A coalition of cybersecurity firms, open-source maintainers, and infrastructure providers has coordinated to disclose and mitigate a pair of severe vulnerabilities affecting the PHP runtime. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as "php2shell," the security flaws impact virtually all web servers running PHP 5.4 or later. Depending on the application environment, successful exploitation may allow malicious actors to trigger denial-of-service conditions, execute arbitrary remote code, or expose sensitive customer data.
The disclosures emerged from a collaborative effort involving Calif.io, Wiz, OpenAI, Quarkslab, and the PHP Foundation. Because PHP underpins a massive share of the modern web—powering roughly 70 percent of all websites, including widely deployed content management systems and e-commerce platforms like WordPress and Magento—the vulnerabilities carry sweeping implications for global web infrastructure.
In response to the active exploitation and pre-disclosure leaks of the vulnerabilities, major web infrastructure and security providers mobilized quickly. Cloudflare announced that it deployed automated Web Application Firewall (WAF) mitigations across all customer tiers, including free users, approximately nine hours ahead of the official public disclosure. As attack traffic began mutating in real time to test and bypass conventional filtering rules, security defenders responded by introducing an advanced mitigation framework known as full transaction detection, designed to analyze both sides of an HTTP transaction to successfully block sophisticated exploit attempts.
Understanding the php2shell Vulnerabilities
The core of the php2shell issue lies within the PHP runtime’s memory management mechanisms, specifically how the interpreter handles memory allocation and error cleanup during the processing of HTTP requests. Under normal operating conditions, PHP allocates memory to fulfill incoming request data and subsequently releases those resources once the workload concludes.
However, complications arise when request processing is interrupted unexpectedly—such as when an application encounters a critical error or exhausts its allocated memory limits. In these scenarios, the runtime fails to cleanly and safely deallocate or initialize resources. The two distinct CVE identifiers outline different facets of this underlying memory safety failure.
CVE-2026-109618 involves situations where PHP runs out of memory and abruptly halts request processing before certain internal data structures have been fully initialized. During the subsequent cleanup phase, the runtime may mistakenly treat this unfinished or half-baked data as valid information, creating an opening for memory corruption and potential code execution.
CVE-2026-109619 focuses on fatal errors that interrupt a request while PHP retains active references to memory slated for release at the lifecycle’s end. When the same underlying PHP process handles subsequent requests, it can follow these outdated references, inadvertently accessing invalid memory spaces. This unsafe memory reuse can lead to unexpected process crashes, service disruptions, or the leakage of sensitive data contained within the shared memory pool.
Because these vulnerabilities reside deep within the PHP runtime engine itself, applying superficial application-level patches, such as updating individual website codebases or third-party plugins, is insufficient. System administrators and web hosting providers must update the underlying PHP software running their web applications to secure environments against exploitation.
Advanced Defenses and Full Transaction Detection
Protecting web infrastructure against sophisticated runtime exploits like php2shell required moving beyond traditional request-based filtering rules. Security analysts noted that inspecting incoming request data alone often fails to provide enough contextual evidence to definitively distinguish an active exploit attempt from legitimate web traffic, creating a difficult balancing act between security and false positives.
To solve this challenge, security engineers developed full transaction detection. This capability combines signals extracted from both the inbound request and the outbound origin response within the context of a single HTTP transaction. By analyzing how the origin server reacts to specific request inputs, the WAF can determine with much higher confidence whether an exploit attempt succeeded, allowing response-filtering rules to block malicious origin responses before they ever reach the end user.
The deployment of these response-filtering rules marked the debut of Cloudflare’s managed response firewall capabilities. For users across all service tiers, these protections were automatically implemented, shielding web applications from malicious payloads designed to mutate and evade traditional perimeter defenses. Security teams actively cataloged and deployed unique rule identifiers across free and paid managed rulesets, providing an extensive array of coverage designed to intercept attack variants targeting CVE-2026-109618 and CVE-2026-109619.
Subsequent Session Upload Progress Advisory
As security monitoring and vulnerability research continued following the initial disclosure, the PHP project published an informational advisory regarding a related security concern. Tracked as CVE-2026-115560, this secondary vulnerability targets PHP’s built-in session upload progress feature and affects fully patched PHP releases, including version 8.5.12.
The advisory confirmed that an upcoming regular PHP release will incorporate a permanent fix for the issue. In the interim, automated WAF defenses were updated to protect sites utilizing PHP’s default upload progress field names. Sites utilizing customized configuration values for session upload progress parameters require manual review, as non-standard field names fall outside the scope of default WAF signature coverage.
Remediation and Ongoing Monitoring
While perimeter defenses such as managed WAF rulesets and full transaction monitoring provide critical layers of defense-in-depth, security experts emphasize that they do not serve as a replacement for software updates. Administrators are urged to review official PHP security advisories, apply vendor-supplied patches to their PHP installations promptly, and coordinate with managed hosting providers to ensure runtime updates are deployed across all production environments.
Organizations are advised to keep their WAF protections active as a persistent shield while executing infrastructure updates. Additional risk-reduction strategies, such as restricting unnecessary file upload capabilities and limiting maximum upload sizes, can help minimize exposure surfaces, though applying the official PHP software updates remains the only definitive remediation. Security analysts continue to monitor threat intelligence feeds and attack traffic telemetry, preparing to deploy additional rule updates and enhancements as new attacker techniques or payload variations emerge.
