PHP2Shell
A critical memory-exhaustion vulnerability class in unpatched PHP installations, tracked as CVE-2026-109618 and CVE-2026-109619.
Research & writeup by Acep
git clone https://github.com/aceptriana/php2shell.git
// Overview
php2shell is the name given to a class of memory-exhaustion vulnerabilities affecting several unpatched PHP branches. A crafted multipart HTTP request with deeply nested array keys can force the PHP request handler to consume all available memory, resulting in a fatal error or a crashed PHP-FPM worker. On vulnerable, misconfigured deployments this instability can escalate toward remote code execution.
This page is an informational advisory. It documents the affected versions and the remediation steps so operators can confirm whether their systems are exposed and patch them. It intentionally does not include exploitation payloads or mass-scanning instructions.
// Affected PHP Versions
| Branch | Vulnerable Range | Fixed In |
|---|---|---|
| PHP 8.2 | 8.2.0 – 8.2.34 | 8.2.35 |
| PHP 8.3 | 8.3.0 – 8.3.35 | 8.3.36 |
| PHP 8.4 | 8.4.0 – 8.4.26 | 8.4.27 |
| PHP 8.5 | 8.5.0 – 8.5.11 | 8.5.12 |
Patched releases handle the malformed multipart payload safely. Distribution packages may also carry vendor backports of the fix on otherwise "old-looking" version numbers — always check your distro's security advisories in addition to the upstream version.
// Impact
Denial of Service
Memory exhaustion crashes the request handler or FPM worker.
Instability
Repeated crashes degrade availability of the service.
RCE Risk
On vulnerable configurations the flaw can escalate toward code execution.
// Am I Affected?
Check your installed PHP version on the server:
Compare the reported version against the table above. If it falls inside a vulnerable range and your distribution has not applied a security backport, your installation is exposed and should be patched.
// Remediation
- Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, or 8.5.12 — or newer).
- Apply vendor security updates — on managed distros, run your package manager's security upgrade (e.g.
apt upgrade/dnf update) and restart PHP-FPM and your web server. - Harden multipart limits — review
max_multipart_body_parts,memory_limit, and request-size limits inphp.iniand at the web-server / WAF layer. - Verify after patching — re-run
php -vand confirm the fixed version is live across all PHP-FPM pools.
// Credits
| Writeup Author | Acep (github.com/aceptriana) |
| php2shell Discovery | Calif Security Team |
Legal Notice
This page is provided for defensive security awareness and educational purposes only. Testing or scanning systems you do not own or lack explicit written authorization to assess is illegal in most jurisdictions. Use this information solely to protect and patch systems you are responsible for.