PHP2Shell: Chained RCE Compromises PHP Web Infrastructure and Broadcom VMware ESX Hypervisors

PHP2Shell is a critical, pre-authentication remote-code-execution chain targeting the PHP runtime by combining CVE-2026-109618 (OOM memory corruption during multipart request cleanup) and CVE-2026-109619 (use-after-free via stale session upload-progress state). Exploitation occurs prior to application-level execution, significantly impacting Apache mod_php environments. Observed attacks have successfully pivoted from PHP-based web servers to Broadcom VMware ESX hypervisors, compromising approximately 25 servers, including U.S. government-linked infrastructure. Despite emergency patches released in October 2026, telemetry from OX Security indicates a severe remediation gap, with over 99% of exposed instances remaining unpatched.

• Vulnerability Mechanics: CVE-2026-109618 and CVE-2026-109619

  • CVE-2026-109618: Out-of-memory (OOM) memory corruption during multipart parsing triggers invalid request cleanup before application code executes.
  • CVE-2026-109619: Use-after-free via stale global/session state; php_session_rfc1867_callback consumes uninitialized decoder states.
  • PHP 8.5 fatal_error_backtraces (enabled by default) is a confirmed exploitation path for consuming stale state.

• Affected SAPIs and Exploitation Scope

  • Highest-risk SAPI: Apache mod_php; secondary risks include PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
  • Vulnerable software ecosystem: WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento.
  • Impacted infrastructure: Attackers successfully pivoted from PHP web layers to Broadcom VMware ESX hypervisors, affecting U.S. government-linked sites.

• Exploitation Status and Remediation Gap

  • Massive exposure: OX Security tracked 2.2 million exposed instances, with only ~0.7% patched within the first 24 hours.
  • Rapid weaponization: AI-assisted research has accelerated the development of public scanners and chained attack payloads.
  • Threat landscape: While initial PoCs were reported as build-dependent, highly reliable and portable exploits are expected to emerge quickly.

• Detection and Mitigation Strategies

  • Primary remediation: Immediate application of official PHP security releases or vendor-specific backports for versions 7.4 through 8.5.
  • Administrative hardening: Disable session.upload_progress.enabled=0 and fatal_error_backtraces=0 (for PHP 8.5) via php.ini.
  • Network defenses: Implement WAF/reverse proxy rules to block multipart/form-data on routes that do not explicitly require file uploads.
  • Tooling: Deploy php2shell-scanner (Searchlight Cyber) or insignary-chk (Insignary) to audit environment exposure.