Critical PHP Vulnerability Alert (CVE-2026-109618 & CVE-2026-109619): Complete Technical Breakdown and Remediation Guide for Australian Businesses

A widespread cybersecurity emergency unfolded when national cyber security agencies—including the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), the UK National Cyber Security Centre (NCSC), CERT-EU, and the US National Security Agency (NSA)—issued urgent advisories regarding the core PHP runtime engine. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, these critical flaws carry a CVSS v4.0 score of 9.2 (Critical) and affect up to 70% of web servers globally.

Because the vulnerabilities exist inside PHP's low-level C memory allocator and request lifecycle routines, unauthenticated remote attackers can achieve Remote Code Execution (RCE) before a single line of application code—or any CMS security plugin—executes. This guide provides a complete technical dissection of the engine flaws, the role of frontier AI models in discovering them, and a step-by-step remediation and forensic verification protocol for Australian engineering teams.

Key Takeaways

• Pre-Application Remote Code Execution: CVE-2026-109618 (Out-of-Memory longjmp() heap teardown corruption) and CVE-2026-109619 (persistent worker stale global state use-after-free) execute inside the Zend Engine before WordPress, Drupal, Laravel, or Magento application logic loads.
• Mandatory Patched Versions: Organisations must immediately upgrade to PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, or PHP 8.2.35 (or verified Linux LTS backport builds) and explicitly restart all php-fpm, apache2, FrankenPHP, or container worker pools.
• Australian GovCMS & Enterprise Impact: Over 400 Australian government agency websites on the Drupal-based GovCMS platform were placed into precautionary maintenance mode while emergency patches were rolled out across Canberra and state digital estates.
• ACSC Essential Eight 48-Hour Mandate: Under the ACSC Essential Eight Maturity Model, critical internet-facing application vulnerabilities with active exploit paths require remediation within 48 hours to maintain compliance and preserve cyber insurance coverage.
• Immediate Assessment & Support: Benchmark your patching and endpoint posture in under four minutes with our free Essential Eight Assessment Tool and Cyber Risk Score Calculator, or contact AgenorIT for emergency Cloud Security & Governance assistance.

1. The Global & Australian Security Incident: What Happened & Why It Matters

Because PHP powers nearly 70% of all websites with a known server-side programming language—including foundational Content Management Systems (CMS) such as WordPress, Drupal, Joomla, and Adobe Commerce (Magento), alongside custom Laravel and Symfony portals—the disclosure of unauthenticated core RCE flaws triggered precautionary takedowns of critical digital infrastructure worldwide.

In Australia, the operational impact was immediate across both public and private sector web estates:

• Public Sector & GovCMS Response: More than 400 federal and state government agency websites hosted on the centralized GovCMS platform (built on Drupal and managed by the Department of Finance) were temporarily taken offline or placed into static maintenance mode while infrastructure engineers deployed emergency runtime updates and verified container worker pools.
• Global Infrastructure Takedowns: Parallel precautionary shutdowns occurred across the United Kingdom, France, the Netherlands, Finland, and Japan, temporarily disrupting municipal portals, financial services platforms, digital identity gateways, and e-commerce storefronts.
• Active Threat Telemetry: Honeypot networks operated by Amazon Threat Intelligence (MadPot) and Cloudflare recorded automated reconnaissance and exploitation probes targeting internet-facing PHP endpoints and worker pools within hours of the coordinated disclosure.

Because the PHP interpreter sits at the foundation of the LAMP/LEMP stack, an unauthenticated RCE grants an adversary execution privileges under the web worker system account (such as www-data, nginx, or apache). From that foothold, attackers can read wp-config.php or .env secrets, exfiltrate database credentials, inject persistent web shells into static asset directories, deploy ransomware, or pivot laterally into internal cloud virtual networks.

