Critical Vulnerabilities in PHP CVE-2026-109618 and CVE-2026-109619
Threat Brief: Critical Vulnerabilities in PHP 🚨
Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). The vulnerabilities are being referred to as PHP2Shell. We encourage reviewing the PHP Group’s security advisory and patching guidance. PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately.
Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.
Details of the Vulnerabilities:
- CVE-2026-109618: Involves a remote code execution vulnerability where handling out-of-memory errors via
longjmp()leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers. - CVE-2026-109619: Describes a remote code execution vulnerability where
longjmp()fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.
Attack Observations:
Unit 42 researchers also observed attackers using agentic AI attack platforms for post-exploitation activity. In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation, they had successfully accessed password hashes and multi-factor authentication secrets. They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.
The commands and behavioral markers used in the attack are strong indicators of an agentic attacker. Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==. These delimiters produce machine-parseable output for an AI model to read. We also noted the use of short, serially spaced tasks and quick pivots after failures.
Exposure Assessment:
At the time of publication, Palo Alto Networks Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry. The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit these CVEs across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation.
We recommend assessing your exposure to these vulnerabilities and patching immediately.