php2shell
PHP runtime flaws can affect applications even when their themes, plugins, and business logic are current. The first two php2shell CVEs have known exploitation reports. The related session-upload issue has a narrower configuration requirement.
Check the PHP runtime serving real traffic, including container images and PHP-FPM services. Verify each CVE against its own vendor advisory; do not infer that a plugin update fixed the runtime.
What happened
CVE-2026-109618 and CVE-2026-109619 involve unsafe PHP memory handling during unusual request-failure conditions. Untrusted HTTP traffic can trigger a crash, disclosure, or code-execution condition in affected runtimes. CISA added the original two CVEs to its Known Exploited Vulnerabilities catalog on October 26.
CVE-2026-115560 is related but must be assessed separately. PHP describes a session-upload-progress path that depends on runtime session configuration and application code switching the session serializer before session_start(). Its exploitation status cannot be inferred from the first two CVEs.
The actual application runtime matters. The version printed by a shell's `php -v` may differ from a PHP-FPM pool, Apache module, managed hosting service, or container image. Establish the build that serves requests.
Where to look
- Internet-facing PHP applications, including CMS products and custom web services.
- PHP-FPM pools and Apache-integrated PHP modules, including replicas inside OpenShift deployments.
- The session-upload-progress follow-up only where its vendor-defined runtime and application conditions exist.
Initial investigation
- Inventory running PHP services and identify the image digest or package providing each runtime.
- For CVE-2026-109618 and CVE-2026-109619, compare the deployed runtime with the PHP or distribution vendor's patched build.
- Review the effective session.upload_progress.enabled and session.serialize_handler settings, plus application serializer changes, for CVE-2026-115560.
- Record any WAF protections, their actions, and direct-to-origin bypass paths as compensating controls.
Operator commands
READ-ONLY EXAMPLESUse these commands to collect evidence. Confirm the running service and vendor security fix before assigning patch status.
php -v
rpm -qa | grep -E '^php(-|$)'
ps -ef | grep '[p]hp-fpm'php -i | grep -E 'session\.(upload_progress\.enabled|serialize_handler)'Remediation plan
- Patch the PHP runtime using the vendor's security release, or apply the distribution's documented fixed/backported packages.
- Follow the PHP session upload progress advisory separately, including its configuration workaround and any newer fixes.
- Rebuild and restart deployed containers or PHP services so the patched runtime handles live traffic. Verify all replicas.
- Keep web controls active during patch rollout and investigate suspicious requests as a separate incident-response task.
Evidence to retain
- Application URL, service owner, PHP handler type, and active runtime package or image.
- Per-CVE applicability determination and vendor proof of fix.
- Session configuration and relevant application code review for CVE-2026-115560.
- Observed WAF actions, direct-origin exposure, and post-update runtime confirmation.
References
EXTERNAL SOURCESRead the analysis on Ops Den. Open a reference only when you need the current vendor release or primary evidence.
Track your environment
Saved only in this browser. Ops Den does not receive or store your selections.