CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities KEV catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability...

PHP Stale Internal Request-State Vulnerability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution...

PHP 8.3.30 Remote Code Execution

PHP version 8.3.30 contains out-of-memory handling and stale request-state flaws that can lead to remote code execution. PHP version 8.3.36 fixes the issues...

PHP 5.4.23 PHP2Shell OOM Mitigation

PHP version 5.4.23 contains out-of-memory request-processing and stale request-state issues. The supplied patches provide a fail-closed mitigation for PHP2Shell...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-check A single-file, read-only Bash script that che...

PHP2SHELL-POC

PHP2Shell — Vulnerability Research & Lab Analysis Research...

Important: Red Hat Security Advisory: php security update

An update for php is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

PHP 7.2.24 Legacy Security Backports

PHP versions 5.4.45, 5.5.9, and 7.2.24 receive unofficial backported fixes and configuration mitigations for two related request-state vulnerabilities...

RHEL 9 : php:8.2 (RHSA-2026:88834)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88834 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsi...

PHP 7.3.33 Multiple Vulnerability Backport

An unofficial source patch for PHP version 7.3.33 ports upstream changes addressing out-of-memory corruption and stale request-state vulnerabilities...

PHP 5.6.40 Security Patch

PHP version 5.6.40 contains vulnerabilities in multipart request parsing and stale request state handling; this patch backports fixes for both issues...

PHP 5.3.29 php2shell Backport

An unofficial backport for PHP version 5.3.29 applies fixes for out-of-memory bailout and stale request-state vulnerabilities affecting Apache modphp...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : PHP vulnerabilities (USN-8948-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8948-1 advisory. It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker coul...

CLSA-2026-1792615126 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

php2shell-poc

CVE-2026-109618 / CVE-2026-109619 — PHP upload-progress RCE P...

CLSA-2026-1792612051 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

CLSA-2026-1792611997 php: Fix of 2 CVEs

CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout - memorylimit and allocation overflow fatals now print to stderr and terminate the process no bailout, no shutdown functions...

USN-8948-2 php5, php7.0, php7.2, php7.4 vulnerabilities

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...

USN-8948-2: PHP vulnerabilities

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...