PHP2Shell: Active Exploitation Reports

Technical Characteristics & Attack Execution

Unlike application-specific bugs isolated to platforms like WordPress or Drupal, PHP2Shell resides directly within the PHP engine's memory management and bailout routines (affecting multipart form-data handling and memory exhaustion conditions).

• The Core Mechanism: CVE-2026-109618 involves out-of-memory error handling where abrupt engine bailouts via longjmp() leave partially initialized internal data or request memory uncleaned. CVE-2026-109619 involves persistent state management flaws.
• Reliability Factors: While the potential attack surface covers a vast percentage of internet-exposed PHP servers, successful exploitation requires precise alignment of the PHP build, process model (such as single-worker mod_php configurations), and heap memory conditions. Consequently, exploitation attempts in the wild have varied in success rate, though automated scanners continue to aggressively probe for vulnerable endpoints.

Incident Response & Remediation Guidance for Canadian Organizations

Given that exploitation attempts have been observed predating official patch cycles, standard log reviews starting merely from the disclosure date will miss early indicators of compromise. Security teams should immediately execute the following steps:

1. Expand Forensic Look-Back Windows: Initiate threat hunting and log inspections back to at least October 17, 2026. Scan web server access logs for anomalous, oversized multipart POST requests, unusual parameter strings (such as unexpected payloads involving upload progress tracking), and unauthorized process spawns by the web server user.
2. Verify Engine-Level Patching: Ensure PHP runtimes are fully upgraded to the patched releases (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 or vendor-backported equivalents). Merely updating content management systems or application plugins is insufficient, as the flaw exists at the core language interpreter level.
3. Inspect Upstream Infrastructure: For enterprises utilizing virtual appliances, load balancers, or custom web stacks embedding PHP runtime environments, verify that underlying vendor firmware and container base images have been rebuilt and updated.