PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

The PHP2Shell exploit targets a critical remote code execution (RCE) vulnerability identified as CVE-2026-109618 affecting PHP core versions after 5.4, specifically demonstrated against PHP 8.4.26 running with mod_php in a prefork Apache environment. The vulnerability leverages a complex multi-stage heap exploitation chain that abuses PHP's session upload progress feature and Zend Engine internals to achieve arbitrary code execution. The exploit initiates with HTTP worker rotation to manipulate PHP's memory allocator state, followed by leaking heap and libphp base addresses via crafted Set-Cookie headers exploiting Zend Memory Manager (Zend MM) and ZVAL destructor (ZVAL_PTR_DTOR) behaviors. These leaks bypass Address Space Layout Randomization (ASLR) by calculating offsets relative to known base addresses. The final stage crafts a fake HashTable structure in memory, overwriting the pDestructor function pointer with the address of the system() function (zif_system), enabling execution of arbitrary shell commands embedded within a 167-byte zend_string payload. The exploit is constrained by a maximum command length of 14 bytes due to payload layout but supports chaining for longer commands. It requires specific PHP configuration settings such as display_errors=1, memory_limit=8M, max_input_vars=1000, session.use_cookies=1, session.use_strict_mode=0, and session.upload_progress.enabled=1, as well as a single-worker prefork Apache setup. The code is sophisticated, employing low-level memory manipulation, multi-threaded HTTP request handling, and precise offset calibration to reliably exploit the target. Detection can focus on anomalous multipart/form-data POST requests with unusual Set-Cookie headers, unexpected session upload progress activity, and creation of suspicious files from shell commands. Forensics may reveal heap corruption patterns and unexpected system calls within PHP processes.

In real-world scenarios, this exploit enables attackers to execute arbitrary commands on vulnerable PHP web servers, effectively gaining full remote control. Attackers can deploy web shells, pivot within internal networks, exfiltrate sensitive data, or disrupt services. The exploit's reliance on HTTP traffic makes it stealthy and easy to weaponize in phishing campaigns or automated scanning tools. Enterprises hosting PHP-based web applications, government agencies relying on legacy or containerized PHP environments, and critical infrastructure with exposed web interfaces are at high risk. The exploit can be integrated into multi-stage attack chains, starting with reconnaissance and vulnerability scanning, followed by exploitation and lateral movement. Secondary impacts include persistent backdoors, data breaches, and supply chain compromises if exploited in development or CI/CD environments. The exploit's ability to bypass ASLR and execute system commands with minimal privileges amplifies its threat, potentially leading to full system compromise and long-term persistence.

Immediate containment requires disabling vulnerable PHP versions and restricting access to affected web servers. Administrators should apply official PHP patches addressing CVE-2026-109618 promptly. Network segmentation should isolate web-facing servers from critical internal resources, and strict access controls should limit administrative interfaces. Deploy Web Application Firewalls (WAFs) with custom detection rules to identify suspicious multipart/form-data requests, anomalous Set-Cookie headers, and unusual session upload progress activity. Monitor logs for unexpected file creations or command execution traces. Implement runtime application self-protection (RASP) and endpoint detection and response (EDR) solutions to detect exploitation attempts. Long-term improvements include adopting PHP versions with hardened memory management, disabling unnecessary PHP features like session upload progress, enforcing strict session cookie policies, and employing container security best practices. Regular security audits, penetration testing, and threat hunting focused on PHP environments will enhance resilience against similar exploits.