Protecting Haltdos Customers Against PHP “PHP2Shell” Critical Zero-Day Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Executive Summary

A pair of critical memory safety vulnerabilities—collectively dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) have been publicly disclosed in the core PHP runtime environment. Affecting virtually all major PHP versions ranging from 5.4 through 8.5.11, these flaws allow unauthenticated remote attackers to trigger out-of-memory (OOM) conditions, manipulate memory cleanup mechanisms, and achieve Pre-Authentication Remote Code Execution (RCE) on target web servers.

To provide immediate, zero-day protection for our customers, the Haltdos Threat Intelligence Team has deployed dedicated detection and virtual patch rules to all Haltdos Web Application Firewall (WAF) instances.

Understanding the Vulnerabilities: How PHP2Shell Works

PHP2Shell stems from how the PHP core runtime handles memory exhaustion and abnormal request aborts using internal longjmp() execution boundaries.

• CVE-2026-109618 (Out-Of-Memory Corruption / RCE): When PHP encounters an out-of-memory error during request handling, it aborts processing immediately. In certain execution contexts, internal request data remains only partially initialized. Subsequent request cleanup erroneously treats this uninitialized data as valid, leading to memory corruption and potential code execution.
• CVE-2026-109619 (Use-After-Free / RCE): Fatal error bailouts can leave internal state pointers referencing memory that was freed at the end of a request cycle. In worker-based deployments (such as Apache prefork or PHP-FPM), a subsequent request handled by the same worker thread can dereference these stale memory structures before re-initialization resets them.

Key Takeaway for Security Teams: Exploitation can occur before any custom application logic executes. Features like PHP’s session.upload_progress can be weaponized in pre-application request phases, making even basic or stateless PHP endpoints vulnerable.

Haltdos WAF Mitigations & Virtual Patching

Haltdos WAF customers can mitigate this critical risk immediately without waiting for server maintenance windows or downtime required to update core PHP runtimes.

The following virtual patch signatures are available and active:

• Signature ID 005067001: Detects and blocks payload patterns targeting CVE-2026-109618.
• Signature ID 005067002: Detects and blocks payload patterns targeting CVE-2026-109619.

When set to Block Mode, these signatures inspect inbound application traffic for anomalous multipart payloads, malicious session upload parameters, and memory exhaustion vectors, terminating hostile requests before they reach your backend web servers.

Recommended Action Plan

1. Enable Haltdos WAF Rules Immediately: Verify that rules 005067001 and 005067002 are active and set to Block on all WAF deployment profiles protecting PHP applications.
2. Patch PHP Runtimes: Upgrade underlying PHP servers to patched versions as soon as vendor packages are ready:
   • PHP 8.5.12
   • PHP 8.4.27
   • PHP 8.3.36
   • PHP 8.2.35
3. Optional Hardening (If patching is delayed): Disable unused features in php.ini such as session.upload_progress.enabled = 0 and opcache.enable = 0 to reduce overall attack surface.

Need Assistance?

If you require help verifying signature enforcement, configuring custom protection profiles, or tuning rules for your application stack, please contact our 24/7 Security Operations team:

• Email: support@haltdos.com
• Toll-Free (India): 1800-120-2394
• Website: www.haltdos.com