ANNOUNCEMENT

Introduction

The National Cyber Security Agency (NACSA), through the National Cyber Coordination and Command Centre (NC4), highlights two critical vulnerabilities in the PHP runtime, collectively known as PHP2Shell.

On 21 October 2026, the PHP security team released security updates addressing the following vulnerabilities:

• CVE-2026-109618 (Out-of-Memory Corruption): Improper handling of out-of-memory conditions may cause PHP to process invalid internal data during request cleanup, potentially allowing remote code execution.
• CVE-2026-109619 (Stale Global State): Previously freed request data may remain referenced and be reused during subsequent requests, potentially resulting in memory corruption and remote code execution.

These vulnerabilities exist within the PHP engine itself, rather than application code, and could allow unauthenticated attackers to compromise vulnerable web servers.

Impact

Successful exploitation could result in:

• Remote Code Execution (RCE): Attackers may execute arbitrary code on affected servers without authentication.
• Sensitive Data Exposure: Attackers may access information stored in PHP process memory, including credentials and authentication tokens.
• Service Disruption: Memory corruption may cause PHP processes to crash.
• Server Compromise: Successful code execution may allow attackers to perform unauthorised actions with the privileges of the PHP process.

System Affected

The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, PHP-CGI, LiteSpeed and FrankenPHP.

The PHP security team identifies Apache mod_php as the highest-risk configuration, based on demonstrated exploitation before application code execution.

Recommendation

NC4 strongly recommends that organisations take the following actions immediately:

1. Apply Security Updates

• Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later fixed versions within the respective branches.
• Upgrade unsupported PHP versions or obtain verified security backports from the relevant operating system or software vendor.
• Restart affected PHP services after patching and verify that the fixed version is running.

2. Temporary Mitigation (If Patching Is Delayed)

The PHP security team recommends the following measures to reduce exposure to specific attack paths:

• For CVE-2026-109618, consider enforcing memory_limit=-1 and restricting post_max_size, subject to application requirements and appropriate infrastructure memory limits.
• For CVE-2026-109619, set session.upload_progress.enabled=0 and restart all PHP workers.
• For PHP 8.5, set fatal_error_backtraces=0 and restart all PHP workers.
• Apply appropriate request restrictions at the web server or reverse proxy where applicable.

Important: These measures do not fully prevent exploitation. Applying the official security updates remains the only complete remediation.

3. Monitoring and Incident Response

• Monitor PHP processes, application logs and web server activity for suspicious behaviour.
• Investigate unexpected file modifications, unauthorised processes and unusual outbound connections.
• If compromise is suspected, isolate affected systems, preserve relevant evidence and initiate incident response procedures.

NC4 urges all organisations operating internet-facing PHP applications to prioritise immediate security updates and conduct vulnerability assessments.

References

PHP Official Security Advisory (21 October 2026) https://www.php.net/archive/2026.php#2026-10-21-5

NC4-ALR-2026-000011 : Critical Vulnerabilities in PHP https://www.nc4.gov.my/alertAdvisory-detail/NC4-ALR-2026-000011

21.10.2026