CVE-2026-109618 and CVE-2026-109619: PHP2Shell RCE Flaws

Summary

Two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were leaked online ahead of their official disclosure. The flaws could allow attackers to execute arbitrary commands on vulnerable web servers. The vulnerabilities may affect multiple PHP releases, potentially including unsupported end-of-life branches.

Investigation

Researchers at watchTowr confirmed the vulnerabilities and successfully reproduced CVE-2026-109618. Huntress also monitored the disclosure and evaluated the likelihood of exploitation, noting that no in-the-wild attacks had been observed across partner environments at the time of reporting. However, the risk remains significant because of PHP’s widespread use. Researchers focused on common exploitation indicators, including PHP processes spawning unusual child processes.

Mitigation

Organizations should immediately inventory all PHP deployments, including instances bundled within third-party vendor software. Administrators should be prepared to apply official PHP security patches as soon as they are released on October 21. Systems running end-of-life PHP versions that will not receive fixes should be isolated from the internet or protected behind a VPN or Web Application Firewall (WAF).

Response

If suspicious activity is detected, including PHP processes launching shells, interpreters, or networking utilities, administrators should immediately isolate the affected server. Preserving web server and PHP logs is essential for forensic investigation. Security teams should also inspect the web root for newly created webshells, unauthorized files, suspicious cron jobs, scheduled tasks, or newly added user accounts.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully exploited a vulnerability in a web application running PHP-FPM. To establish a foothold and begin reconnaissance, the attacker uses a PHP script to execute a system command. The attacker’s goal is to identify the current user context to determine the level of privilege available for further lateral movement. The attacker executes whoami through the php-fpm process, which should trigger the detection rule’s Image|endswith: 'whoami' logic.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the PHP RCE detection rule.
  # This script simulates a PHP-FPM process spawning a reconnaissance command.
  
  # 1. Check if we can simulate the parent process. 
  # In a real environment, this is the php-fpm daemon.
  # For simulation, we will use a subshell to mimic the behavior.
  
  echo "[+] Starting Simulation: Triggering PHP-FPM RCE detection..."
  
  # We use 'sudo -u www-data' to mimic the web user, 
  # and we wrap the execution to mimic a child process relationship.
  # Note: To perfectly match 'ParentImage|endswith: php-fpm', 
  # the test must be run on a system where php-fpm is active.
  
  # Mocking the behavior via a direct execution if php-fpm isn't running:
  # In a real lab, you would trigger this via a web request to a real PHP file.
  
  # Command to trigger: whoami
  # We simulate the process tree relationship expected by the rule.
  # Since we cannot easily 'become' php-fpm without a real service,
  # we will execute the command to ensure the telemetry of the 'child' is present.
  
  # REAL TEST COMMAND (Requires php-fpm running):
  # php-fpm-cli-simulated-trigger
  # For the sake of this script, we execute the targeted binary:
  whoami
  
  echo "[+] Simulation command executed. Check SIEM for 'whoami' triggered by PHP."

• Cleanup Commands:

  # No persistent files were created by this simulation.
  # Clear shell history to remove traces of the simulation.
  history -c
  echo "[+] Cleanup complete."