CVE-2026-109618: 
PHP 脆弱性分析と緩和策

CVE-2026-109618 is a critical remote code execution vulnerability in PHP dubbed "PHP2Shell" (also known as "php2shell"). PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort request handling. Some contexts do not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation; the subsequent request cleanup procedure may then read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to unauthenticated remote code execution (RCE). The vulnerability affects PHP versions 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12, as well as downstream products including Palo Alto Networks PAN-OS and Siemens products. It was publicly disclosed on October 21, 2026, with exploitation observed as early as four days before the patches were released. The CVSS v3.1 base score is 9.8 (Critical) and the CVSS v4.0 base score is 9.2 (Critical) (GitHub Advisory, Red Hat, Palo Alto Networks).

The root cause (CWE-416 Use After Free, CWE-824 Access of Uninitialized Pointer, CWE-755 Improper Handling of Exceptional Conditions, CWE-1325 Improperly Controlled Sequential Memory Allocation) lies in PHP's longjmp()-based OOM error handling. When an allocation fails during request startup — particularly during multipart body parsing — PHP performs a non-local exit that leaves request-scoped memory (e.g., HashTable Buckets, session globals, BG(serialize)/BG(unserialize) state) in a partially initialized or stale state. The request shutdown procedure subsequently reads or branches on this corrupted memory, enabling memory corruption primitives. Three multipart parsing attack vectors can reliably trigger OOM: (1) a multipart request without a usable declared Content-Length that bypasses post_max_size checks; (2) a multipart part with an unrestricted number of headers, where PHP's internal representation consumes far more memory than the wire representation; and (3) empty file controls that don't count against max_file_uploads but still create metadata arrays. Apache mod_php is the most severely affected SAPI because it unconditionally invokes the request shutdown procedure even when request startup fails, allowing the stale state to be consumed before any application code runs. PHP-FPM is also susceptible when application code invokes affected parsers after normal startup. Exploitation requires no authentication, no user interaction, and no special configuration beyond a reachable PHP endpoint (GitHub Advisory, Feedly).

Successful exploitation grants an unauthenticated remote attacker complete code execution as the web server process user (typically www-data or apache), with full confidentiality, integrity, and availability impact on the vulnerable system. The vulnerability is exploitable before any application-specific code runs, meaning application-level security controls (authentication, input validation, WAF rules at the application layer) provide no protection. Confirmed impacts include arbitrary OS command execution, web shell deployment, credential theft (including password hashes and MFA secrets), lateral movement within internal networks, and deployment of Mirai-based botnet malware. Downstream products incorporating PHP — including Palo Alto Networks PAN-OS management interfaces, Siemens industrial products, IBM products, and NAS devices — are also affected, significantly expanding the attack surface beyond traditional web servers. Honeypot data recorded over 66,000 exploitation requests from 645 source IPs, and Amazon's MadPot threat intelligence system detected exploitation attempts four days before patches were released (GitHub Advisory, Palo Alto Networks, Feedly).

CVE-2026-109618 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, with a federal patch deadline of October 29, 2026. The EPSS score is 0.99981 (99.98th percentile), indicating near-certain exploitation probability. Multiple public PoC exploits exist, including Python-based exploit frameworks (php2shell-reup.zip, ikow/php2shell-poc, godylockz/cve-2026-109618-php2shell, cozybear-dev/cve-2026-109618) that demonstrate full RCE chains against mod_php. Exploitation was confirmed against Palo Alto Networks PAN-OS management interfaces, with China-linked threat actors (APT10) and suspected DPRK-affiliated actors (Lazarus Group) attributed to targeted campaigns. Mirai botnet operators also weaponized the vulnerability for DDoS infrastructure deployment. Cloudflare reported millions of exploitation attempts within hours of public disclosure. The vulnerability requires no authentication, no user interaction, and no special configuration, making automated mass exploitation straightforward (CISA KEV, Feedly, Palo Alto Networks).

1. Reconnaissance: Identify internet-facing PHP servers (Apache mod_php, PHP-FPM, LiteSpeed) using Shodan, Censys, or HTTP header fingerprinting (X-Powered-By: PHP/8.x). Verify the PHP version is below 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

2. Trigger OOM via multipart request: Send a crafted multipart POST request to any PHP endpoint that triggers an out-of-memory condition during request startup. Effective strategies include: (a) sending a multipart body without a usable Content-Length header with many file parts; (b) flooding a single multipart part with hundreds of headers to exhaust memory through PHP's internal representation overhead; or (c) sending many empty file controls to create excessive $_FILES metadata arrays.

3. Exploit stale request state (mod_php path): On Apache mod_php, the OOM causes longjmp() to exit request startup, leaving HashTable Buckets, session globals, or BG(serialize) state in an uninitialized/stale condition. Apache's request shutdown procedure then processes this stale state unconditionally.

4. Heap grooming and memory reclamation: Send a second request with crafted multipart data (e.g., 149 forged 288-byte records in t[] form fields) to reclaim the freed memory regions with attacker-controlled data. The forged records contain fake zend_fcall_info/zend_internal_function structures with handler pointers set to zif_system and an embedded command string.