2. Technical Deep Dive: Dissecting the PHP Core Flaws

Understanding the mechanics of PHP2Shell is essential for systems architects and DevOps engineers evaluating their exposure. Both primary vulnerabilities originate in low-level C engine operations inside the Zend Engine and SAPI (Server Application Programming Interface) layers that govern memory allocation, error handling, and request teardown across Apache (mod_php), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

CVE-2026-109618: Remote Code Execution via Out-of-Memory (OOM) Corruption

The first vulnerability, tracked as CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), stems from improper control-flow recovery when memory allocation fails inside the Zend Memory Manager (ZMM). PHP enforces its configurable memory_limit directive by invoking _zend_bailout()—which executes a C longjmp() jump back to the top-level error handler—whenever an allocation request exceeds the permitted per-request memory ceiling.

When an Out-of-Memory (OOM) condition is triggered at a precise point during pre-script request parsing—specifically while parsing multipart/form-data bodies or initializing file upload structures—execution is abruptly interrupted via longjmp() while internal SAPI and global request structures remain only partially initialized:

1. Heap Layout Grooming: An unauthenticated attacker sends preliminary HTTP payloads to shape the Zend heap layout so specific memory chunks contain attacker-controlled values where pointers will later be expected.
2. Mid-Initialization Bailout: A crafted multipart/form-data request forces an allocation failure right after a composite structure is allocated, but before its child pointers are zeroed or assigned valid addresses.
3. Corrupted Request Teardown: During php_request_shutdown(), the engine's cleanup routines iterate over the partially initialized request structure, treating uninitialized or stale attacker-controlled bytes as valid pointers and passing them to efree().
4. Arbitrary Free to RCE: By forcing the Zend allocator to free a fake chunk header under attacker control, the attacker corrupts the internal free-list bins, overwrites function pointers inside the worker process, and achieves deterministic Remote Code Execution.

CVE-2026-109619: Remote Code Execution via Stale Global State

The second vulnerability, tracked as CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), involves global state pollution across persistent web worker processes. High-performance PHP deployments rely on persistent worker pools—such as PHP-FPM children, Apache prefork/worker processes with mod_php, or FrankenPHP workers—where a single OS process handles thousands of sequential HTTP requests before recycling.

When a request encounters a fatal error during specific initialization or upload-tracking routines, internal global state pointers owned by that request can survive even after their backing heap memory has been reclaimed by the request-scoped allocator:

• Stage 1 (State Pollution): The attacker dispatches a crafted HTTP request that triggers session.upload_progress or fatal-error backtrace generation and deliberately induces a fatal bailout. The Zend Memory Manager frees the request heap, but a global state pointer remains non-NULL.
• Stage 2 (Use-After-Free Exploitation): A subsequent HTTP request routed to the same worker process accesses or branches on that stale, dangling global pointer before standard php_request_startup() routines reinitialize the structure. This classic Use-After-Free (UAF) condition allows the second request to pivot execution flow into attacker-supplied heap data.

CVE-2026-115560: Secondary Session Serialization Vector

Alongside the two critical RCE flaws, the PHP Foundation issued a defense-in-depth advisory for CVE-2026-115560. This vulnerability affects applications that dynamically alter the session serialization handler at runtime—specifically switching from php_binary or php_serialize to the legacy php serializer via ini_set('session.serialize_handler', 'php')—while session.upload_progress remains enabled. In applications exhibiting this pattern, an attacker can inject pipe-delimited (|) serialized PHP object payloads via upload progress metadata, triggering PHP Object Injection during session deserialization.

3. The AI Dimension: How Frontier LLMs Uncovered 14-Year-Old Engine Bugs

One of the most consequential aspects of the PHP2Shell disclosure for CTOs and CISOs is how these vulnerabilities were discovered. The underlying longjmp() memory teardown flaw had lurked inside the PHP C codebase for more than 14 years, originating in architectural changes introduced in PHP 5.4 back in 2012.

Although early symptoms of unsafe longjmp() state transitions were noted during a 2024 security audit conducted by Quarkslab for the PHP Foundation, the finding was classified as low priority at the time. Human security auditors lacked a deterministic, reproducible exploit chain and warned that refactoring the core bailout mechanism carried high risk of breaking binary compatibility across third-party C extensions.

