PHP2Shell: two flaws that hand attackers your server

CVE-2026-109618

Out-of-memory corruption during request parsing

PHP enforces its memory limit by aborting the current request the moment an allocation fails. The problem: in several code paths — notably while parsing a multipart form upload — PHP has already marked internal request data as "ready" before every allocation behind it has completed. When the memory abort interrupts things, that half-built state is never rolled back.

The request's cleanup routine then walks the uninitialized memory as if it were valid — reading, branching, and freeing it. Because the abandoned memory may still contain data from earlier allocations that the attacker influenced through a crafted HTTP request, this corruption can be steered toward code execution.

CVE-2026-109619

Stale state between requests on the same worker

PHP workers reuse themselves across requests, and some global state temporarily points into memory owned by a single request. If a fatal error interrupts the reset — or the state is repopulated after being cleared — the worker keeps pointing at memory that has already been freed. The next request handled by that worker reads or acts on the stale state before normal initialization catches up, producing a classic use-after-free with attacker-controlled contents.