelligence networks—including Cloudflare, Arctic Wolf, and watchTowr—observed automated weaponized scanning within hours of initial proof-of-concept leaks. Telemetry indicates automated botnets scanning public IP blocks for exposed Apache mod_php and Nginx/PHP-FPM instances, attempting to drop persistent web shells and cryptominers.

The Cybersecurity and Infrastructure Security Agency (CISA) has taken the emergency step of adding both vulnerabilities directly to its Known Exploited Vulnerabilities (KEV) Catalog, mandating immediate remediation for all federal and enterprise systems.

Remediation Matrix: Official Patching Guide

The official PHP development team has released emergency point releases across all active branches. System administrators must upgrade package repositories immediately:

Immediate Defense-in-Depth Mitigation Steps

If full system patching cannot be executed immediately due to deployment schedules, security engineers must enforce the following containment guardrails:

1. Drop Worker Privileges: Configure systemd units with ProtectSystem=strict, NoNewPrivileges=yes, and ProtectHome=yes to prevent arbitrary file writes outside temporary directories.
2. Egress Firewalling: Disallow outbound socket connections from web worker pools to prevent downloaded second-stage command-and-control scripts.
3. Enable Edge WAF Rules: Activate Cloudflare or AWS WAF managed rulesets targeting anomalous request payloads and oversized chunked transfer requests.