By UNST33R
PHP2Shell: pre-auth RCE in core PHP, found by AI agents
CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers execute code on stock PHP 8.2 through 8.5, before any application code runs. Patch matrix, interim mitigations, and how to run the same AI-assisted patch triage Wiz used.
On October 21, 2026, PHP shipped emergency releases fixing two unauthenticated remote code execution flaws in the engine itself, application code irrelevant (official advisory). Wiz Research found them using frontier AI models and every PHP release of the last decade, back to 5.4, is affected by at least one of the two (Wiz, Oct 21). Both CVEs score 9.2 on CVSS 4.0. A public PoC against Apache mod_php on PHP 8.4.26 (3em0/php2shell) landed within hours.
The two bugs
| CVE | Mechanism | Trigger primitive |
|---|---|---|
| CVE-2026-109618 | OOM corruption: PHP longjmp()s out of a failed allocation while request data is half-initialized; request cleanup then treats that memory as valid | Controllable memory-limit exhaustion (large request bodies, post_max_size) |
| CVE-2026-109619 | Stale global state: pointers into request memory survive free(); the next request on the same worker branches on them before initialization | Request-shape crafting, e.g. session.upload_progress teardown paths |
Wiz also documents Heartbleed-style memory disclosure from the same root causes: passwords, tokens, and keys from other requests leaking across workers.
Patch matrix
| Branch | Fixed in | Notes |
|---|---|---|
| 8.2.x | 8.2.35 | Also 8.3.36, 8.4.27, 8.5.12; all SAPIs affected (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed) |
| 8.1 and older | backports or vendor LTS | PHP 7.4/8.0/8.1 minimal source backports published for source builders |
mod_php carries the highest risk: the demonstrated exploit fires from a single unauthenticated request before any application code executes. Interim mitigations if you cannot update today: force memory_limit = -1 via php_admin_value, cap post_max_size (8M without uploads, 32M with), and enforce decoded body, multipart-part, and header-count limits at the proxy. These reduce exposure to specific paths; only the update fixes the engine.
The part that changes your job
Wiz's own framing: the flaws sat in the codebase for a decade, but building a working chain was "at the edge of what human researchers could practically achieve." Frontier models adapted working exploits to multiple target memory layouts in hours. When exploit-building cost collapses, memory-safety bug classes that everyone ignored become reportable findings (Vals AI CyberBench already grades exactly this: working crash PoCs plus source patches).
You can run the same workflow on this disclosure. Feed the fix commits behind 8.2.35 through 8.5.12 to an agent tier and have it map reachable OOM paths, write regression tests, and hunt variant cleanup sites your own PHP extensions hit:
curl https://api.unst33r.si/v1/chat/completions \
-H "Authorization: Bearer $UNST33R_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"unst33r-deepseek","messages":[{"role":"user","content":"Diff the fix commits for CVE-2026-109618 across php-8.2..8.5. List every cleanup path that reads request memory after an OOM longjmp, rank by external reachability, and draft a PHP regression test for each."}]}'
unst33r-deepseek ($1.20/$3.20 per M tokens) fits patch-diff and PoC analysis (73.69% CyberBench); use unst33r-pro for long multi-repo triage loops.
Study public PoCs only in isolated labs you own, per the acceptable-use policy. Get an API key or compare tiers for security work in our tier guide.