CVE-2026-109619: 
PHP Análisis y mitigación de vulnerabilidades

CVE-2026-109619 is a critical use-after-free vulnerability in PHP's global state management, part of the broader "PHP2Shell" (php2shell) vulnerability cluster disclosed on October 21, 2026. PHP maintains various global state that temporarily points into request memory; in certain scenarios this state is not correctly reset (or is repopulated after reset), causing a subsequent request handled by the same worker to access freed memory before normal initialization replaces it. This can lead to unauthenticated remote code execution (RCE). Affected versions include PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12; older branches (5.4–8.1) are also affected via the session upload-progress path. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.2 (Critical) (Red Hat Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause is a use-after-free (CWE-416) combined with improper handling of exceptional conditions (CWE-755) and access of uninitialized pointers (CWE-824). PHP worker processes retain global state (error handlers, session state, object store, fatal-error backtraces, etc.) that points into per-request heap memory. Two confirmed exploitation paths exist: (1) Fatal-error backtrace producer: with fatal_error_backtraces enabled, a fatal error stores backtrace state owned by the request; this global state is never reset during shutdown, so a diagnostic raised on a subsequent request (e.g., from an invalid INI directive applied before php_request_startup()) reads the stale, freed pointer. (2) Session upload-progress lifecycle: a multipart upload can initialize request-owned session and decoding state before normal module initialization; an OOM or other fatal error after publication prevents the matching reset, leaving BG(unserialize) or BG(serialize) dangling into freed memory. A follow-up request's upload-progress handler then consumes the stale pointer. Exploitation requires a producer request (which publishes stale state) and a consumer request (which reads it) to hit the same worker process. Attack complexity is rated High because specific heap layout conditions and per-build offsets are required for reliable RCE, though multiple public PoC frameworks automate this (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated remote attacker to achieve arbitrary code execution as the web server worker user (e.g., www-data), with full confidentiality, integrity, and availability impact on the vulnerable PHP process. Confirmed RCE has been demonstrated against Apache mod_php and PHP-FPM. In real-world attacks, threat actors chained CVE-2026-109619 with a Linux kernel privilege escalation flaw (CVE-2026-46300, "Fragnesia") to obtain root access on network devices including Palo Alto Networks PAN-OS firewalls, compromising 25 servers across the US, Japan, Taiwan, and South Korea. A European government entity reportedly had password hashes and MFA secrets exfiltrated within two hours of exploitation. The vulnerability also affects downstream products embedding PHP, including Palo Alto Networks PAN-OS, Siemens industrial products, IBM App Connect Enterprise, and various NAS devices (GitHub Advisory, Feedly).

CVE-2026-109619 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, with a federal patch deadline of October 29, 2026 (CISA KEV). Amazon's MadPot threat intelligence honeypot detected exploitation attempts four days before the patches were publicly released (around October 17, 2026). Multiple high-confidence PoC exploit frameworks are publicly available, including cozybear-dev/cve-2026-109619 (demonstrating full RCE against PHP 8.4.26 with Apache mod_php), ikow/php2shell-poc (multi-chain exploit), and the jackalsyn.com PHP-UP-2026 framework. Cloudflare reported millions of exploitation attempts within hours of disclosure. Threat actors attributed to APT10 (China-nexus) and suspected DPRK-affiliated operators have been observed exploiting this vulnerability. The EPSS score is 0.99997 (extremely high probability of exploitation) (Feedly, CISA).

1. Reconnaissance: Identify internet-facing PHP servers (Apache mod_php or PHP-FPM) running vulnerable versions (PHP < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12) using tools like Shodan, Censys, or the public php2shell.censys.com scanner. Confirm session.upload_progress.enabled=1 (default) and that the target accepts multipart POST requests.

2. Heap layout calibration (Stage 1 — leak Zend MM chunk base): Send a series of calibration multipart POST requests with many small fields to establish a predictable heap layout. Then send a "producer" request with a large file part (~12 MB) to trigger OOM during pre-RINIT session initialization, leaving PS(http_session_vars) dangling. A "consumer" request with crafted field counts causes php_url_encode to read stale PS(id) pointers into the Set-Cookie header, leaking the Zend MM chunk base address (2 MB-aligned).

3. Leak libphp base (Stage 2): Send another producer/consumer pair; the consumer request includes a 16-byte value at a specific field index, causing the leaked pDestructor pointer (whose low 12 bits match a known offset) to reveal the libphp base address.

4. Trigger stale state (Stage 3a): Send a producer request with session fields, padding fields, and a large (~12 MB) file part to OOM and leave PS(http_session_vars) dangling into freed request memory.

