%PHP2Shell: Finding The PHP You Didn’t Know You Were Running%
October 29 was the deadline CISA gave US federal agencies to patch PHP2Shell. Most businesses sit outside that mandate, yet the date is a fair yardstick for everyone else. Exploitation is confirmed, fixes have been out for eight days, and for many teams the hardest question is still the first one: where exactly are we running PHP?
What PHP2Shell is
PHP2Shell is the name researchers gave two flaws in PHP core, CVE-2026-109618 and CVE-2026-109619≈. The first is an out-of-memory bug that corrupts request memory. The second is a use-after-free in state PHP carries between requests, reachable through the session upload progress handler, which has been on by default since PHP 5.4. Both trigger while PHP parses a multipart POST request, before any application code runs. The result is code execution as the PHP worker user, with no credentials and no user interaction.
The timeline was compressed. Details leaked on...
Copyright of this story solely belongs to informationsecuritybuzz.com. To see the full text click HERE
