CVE-2026-109618: 
PHP 취약점 분석 및 완화

CVE-2026-109618, dubbed "PHP2Shell," is a critical remote code execution vulnerability in PHP's out-of-memory (OOM) error handling. PHP uses longjmp() to exit the current context during OOM errors, but some contexts leave request memory in an uninitialized or partially initialized state before performing allocations. The subsequent request cleanup procedure may then read or branch on this corrupted memory, enabling unauthenticated RCE. The vulnerability affects PHP versions from 7.3.0 through 8.5.11, with fixed versions being 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It was disclosed on October 21, 2026, with exploitation confirmed to have begun at least four days prior to public disclosure. CVSS v3.1 base score is 9.8 (Critical); CVSS v4.0 base score is 9.2 (Critical) (GitHub Advisory, Red Hat, Palo Alto Networks).

The root cause (CWE-416 Use After Free, CWE-824 Access of Uninitialized Pointer, CWE-755 Improper Handling of Exceptional Conditions) lies in PHP's longjmp()-based OOM handling. When memory exhaustion occurs during request startup — particularly during multipart body parsing — PHP exits the current context via longjmp() without fully initializing request-scoped state. The request shutdown procedure then processes this invalid, partially-initialized memory. Multiple OOM trigger strategies exist: multipart requests without a usable Content-Length header can bypass post_max_size checks; multipart parts can contain an unrestricted number of headers whose in-memory representation consumes far more memory than their wire size; and empty file controls still create metadata arrays without counting toward max_file_uploads. Apache mod_php is the most severely affected SAPI because it unconditionally invokes the request shutdown procedure even after a failed startup, allowing the stale state to be consumed before any application code runs. PHP-FPM is also susceptible in application-specific scenarios where OOM is reached after normal startup. The attack vector is network-based, requires no authentication, and no user interaction (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthenticated remote code execution as the web server worker account (e.g., www-data). The vulnerability provides full confidentiality, integrity, and availability impact on the vulnerable system. Attackers can execute arbitrary OS commands, read sensitive files including credentials and MFA secrets, deploy web shells, establish persistence, and pivot laterally within the network. Unit 42 reported that in at least one confirmed intrusion against a European government entity, attackers reached password hashes and MFA secrets within two hours of exploitation. The vulnerability affects an estimated 22 million exposed PHP instances globally, with approximately 70% of all websites running PHP being potentially affected (GitHub Advisory, Palo Alto Networks).

CVE-2026-109618 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, with a federal patch deadline of October 29, 2026. Amazon's MadPot threat intelligence identified exploitation attempts beginning four days before public disclosure (around October 17, 2026). Multiple public PoC exploits and exploit frameworks exist, including Python-based tools targeting mod_php with ASLR bypass capabilities (e.g., jackalsyn.com/posts/php-up-2026.html, github.com/ikow/php2shell-poc, github.com/cozybear-dev/cve-2026-109618). Exploitation attempts rapidly escalated to millions within hours of disclosure, with Cloudflare reporting a surge from thousands to millions of attempts. Threat actors including Mirai botnet operators and suspected DPRK-linked actors (Lazarus Group) have been attributed to exploitation campaigns. The EPSS score is 0.99981 (extremely high probability of exploitation). Honeypots have recorded confirmed successful shell launches (CISA KEV, AWS Blog).

1. Reconnaissance: Identify internet-facing PHP servers using tools like Shodan or Censys, targeting Apache mod_php deployments running PHP versions prior to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Check X-Powered-By headers or server responses for PHP version disclosure.

2. Verify attack surface: Confirm the target accepts multipart/form-data POST requests and that session.upload_progress.enabled is On (default). Send a benign multipart probe to verify the upload-progress path is reachable.

3. Trigger OOM during request startup: Send a crafted multipart POST request designed to exhaust memory_limit during pre-RINIT session handling. Strategies include: (a) a multipart body without a usable Content-Length to bypass post_max_size; (b) a multipart part with a flood of headers (each header consumes more memory than its wire size); (c) a large number of empty file controls that each generate $_FILES metadata arrays. This causes PHP to longjmp() out of the request context, leaving request memory in an invalid state.

4. Heap grooming and address leakage (for full RCE): Send follow-up requests with crafted session upload-progress fields to leak Zend MM chunk base addresses and libphp base addresses via Set-Cookie response headers, defeating ASLR.

5. Forge internal PHP structures: Construct a forged zend_array (HashTable) with pDestructor pointing to zif_system, or a forged zend_internal_function record with handler set to zend_call_function and an embedded command string. Spray these 149 forged records via t[] form fields in a multipart request.