In August 2026, two independent AI-driven vulnerability research initiatives changed that assessment:

• Calif & OpenAI ("Patch the Planet"): Security researchers at Calif, operating under OpenAI's Patch the Planet defensive initiative, paired static taint analysis with frontier reasoning models (GPT-5.6 Sol) to trace every allocation site reachable prior to php_execute_script(). The model synthesized a deterministic heap-grooming and multipart/form-data OOM sequence that proved unconditional RCE.
• Wiz Research (Wiz Atlas & Gemini 4 Argon): Simultaneously, autonomous vulnerability discovery agents operated by Wiz independently identified both CVE-2026-109618 and the persistent-worker stale state vector (CVE-2026-109619), validating working exploit payloads across default PHP-FPM and Apache containers.

Why This Matters for Enterprise Patch SLAs: Frontier AI models have compressed the time required to trace complex C/C++ control-flow edge cases and construct working heap exploits from months to hours. While defensive AI teams responsibly disclosed these flaws to the PHP Foundation, opportunistic threat actors now use similar LLM-assisted binary diffing tools to reverse-engineer published security patches within minutes of release. The traditional 30-day enterprise patching cycle is obsolete for internet-facing runtimes.

4. Immediate Action Plan for Australian & Global Businesses

Organisations operating PHP workloads across cloud virtual machines, Kubernetes clusters, PaaS environments, or shared cPanel/Plesk hosts must take structured, immediate action to verify their live worker binaries, deploy patched builds, and flush stale processes from memory.

Official Patched PHP Releases

The PHP Foundation has published emergency security releases across all actively supported branches, alongside minimal source patches for Linux distribution maintainers backporting fixes to legacy LTS branches:

5-Step Engineering Remediation & Verification Protocol

A common failure mode during emergency patching is updating the system package on disk while leaving long-running php-fpm worker pools executing the vulnerable binary in RAM—or checking php -v on the CLI while the web server runs a different PHP branch entirely. Execute this five-step protocol to guarantee complete remediation:

Step 1: Audit Both CLI and Live Web Worker Binaries

Do not rely solely on php -v in an SSH shell. Inspect the exact php-fpm master and child processes actively bound to your UNIX sockets or TCP ports (9000):

# Check all installed PHP-FPM binaries and active systemd units
systemctl list-units --type=service | grep -E 'php|apache|httpd|lsws|frankenphp'

# Inspect the exact binary path and version of the running PHP-FPM master process
for pid in $(pgrep -f "php-fpm: master"); do
  exe_path=$(readlink -f /proc/$pid/exe)
  echo "PID $pid -> $exe_path : $($exe_path -v | head -n 1)"
done

Step 2: Apply Vendor & Distribution Security Packages

Update packages via your OS package manager or rebuild container base images (php:8.4.27-fpm-alpine, php:8.3.36-fpm-bookworm):

# Debian / Ubuntu (including Ondřej Surý PPA)
sudo apt-get update && sudo apt-get install --only-upgrade -y 'php*'

# RHEL / AlmaLinux / Rocky Linux / Amazon Linux
sudo dnf upgrade --refresh -y 'php*'

For Ubuntu LTS (22.04 Jammy, 24.04 Noble) or RHEL 8/9 servers running vendor-maintained PHP 8.1 or 8.2 builds where the upstream version string remains 8.1.x or 8.2.x, verify that the distribution changelog explicitly includes the backported patches for CVE-2026-109618 and CVE-2026-109619:

# Verify CVE patch inclusion in Debian/Ubuntu package changelog
apt-get changelog php8.3-fpm | grep -E "CVE-2026-109618|CVE-2026-109619"

# Verify CVE patch inclusion on RHEL / AlmaLinux / Rocky Linux
rpm -q --changelog php-fpm | grep -E "CVE-2026-109618|CVE-2026-109619"

Step 3: Restart All Web Process Workers & Check for Unflushed RAM Binaries

Updating files on disk does not terminate active worker processes holding old shared libraries in memory. Restart the worker service and verify that zero processes reference (deleted) shared objects in /proc:

