The PHP2Shell research is on php2shell.com. The PHP project published GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Our technical notes link both: https://php2shell.fyi/technical?ref=bsky
October 29, 2026 at 10:20 PM
The PHP2Shell research is on php2shell.com. The PHP project published GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Our technical notes link both: https://php2shell.fyi/technical?ref=bsky
PHP2Shell can leak PHP process memory. Our advice after the update: rotate the secrets PHP could read on hosts that ran an affected version (passwords, API keys, tokens), then end active sessions. https://php2shell.fyi/faq?ref=bsky
October 30, 2026 at 2:26 PM
PHP2Shell can leak PHP process memory. Our advice after the update: rotate the secrets PHP could read on hosts that ran an affected version (passwords, API keys, tokens), then end active sessions. https://php2shell.fyi/faq?ref=bsky
エラーで止まった処理。その後始末まで、おとなしいとは限りません。
PHP2Shellの一方、CVE-2026-109619。要求の終了時に消すべき内部状態が残り、同じワーカーが扱う次の要求で、解放済みメモリへの参照が使われる穴。条件がそろうと、認証なしのコード実行に至ります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
PHP2Shellの一方、CVE-2026-109619。要求の終了時に消すべき内部状態が残り、同じワーカーが扱う次の要求で、解放済みメモリへの参照が使われる穴。条件がそろうと、認証なしのコード実行に至ります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
October 28, 2026 at 10:25 PM
エラーで止まった処理。その後始末まで、おとなしいとは限りません。
PHP2Shellの一方、CVE-2026-109619。要求の終了時に消すべき内部状態が残り、同じワーカーが扱う次の要求で、解放済みメモリへの参照が使われる穴。条件がそろうと、認証なしのコード実行に至ります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
PHP2Shellの一方、CVE-2026-109619。要求の終了時に消すべき内部状態が残り、同じワーカーが扱う次の要求で、解放済みメモリへの参照が使われる穴。条件がそろうと、認証なしのコード実行に至ります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
急所は、普通の初期化より先に動く処理です。アップロード進捗の処理は、アプリがセッション開始を呼ばなくても内部状態へ触れます。💎
ただし、どの配置でも同じ攻め方になるわけではありません。mod_phpでは要求の起動中に成立する経路が実証済み。FPMの確認済みセッション経路は、起動後のアプリ処理にも条件があります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
ただし、どの配置でも同じ攻め方になるわけではありません。mod_phpでは要求の起動中に成立する経路が実証済み。FPMの確認済みセッション経路は、起動後のアプリ処理にも条件があります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
October 28, 2026 at 10:25 PM
急所は、普通の初期化より先に動く処理です。アップロード進捗の処理は、アプリがセッション開始を呼ばなくても内部状態へ触れます。💎
ただし、どの配置でも同じ攻め方になるわけではありません。mod_phpでは要求の起動中に成立する経路が実証済み。FPMの確認済みセッション経路は、起動後のアプリ処理にも条件があります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
ただし、どの配置でも同じ攻め方になるわけではありません。mod_phpでは要求の起動中に成立する経路が実証済み。FPMの確認済みセッション経路は、起動後のアプリ処理にも条件があります。💎
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
PHP2Shell fixed releases:
8.2.35
8.3.36
8.4.27
8.5.12
Ubuntu and the RHEL 9 default PHP ship the fix under an old number. 8.1 and older: no upstream release, only source backports or vendor builds.
Sources: https://php2shell.fyi/fixed-versions?ref=bsky
8.2.35
8.3.36
8.4.27
8.5.12
Ubuntu and the RHEL 9 default PHP ship the fix under an old number. 8.1 and older: no upstream release, only source backports or vendor builds.
Sources: https://php2shell.fyi/fixed-versions?ref=bsky
October 26, 2026 at 2:22 AM
PHP2Shell fixed releases:
8.2.35
8.3.36
8.4.27
8.5.12
Ubuntu and the RHEL 9 default PHP ship the fix under an old number. 8.1 and older: no upstream release, only source backports or vendor builds.