6. Trigger code execution: Send the final multipart request that causes the stale destructor pointer to fire, invoking system() with the attacker-controlled command. The command output can be retrieved from the HTTP response or a dropped proof file.

7. Establish persistence: Deploy a web shell, create backdoor accounts, or install malware (e.g., Mirai variants) for continued access (GitHub Advisory, jackalsyn PoC).

• Network: Unusual multipart POST requests with PHP_SESSION_UPLOAD_PROGRESS field and PHPSESSID in the POST body (not cookie); requests with abnormally large numbers of headers per part; multipart requests without Content-Length or with very large filenames (>256KB); stalled two-chunk delivery with timing gaps exceeding session.upload_progress.min_freq; outbound connections from the PHP worker process to unknown IPs.
• Network (Zeek/Suricata): Signatures for PHP_Crash_Sequence, Multipart_Header_Flood, Large_Form_Key patterns (see github.com/corelight/php2shell-detect).
• Logs: Apache/nginx access logs showing repeated multipart POST requests with PHP_SESSION_UPLOAD_PROGRESS in the body; PHP error logs showing Allowed memory size of N bytes exhausted in Unknown on line 0; zend_mm_heap corrupted messages; SIGSEGV or exit code 134/139 for PHP worker processes; worker crash sequences followed by rapid respawning.
• File System: Unexpected web shells or PHP files in the web root or session save path (/tmp/sessions/, /var/lib/php/sessions/); session files (sess_*) containing PHP code or serialized objects with pipe-delimited payloads; new cron jobs or scheduled tasks created by the web server user; proof files like /var/www/html/pwned.txt or /tmp/proof.
• Process: Unusual child processes spawned by the PHP/Apache worker (e.g., /bin/bash, curl, wget, python, nc); id, uname, or other reconnaissance commands executed as www-data.
• Threat Intelligence: Honeypot data showing 66,492+ exploitation requests from 645+ source IPs; dropper URLs associated with Mirai/Potassium botnet payloads (Corelight Detection, php2shell.delftintellab.com).

Primary remediation: Upgrade PHP immediately to patched versions: 8.2.35, 8.3.36, 8.4.27, or 8.5.12. The patch replaces longjmp() for OOM with a delayed, graceful soft OOM triggered at the next VM safe point, and an immediate hard OOM using _exit() if memory consumption reaches a second, higher threshold.

Configuration mitigations (partial, not complete fixes):

• Set session.upload_progress.enabled=0 in php.ini — removes the confirmed exploit's primary trigger but does not address all OOM paths.
• Set memory_limit=-1 administratively — removes the predictable per-request limit enabling the confirmed exploit, but does not prevent OOM from mmap() or other underlying allocation failures.
• Keep post_max_size conservative and enforce decoded request size at the frontend.
• Reduce max_input_nesting_level and bound the number of input variables, multipart parts, headers per part, and uploads.
• Block multipart/form-data requests at the frontend if the application does not use file uploads.

Third-party workaround: The unofficial php_uploadprogress_guard PHP extension (Hosted Power) mirrors the official fix component by component and steps aside once the patched engine is detected (HOSTED-POWER GitHub).

Vendor patches: Red Hat RHSA-2026:87080 (php:7.4 for RHEL 8), multiple additional RHSAs for other RHEL versions; Ubuntu USN-8948-1/2; Palo Alto Networks PAN-OS hotfixes (see advisory for version-specific fixes) (Red Hat RHSA, Palo Alto Networks).

The vulnerability, nicknamed "PHP2Shell," triggered an unprecedented global security response. Multiple European and Asian government websites were taken offline preemptively, including Dutch government sites and services in Japan, Nepal, and Latvia. The UK's NCSC, NSA, FBI, and CISA all issued urgent advisories urging immediate patching or taking systems offline. CISA added the CVE to its KEV catalog with a 3-day federal patch deadline.

The PHP Foundation published a statement acknowledging the vulnerability and explaining how it was strengthening PHP security processes. The disclosure was complicated by an embargo leak — a forum user inadvertently published details before the official October 21, 2026 release date, forcing PHP to accelerate the patch timeline. Chainguard was blamed by some PHP maintainers for the early disclosure, sparking a public dispute about coordinated vulnerability disclosure practices.

Notably, the vulnerabilities were discovered with AI assistance — OpenAI's GPT-5.6 Sol model and Wiz researchers were credited with finding the flaws, sparking widespread discussion about AI-assisted vulnerability research. Cloudflare's CEO reported exploit attempts escalating from thousands to millions within hours of disclosure. Security researchers from Arctic Wolf, CrowdStrike, Wiz, and others published detailed analyses. The event was widely described as "Black October" in the security community (The PHP Foundation, CISA Alert).