# Restart PHP-FPM and Apache/Nginx services
sudo systemctl restart php8.4-fpm php8.3-fpm php8.2-fpm apache2 nginx 2>/dev/null || true

# Verify no running php-fpm worker still maps a deleted (pre-patch) binary in memory
sudo grep -l "deleted" /proc/$(pgrep -d, -f php-fpm | tr ',' ' ' | awk '{print $1}')/maps 2>/dev/null || echo "Clean: All workers running current on-disk binaries"

Step 4: Temporary Hardening Mitigations (If Immediate Upgrade Is Blocked)

If legacy application dependencies prevent an immediate binary upgrade, deploy an emergency FPM pool override (/etc/php/*/fpm/pool.d/zz-cve-2026-109618-mitigation.conf) using php_admin_value and php_admin_flag so application scripts cannot override the settings via ini_set() or .htaccess:

; Emergency Mitigation Override for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560
; Note: Apply only as a temporary control until PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 is deployed.

[www]
; Mitigation for CVE-2026-109618: Prevent PHP-level memory_limit longjmp() bailout during request init.
; Enforce memory ceilings at the OS cgroup / container boundary instead.
php_admin_value[memory_limit] = -1

; Strict request body & upload size bounds (keep upload_max_filesize strictly below post_max_size)
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 4M
php_admin_value[max_file_uploads] = 5

; Mitigation for CVE-2026-109619 & CVE-2026-115560: Disable session upload progress tracking
php_admin_flag[session.upload_progress.enabled] = off
php_admin_flag[session.upload_progress.cleanup] = on

; Mitigation for PHP 8.5 fatal error state retention
php_admin_flag[fatal_error_backtraces] = off

; Recycle worker processes more aggressively to limit persistent heap grooming
pm.max_requests = 200

Important Engineering Caveat: Setting memory_limit = -1 disables PHP's internal per-request allocator ceiling to prevent controlled _zend_bailout() jumps, meaning you must enforce memory limits at the Linux systemd slice (MemoryMax=) or Docker/Kubernetes container cgroup level to prevent Denial-of-Service (DoS) exhaustion. Mitigations reduce known exploit paths but do not replace upgrading the PHP binary.

Step 5: Hunt for Pre-Patch Exploitation & Indicators of Compromise (IOCs)

Because heap layout grooming and OOM triggers frequently cause worker crashes before an attacker achieves clean code execution, inspect your php-fpm error logs and web server access logs for anomalous signals around the disclosure window:

# 1. Check PHP-FPM logs for worker segmentation faults (SIGSEGV / 11) or aborts (SIGABRT / 6)
sudo grep -E "SIGSEGV|SIGABRT|exit code (139|134)|Allowed memory size of" /var/log/php*-fpm.log

# 2. Check Nginx/Apache access logs for anomalous POST multipart requests returning 500/502/503
sudo awk '$6 ~ /"POST/ && ($9 == 500 || $9 == 502 || $9 == 503) {print $1, $4, $6, $7, $9, $10}' /var/log/nginx/access.log | tail -n 50

# 3. Scan web roots for recently modified PHP files (potential post-exploitation web shells)
sudo find /var/www -type f -name "*.php" -mtime -7 -ls

5. Australian Regulatory & Compliance Impact: Essential Eight & Privacy Act

For Australian CTOs, CISOs, and IT Directors, CVE-2026-109618 and CVE-2026-109619 are not merely technical maintenance items—they directly intersect with mandatory national cybersecurity frameworks, cyber insurance policy warranties, and statutory privacy obligations.

You can evaluate your organisation's exposure across these regulatory pillars using our interactive Essential Eight Maturity Assessment, Privacy Act Exemption Checker, and Australian Data Breach Cost Estimator.