Sources: https://php2shell.fyi/fixed-versions?ref=bsky
8.2.35
8.3.36
8.4.27
8.5.12
Ubuntu and the RHEL 9 default PHP ship the fix under an old number. 8.1 and older: no upstream release, only source backports or vendor builds.
Sources: https://php2shell.fyi/fixed-versions?ref=bsky
github.com/php/php-src/... this is the patch. it's really large — a complete rework. also backported to multiple release branches. naively, it seems to introduce tremendous risk of its own. is it really that much better than crashing?
Avoid state corruption via bailout · php/php-src@31c0ea7
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 22, 2026 at 12:49 AM
github.com/php/php-src/... this is the patch. it's really large — a complete rework. also backported to multiple release branches. naively, it seems to introduce tremendous risk of its own. is it really that much better than crashing?
oops that link is fucked: github.com/php/php-src/...
Avoid state corruption via bailout · php/php-src@3584a98
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 22, 2026 at 5:40 AM
oops that link is fucked: github.com/php/php-src/...
one commit. 11.5k additions. touches 423 files. Am I high as balls or is this real?
github.com/php/php-src/...
github.com/php/php-src/...
Avoid state corruption via bailout · php/php-src@31c0ea7
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 21, 2026 at 2:56 PM
one commit. 11.5k additions. touches 423 files. Am I high as balls or is this real?
github.com/php/php-src/...
github.com/php/php-src/...
that's a *big* change github.com/php/php-src/...
it looks like they had to revise all the error handling paths everywhere wtf?
it looks like they had to revise all the error handling paths everywhere wtf?
Avoid state corruption via bailout · php/php-src@31c0ea7
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 21, 2026 at 2:16 PM
that's a *big* change github.com/php/php-src/...
it looks like they had to revise all the error handling paths everywhere wtf?
it looks like they had to revise all the error handling paths everywhere wtf?
Seriously how is this only one CVE
The people dealing with this now deserve a statue in their honor or something.
github.com/php/php-src/...
The people dealing with this now deserve a statue in their honor or something.
github.com/php/php-src/...
Avoid state corruption via bailout · php/php-src@31c0ea7
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 22, 2026 at 11:35 AM
Seriously how is this only one CVE
The people dealing with this now deserve a statue in their honor or something.
github.com/php/php-src/...
The people dealing with this now deserve a statue in their honor or something.
github.com/php/php-src/...
Yeah it's enormous and I haven't yet found a detailed explanation of the issue or how the fix addresses it. It is a bit concerning github.com/php/php-src/...
Avoid state corruption via bailout · php/php-src@31c0ea7
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 22, 2026 at 12:32 PM
Yeah it's enormous and I haven't yet found a detailed explanation of the issue or how the fix addresses it. It is a bit concerning github.com/php/php-src/...
今晩のお楽しみ、を見てたんですが
https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
過去PHPのコードは見たことなかったもんで、「あー、なるほど、先に古いコード修正してから新しい方向に伝播させるのね」ってのを理解したから、今日は良い日。
https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
過去PHPのコードは見たことなかったもんで、「あー、なるほど、先に古いコード修正してから新しい方向に伝播させるのね」ってのを理解したから、今日は良い日。
Avoid state corruption via bailout · php/php-src@3584a98 · GitHub
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 21, 2026 at 3:07 PM
今晩のお楽しみ、を見てたんですが
https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
過去PHPのコードは見たことなかったもんで、「あー、なるほど、先に古いコード修正してから新しい方向に伝播させるのね」ってのを理解したから、今日は良い日。
https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19
過去PHPのコードは見たことなかったもんで、「あー、なるほど、先に古いコード修正してから新しい方向に伝播させるのね」ってのを理解したから、今日は良い日。
#php2shell landed:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
RCE via OOM corruption
## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...
github.com
October 21, 2026 at 1:43 PM
#php2shell landed:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Wheeeeeeeee!
変更点はこれかな？
PHP-8.3.36ブランチ（テストファイルが色々増えててでかい方）:
github.com/php/php-src/...
PHP-8.1-CVE-2026-109618-109619ブランチ（diffが比較的シンプルな方）:
github.com/php/php-src/...
