PHP's Critical RCE Flaws: Exploited Before Patched

The PHP Vulnerability Crisis

This InfoQ article provides a timely and crucial report on two critical Remote Code Execution (RCE) vulnerabilities in PHP, highlighting the alarming reality that these flaws were actively exploited before official patches were released. The analysis delves into the technical nature of the vulnerabilities, describing them as memory-safety failures in request handling and state management. The article effectively conveys the urgency by citing Amazon's threat intelligence and the rapid deployment of Web Application Firewall (WAF) rules by Cloudflare. The breakdown of how different serving mechanisms (mod_php, PHP-FPM, FrankenPHP) are affected adds significant technical depth. Crucially, the piece doesn't shy away from the chaotic disclosure process, detailing how a researcher's premature video and Chainguard's early release of patched images collapsed the coordinated disclosure timeline, leaving many users exposed. This aspect underscores a systemic challenge in the security ecosystem: balancing rapid remediation with responsible disclosure.

The article also does an excellent job of illustrating the real-world impact and the challenges faced by developers and system administrators. The accounts of users shutting down websites, the difficulty in identifying PHP usage in containerized environments, and the subsequent race to apply patches from various distributions paint a vivid picture of the operational disruption. The warning about confirming patches by checking package versions rather than php -v and the need to restart workers are essential practical takeaways. The discussion around the limited resources of the PHP Foundation and the brutal end-of-life policy for older versions raises important questions about the sustainability of open-source security. While the article covers the technical and operational aspects well, a deeper dive into potential mitigation strategies beyond immediate patching, even if imperfect, could have added further value, especially for those unable to update instantly. The mention of a third unpatched issue (CVE-2026-115560) also serves as a reminder that the threat landscape is constantly evolving.

Key Points

• Two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) were patched in PHP emergency releases.
• These flaws, nicknamed 'php2shell', were actively exploited by attackers before patches were available.
• The vulnerabilities are memory-safety failures in request lifecycle, present in PHP versions 5.4 and later.
• Exploitation was confirmed against Apache mod_php and likely affects FrankenPHP; PHP-FPM is also vulnerable to one flaw.
• Coordinated disclosure collapsed due to premature public disclosure of a proof-of-concept video and early release of patched images by Chainguard.
• Many organizations and individuals took their websites offline as a precautionary measure.
• Identifying PHP usage in containerized environments proved challenging for some users.
• Patch availability varied across distributions, with some trailing significantly.
• Verifying patches requires checking full package versions and restarting web server workers, not just php -v.
• The PHP Foundation relies on a small group of funded developers, highlighting resource constraints for security work.
• Older PHP versions (8.1 and below) receive no official security support, with minimal backports provided for some.
• A third unpatched issue (CVE-2026-115560) requires manual configuration changes until a fix is released.

---

📖 Source: PHP Patches Two Critical RCE Flaws That Were Already Under Attack