6. Enterprise Decision Framework for Systems & Web Teams

Use this structured decision tree adapted from national cyber agency guidance and AgenorIT's incident response playbook to triage every workload in your environment:

Start Here: Does your application, CMS, or API use PHP?
 │
 ├── [No: Next.js / .NET / Node / Static Edge] ──> Unaffected by PHP2Shell. No action required.
 │
 └── [Yes] ──> Do you manage the PHP runtime in-house (VMs, Containers, PaaS)?
       │
       ├── [Yes: In-House Management] ──> Is your PHP branch actively supported (PHP 8.2 – 8.5)?
       │     │
       │     ├── [Yes] ──> Upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
       │     │             Restart php-fpm / Apache workers and verify /proc/<pid>/maps.
       │     │
       │     └── [No: End-of-Life PHP 5.x, 7.x, 8.0, 8.1] ──> Isolate or take system offline.
       │           Apply verified Linux LTS vendor backport or migrate runtime to PHP 8.3/8.4.
       │
       └── [No: Managed Hosting / GovCMS SaaS / Third-Party Vendor] ──> Is the service internet-facing?
             │
             ├── [Yes] ──> Obtain written patch & worker-restart confirmation from host.
             │             Enforce WAF multipart/upload inspection and origin IP locking.
             │
             └── [No: Internal Network Only] ──> Restrict access strictly to VPN / Jump Hosts.
                   Schedule vendor patch verification within your 48-hour maintenance window.

7. Architectural Prevention: Eliminating Interpreter RCE via Decoupled Web Platforms

While emergency patching resolves the immediate CVE-2026-109618 and CVE-2026-109619 threat, the PHP2Shell incident highlights a broader architectural reality: monolithic server-rendered CMS platforms expose a massive C-interpreter and database attack surface to every unauthenticated internet request.

Many Australian organisations run WordPress, Drupal, or Joomla solely to serve corporate marketing pages, investor relations portals, and lead-capture forms—yet every page view invokes a stateful PHP worker connected directly to a relational database.

When AgenorIT modernises legacy PHP estates through our Corporate Websites & Web Presence and Custom Web Application Development practices, we eliminate this class of vulnerability by design:

1. Static & Edge-Rendered Frontends (Next.js & TypeScript): Public-facing pages are pre-rendered into immutable static assets served from global CDN edge nodes (Cloudflare, Vercel, or Azure Front Door). There is no PHP interpreter, no multipart/form-data worker pool, and no SQL database reachable from public page requests.
2. Isolated Serverless API Boundaries: Form submissions and interactive tools run inside ephemeral, memory-safe TypeScript serverless functions protected by strict schema validation and rate limiting.
3. Zero-Trust Identity Delegation: Customer and staff portals delegate authentication to Microsoft Entra External ID rather than storing password hashes inside a CMS database table.

If your organisation is spending recurring engineering hours patching legacy WordPress or Drupal servers, explore our guide on 10 Signs Your Website Needs an Upgrade and model the cost of transitioning to a modern Next.js platform using our Website Cost Calculator Melbourne.

8. Partner with AgenorIT for Emergency Remediation & Infrastructure Hardening

Navigating zero-day and emergency runtime disclosures across hybrid cloud environments, legacy containers, and enterprise web estates requires senior engineering precision.

At AgenorIT, our Melbourne-based cloud security and software engineering team provides rapid, hands-on technical support for Australian businesses:

• Emergency PHP Estate Auditing & Patching: Rapid discovery of exposed PHP runtimes across Azure, AWS, GCP, and on-premises Linux fleets, followed by zero-downtime upgrades and worker pool verification.
• Forensic Log Triage & Compromise Assessment: Deep inspection of FPM crash telemetry, web server access logs, and filesystem integrity to verify your servers were not compromised prior to patching.
• ACSC Essential Eight Uplift: End-to-end engineering implementation of Essential Eight Consulting controls, automated vulnerability scanning, and Azure WAF / Cloudflare origin protection.
• Legacy CMS to Next.js Modernisation: Fixed-scope migration of vulnerable monolithic PHP websites into sub-second, zero-maintenance Corporate Websites.

Book a 20-minute technology consultation or send your infrastructure requirements to speak directly with Principal Architect Gurinder Singh today.