PHP-8.3.36ブランチ（テストファイルが色々増えててでかい方）:
github.com/php/php-src/...
PHP-8.1-CVE-2026-109618-109619ブランチ（diffが比較的シンプルな方）:
github.com/php/php-src/...
Avoid state corruption via bailout · php/php-src@3c832b5
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
C...
github.com
October 21, 2026 at 2:35 PM
変更点はこれかな？
PHP-8.3.36ブランチ（テストファイルが色々増えててでかい方）:
github.com/php/php-src/...
PHP-8.1-CVE-2026-109618-109619ブランチ（diffが比較的シンプルな方）:
github.com/php/php-src/...
PHP-8.3.36ブランチ（テストファイルが色々増えててでかい方）:
github.com/php/php-src/...
PHP-8.1-CVE-2026-109618-109619ブランチ（diffが比較的シンプルな方）:
github.com/php/php-src/...
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
#php
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
#php
RCE via OOM corruption
## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...
github.com
October 21, 2026 at 1:39 PM
PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Emergency Advisory #patchmanagement
PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Emergency Advisory
https://www.wiz.io/blog/php2shell-php-rce
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://isc.sans.edu/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell
https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
https://www.php.net/archive/2026.php#2026-10-21-5
https://security.paloaltonetworks.com/CVE-2026-109618
https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
https://docs.cloud.google.com/support/bulletins#gcp-2026-070
https://ubuntu.com/security/CVE-2026-109618
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
https://cert.europa.eu/publications/security-advisories/2026-018
https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
dlvr.it
October 21, 2026 at 6:45 PM
PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Emergency Advisory #patchmanagement
PHP 释出更新修复两个允许远程执行代码的高危漏洞
PHP 项目释出了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35，修复了两个允许未经身份验证远程执行代码的高危漏洞。开发者建议所有 PHP 用户立即进行更新。 CVE-2026-109618(GHSA-w8hw-w9fx-j79w)：内存溢出处理可能会在内部请求数据仅完成部分初始化时中断 PHP；请求清理机制可能会将这些无效数据误认为有效数据进行处理。 CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：归属于某个请求的内部状态在其底层内存被释放后仍可能残存。
PHP 项目释出了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35，修复了两个允许未经身份验证远程执行代码的高危漏洞。开发者建议所有 PHP 用户立即进行更新。 CVE-2026-109618(GHSA-w8hw-w9fx-j79w)：内存溢出处理可能会在内部请求数据仅完成部分初始化时中断 PHP；请求清理机制可能会将这些无效数据误认为有效数据进行处理。 CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：归属于某个请求的内部状态在其底层内存被释放后仍可能残存。
October 21, 2026 at 3:31 PM
PHP 释出更新修复两个允许远程执行代码的高危漏洞
PHP 项目释出了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35，修复了两个允许未经身份验证远程执行代码的高危漏洞。开发者建议所有 PHP 用户立即进行更新。 CVE-2026-109618(GHSA-w8hw-w9fx-j79w)：内存溢出处理可能会在内部请求数据仅完成部分初始化时中断 PHP；请求清理机制可能会将这些无效数据误认为有效数据进行处理。 CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：归属于某个请求的内部状态在其底层内存被释放后仍可能残存。
PHP 项目释出了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35，修复了两个允许未经身份验证远程执行代码的高危漏洞。开发者建议所有 PHP 用户立即进行更新。 CVE-2026-109618(GHSA-w8hw-w9fx-j79w)：内存溢出处理可能会在内部请求数据仅完成部分初始化时中断 PHP；请求清理机制可能会将这些无效数据误认为有效数据进行处理。 CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：归属于某个请求的内部状态在其底层内存被释放后仍可能残存。
Solidot: "PHP 释出更新修复两个允许远程执行代码的高危漏洞"
PHP 释出更新修复两个允许远程执行代码的高危漏洞
PHP 项目释出了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35，修复了两个允许未经身份验证远程执行代码的高危漏洞。开发者建议所有 PHP 用户立即进行更新。
CVE-2026-109618(GHSA-w8hw-w9fx-j79w)：内存溢出处理可能会在内部请求数据仅完成部分初始化时中断 PHP；请求清理机制可能会将这些无效数据误认为有效数据进行处理。
CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：归属于某个请求的内部状态在其底层内存被释放后仍可能残存。由同一个工作进程处理的后续请求，可能会在正常初始化将其重置之前使用该陈旧状态。
www.solidot.org
October 21, 2026 at 3:37 PM
Solidot: "PHP 释出更新修复两个允许远程执行代码的高危漏洞"
"What I fear most isn't death. What I fear most is...attachment. Once I become attached to something, I fear that I will lose it."
