php2shell and what we did
CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560 · October 23, 2026
What happened
On October 21, 2026, PHP shipped emergency fixes for two critical, actively-exploited RCE vulnerabilities in the core — collectively called “php2shell”:
- CVE-2026-109618 — heap use-after-free via session.upload_progress
- CVE-2026-109619 — OOM corruption / session handler mismatch
Both score CVSS 9.2, both are unauthenticated, and both are in PHP core — meaning every site served by a vulnerable PHP-FPM pool is at risk, regardless of the CMS or application on top. In-the-wild exploitation began on October 17, four days before disclosure.
Two days later, on October 23, PHP published an informational advisory for a third, lower-severity issue in the same feature: CVE-2026-115560 — an “unlikely RCE vector” that only triggers when an application uses a non-default session.serialize_handler (php_binary or php_serialize) and switches it to php at runtime via ini_set() before session_start(), with upload progress still enabled. PHP is not issuing an emergency patch for this one; the fix lands in the next routine release (expected mid-to-late November). The recommended mitigation in the meantime: disable session.upload_progress entirely.
What we did
Patch (Oct 21)
The only complete fix for 109618/109619 is to update PHP. We upgraded both affected PHP hosts to the fix-line builds and verified FPM parity — the web-serving SAPI the exploit targets:
| Site | Before | After | Fix line | Status |
|---|---|---|---|---|
| c0urier.net | 8.5.11 | 8.5.12 | 8.5.12 | closed |
| nordisk.cloud | 8.4.x | 8.4.27 | 8.4.27 | closed |
Both sites re-verified serving 200 post-upgrade.
Compromise sweep (Oct 21)
Because the hosts were below the fix line until the morning of the 21st and the campaign was already in the wild, we swept for signs of earlier compromise:
- session.upload_progress / uploadprogress grep across nginx access and error logs on both hosts — no exploit traffic
- OOM/crash signatures — none
- New/unexpected .php files in webroots — none
Verdict: clean.
Defense in depth (Oct 21–22)
As a precaution following the php2shell patches, and in direct response to the CVE-2026-115560 advisory, we set:
; php.ini (all PHP-FPM pools) echo 'session.upload_progress.enabled = Off' > /etc/php/8.*/fpm/conf.d/99-disable-upload-progress.ini
This disables the session.upload_progress feature entirely. It has near-zero legitimate use in modern applications, and disabling it closes both the php2shell attack surface and the CVE-2026-115560 vector until the routine PHP release lands.
IDS detection (Oct 22)
We authored and validated a custom Suricata ruleset for our firewall — 12 SIDs covering all known php2shell exploit primitives:
- PHP_SESSION_UPLOAD_PROGRESS in multipart POST body
- PHPSESSID as multipart form field (session fixation)
- PHP code in upload filename (session injection)
- Serialized object in filename (handler mismatch)
- Oversized upload body (session inflation)
- Chunked Transfer-Encoding POST (post_max_size bypass)
- Session file path in URI (LFI)
- PHP OOM error in response body
- Anomalous PHPSESSID in response cookie (heap leak)
- Reconnaissance probe (thresholded)