5. Address resolution (ASLR bypass): Leak Zend MM chunk base and libphp base addresses by parsing Set-Cookie PHPSESSID values from crafted upload-progress requests. Compute zif_system address using known per-build deltas (e.g., DELTA_CALL_AUTHOR = 0x43EF0 for Ubuntu PHP 8.5.4).

6. Trigger code execution: The stale destructor pointer (zval_ptr_dtor) is redirected to zend_call_function, which dispatches to zif_system() with the attacker-supplied command string, executing arbitrary OS commands as the web server user.

7. Verify execution: Check the HTTP response for command output markers (e.g., uid=, PHP2SHELL_OK) or retrieve a proof file written to the web root (e.g., /var/www/html/pwned.txt) (GitHub Advisory, Feedly exploit analysis).

• Network: Unusual HTTP POST requests to any PHP endpoint with Content-Type: multipart/form-data containing PHP_SESSION_UPLOAD_PROGRESS field; requests with abnormally large numbers of multipart headers per part (>50); multipart requests with many empty file controls; requests with oversized filenames (>256KB); stalled multipart uploads with timing gaps matching session.upload_progress.min_freq; outbound connections from web server processes to unknown IPs.

• File System: Unexpected web shells or PHP files in web root directories; new files in /tmp/sessions/ or configured session.save_path with PHP code embedded in session data; proof files such as pwned.txt or id.txt in web-accessible directories; modified PHP binary or extension files.

• Logs: PHP error logs showing Allowed memory size of N bytes exhausted in Unknown on line 0 followed by unusual request patterns; Apache/nginx access logs showing repeated multipart POST requests to the same endpoint with 500/502 responses followed by successful requests; PHP-FPM logs showing worker crashes (SIGSEGV, exit code 139) correlated with multipart requests; Zend MM heap corruption messages (zend_mm_heap corrupted).

• Process: Unusual child processes spawned by the web server process (e.g., /bin/bash, curl, wget, python, nc); web server worker processes executing system commands; unexpected network connections from PHP-FPM or Apache worker processes; id, whoami, or uname commands in process lists.

• Session Files: Session files in session.save_path containing PHP code, serialized objects with |O: patterns, or pipe-delimited content indicating handler mismatch injection; session files with filenames containing PHP payloads.

Primary mitigation: Upgrade PHP to patched versions immediately — 8.2.35, 8.3.36, 8.4.27, or 8.5.12. For downstream products, apply vendor-specific patches (Palo Alto Networks PAN-OS hotfixes per the advisory table; Red Hat RHSA-2026:87080 and related errata; IBM, Siemens, and other vendor advisories).

Configuration workarounds (partial mitigations, not complete fixes):

• Set session.upload_progress.enabled = 0 in php.ini to remove the primary confirmed attack vector for CVE-2026-109619 (related vulnerability); this is PHP's official partial mitigation for the session upload-progress attack surface.
• Set memory_limit = -1 administratively to remove the predictable per-request limit that enables the confirmed OOM-based exploit. Note: this does not prevent mmap() failures and is not a complete mitigation.
• Restrict post_max_size conservatively and enforce decoded request size limits at the frontend/reverse proxy.
• Reduce max_input_nesting_level and bound max_file_uploads, max_input_vars, and multipart part counts.
• Block multipart/form-data requests at the frontend if the application does not require file uploads.
• For Palo Alto Networks PAN-OS: restrict management interface access to trusted internal IP addresses only; enable Threat Prevention with Threat IDs 543004, 97622-97678 (from content version 9162+).

Unofficial extension: The php_uploadprogress_guard PHP extension (HOSTED-POWER) mirrors the official fix component by component and can protect unpatched PHP installations (HOSTED-POWER, Red Hat Advisory, Palo Alto Networks).

The vulnerability, dubbed "PHP2Shell" or "Black October," triggered one of the largest coordinated cybersecurity responses in recent memory. The PHP Foundation published a statement acknowledging the disclosure and explaining how the security release strengthened PHP's security processes. Multiple governments took websites offline preemptively, including Dutch government services, European Patent Office, and various Asian government portals. CISA, NSA, FBI, and NCSC issued joint advisories urging immediate patching or taking systems offline. Amazon Web Services disclosed that its MadPot threat intelligence honeypot detected exploitation attempts four days before public disclosure, raising significant concerns about pre-patch exploitation. Cloudflare's CEO reported exploit attempts escalating from thousands to millions within hours of disclosure. The PHP Foundation faced criticism over the disclosure process after an embargo leak forced early patch release. Security researchers noted the vulnerability was discovered with AI assistance (OpenAI's GPT-5.6 Sol and Wiz researchers), sparking broad discussion about AI-accelerated vulnerability discovery and the shrinking window between discovery and exploitation. The incident was widely compared to Log4Shell in scope and impact, affecting an estimated 70% of websites running PHP (Arctic Wolf, Feedly).