5. Heap spray and RCE (Stage 3b): Send a consumer request that sprays forged PHP internal structures (a zend_reference with val.value pointing to a crafted zend_array, a zend_string/HashTable with pDestructor=zif_system, and a forged zend_execute_data with the attacker's shell command as argument) into the freed bins. When zval_ptr_dtor is called on the stale reference, it invokes zif_system() with the attacker-supplied OS command, executing it as the web server user.

6. Verify execution: Poll a proof file (e.g., /out/p) or check the response for command output markers (e.g., uid=) to confirm successful RCE. Retry with worker rotation if the heap layout does not align on the first attempt (GitHub PoC, Feedly exploit analysis).

• Network: Unusual multipart POST requests with PHP_SESSION_UPLOAD_PROGRESS field and large file parts (>8 MB) to any PHP endpoint; requests with hundreds of repeated small fields followed by a large filler part; Set-Cookie headers containing anomalous pointer-like values; outbound connections from the web server process to attacker-controlled IPs.
• Logs: PHP error logs showing Allowed memory size exhausted errors during request startup (before script execution); repeated SIGSEGV or SIGBUS signals in PHP-FPM or Apache error logs; worker process crashes and restarts correlated with multipart upload requests; access logs showing high-frequency multipart POST requests from the same source IP.
• File System: Unexpected web shells or scripts written to the web root or /tmp; new cron jobs or systemd units created by the web server user; proof files (e.g., /out/p containing uid=) left by exploit verification steps; modified PHP binary or extension files.
• Process: Unusual child processes spawned by the PHP worker (e.g., /bin/bash, curl, wget, python, nc) with the web server user's UID; system() or exec() calls visible in process audit logs; unexpected network connections from the PHP worker process.
• Honeypot data: The php2shell.delftintellab.com dashboard recorded 66,492+ exploitation requests with documented source IPs and dropper URLs (Feedly).

Primary remediation: Upgrade PHP to the patched versions — 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later). Red Hat Enterprise Linux users should apply the relevant RHSA errata (e.g., RHSA-2026:87080 for RHEL 8 php:7.4) (Red Hat Advisory).

Configuration workarounds (partial, until patching is complete):

• Set session.upload_progress.enabled=0 in php.ini (not via ini_set()) and restart all PHP workers. This removes the confirmed session upload-progress consumer path but does not cover all attack vectors.
• For PHP 8.5 only: set fatal_error_backtraces=0 administratively and restart workers to remove the fatal-error backtrace producer.
• Consider setting pm.max_requests=1 in PHP-FPM pools to prevent stale state from persisting across requests (significant performance impact).
• Deploy the unofficial php_uploadprogress_guard PHP extension (Hosted Power) as a temporary mitigation for unpatched PHP versions 5.6–8.5; it mirrors the official fix components and steps aside once the engine is patched (Hosted Power).
• Apply WAF rules (AWS WAF, Cloudflare, Azure WAF) targeting PHP_SESSION_UPLOAD_PROGRESS in multipart bodies as a defense-in-depth measure.

Federal agencies were required to patch by October 29, 2026 per CISA's KEV directive (CISA).

The disclosure of CVE-2026-109619 (alongside CVE-2026-109618) triggered one of the largest coordinated cybersecurity responses in recent memory, widely dubbed "Black October" or "PHP2Shell" by the security community. The PHP Foundation published a statement acknowledging the vulnerabilities and outlining plans to strengthen the security disclosure process. The embargo was broken early by a consultant who inadvertently shared details, forcing PHP to release patches ahead of schedule on October 21, 2026.

Major cloud and security vendors responded rapidly: Cloudflare deployed WAF protections nine hours before public disclosure; AWS, Google Cloud, and Microsoft Azure published mitigation guidance and WAF rules within hours of the patch release. OpenAI disclosed that its GPT-5.6 Sol model assisted in discovering the vulnerabilities through AI-assisted code review, sparking broad discussion about AI's role in both vulnerability discovery and exploitation.

Government agencies worldwide — including CISA, NSA, FBI, NCSC (UK), CERT-EU, and agencies in Japan, Singapore, Canada, and Australia — issued emergency advisories urging immediate patching or taking systems offline. Several European government websites were proactively taken offline. Security researchers on Mastodon, Bluesky, and X noted the unprecedented scale of exploitation attempts (millions within hours) and the speed at which working exploits appeared. The Recorded Future and CrowdStrike teams published analyses noting that while exploitation was widespread, confirmed successful compromises remained relatively limited in the first week (Feedly, GitHub Advisory).