RP Experience: About 9-10 Years give or take.
Not new to the character or the verse.
SFW is preferred as per usual.
#PersonaRP #MVRP #P3RP #SegaRP #RPSky
RP Experience: About 9-10 Years give or take.
Not new to the character or the verse.
SFW is preferred as per usual.
#PersonaRP #MVRP #P3RP #SegaRP #RPSky
October 7, 2026 at 5:08 AM
"What I fear most isn't death. What I fear most is...attachment. Once I become attached to something, I fear that I will lose it."
RP Experience: About 9-10 Years give or take.
Not new to the character or the verse.
SFW is preferred as per usual.
#PersonaRP #MVRP #P3RP #SegaRP #RPSky
RP Experience: About 9-10 Years give or take.
Not new to the character or the verse.
SFW is preferred as per usual.
#PersonaRP #MVRP #P3RP #SegaRP #RPSky
"The execution queen, hm...? Not an honorable nickname by most perspectives, but it's not all bad. I will strike down all that stand in my way!"
❄️Canon Divergent
❄️Single Ship with Shinjiro Aragaki ♡
❄️MVRP & OC Friendly
~ Adored by Xixi
#P3RP
#PersonaRP
❄️Canon Divergent
❄️Single Ship with Shinjiro Aragaki ♡
❄️MVRP & OC Friendly
~ Adored by Xixi
#P3RP
#PersonaRP
August 25, 2026 at 5:56 PM
"The execution queen, hm...? Not an honorable nickname by most perspectives, but it's not all bad. I will strike down all that stand in my way!"
❄️Canon Divergent
❄️Single Ship with Shinjiro Aragaki ♡
❄️MVRP & OC Friendly
~ Adored by Xixi
#P3RP
#PersonaRP
❄️Canon Divergent
❄️Single Ship with Shinjiro Aragaki ♡
❄️MVRP & OC Friendly
~ Adored by Xixi
#P3RP
#PersonaRP
#p5rp. #personarp. #prp. #mvrp.
#p3rp. #persona3rp. #persona4rp.
#persona5p. #nintendorp. #bskyrp.
#p4rp. #rpsky. #multiverserp.
#p5rp. #personarp. #prp. #mvrp.
#p3rp. #persona3rp. #persona4rp.
#persona5p. #nintendorp. #bskyrp.
#p4rp. #rpsky. #multiverserp.
March 22, 2025 at 12:54 AM
#p5rp. #personarp. #prp. #mvrp.
#p3rp. #persona3rp. #persona4rp.
#persona5p. #nintendorp. #bskyrp.
#p4rp. #rpsky. #multiverserp.
#p5rp. #personarp. #prp. #mvrp.
#p3rp. #persona3rp. #persona4rp.
#persona5p. #nintendorp. #bskyrp.
#p4rp. #rpsky. #multiverserp.
“ You can close your eyes. ”
[ #Persona3RP #P3RP
#PersonaRP #MVRP ]
“ I'll always remain here
by your side. ”
“ You can close your eyes. ”
[ #Persona3RP #P3RP
#PersonaRP #MVRP ]
“ I'll always remain here
by your side. ”
a girl with blonde hair and a red bow is sitting on a railing
ALT: a girl with blonde hair and a red bow is sitting on a railing
media.tenor.com
November 9, 2025 at 9:56 PM
“ You can close your eyes. ”
[ #Persona3RP #P3RP
#PersonaRP #MVRP ]
“ I'll always remain here
by your side. ”
“ You can close your eyes. ”
[ #Persona3RP #P3RP
#PersonaRP #MVRP ]
“ I'll always remain here
by your side. ”