# Detection Coverage - PHP2Shell (CVE-2026-109618 and CVE-2026-109619) **URL:** \ **Category:** Rule Signatures\ **Created:** [October 22, 2026, 8:43pm UTC](https://community.emergingthreats.net/t/detection-coverage-php2shell-cve-2026-109618-and-cve-2026-109619/3488 "2026-10-22T20:43:08Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Post date:** [October 22, 2026, 8:43pm UTC](https://community.emergingthreats.net/t/detection-coverage-php2shell-cve-2026-109618-and-cve-2026-109619/3488/1 "2026-10-22T20:43:08Z")
# Summary PHP2Shell consists of two CVE’s 2026-109618 and 2026-109619 which allow Remote Code Execution (RCE). Both CVE’s were originally leaked on October 20, 2026 and officially announced on October 21, 2026. Below are details for each vulnerability as well as Detection provided by the Emerging Threats OPEN Ruleset. ## IDSes and PHP2Shell Suricata/Snort cannot determine whether two requests reached the same FPM (FastCGI Process Manager) worker, whether a session handler differs between directories, or whether a PHP memory error led to command execution. Those questions require server logs, process telemetry, or correlation outside the packet sensor. Additionally, rules that inspect multi-megabyte HTTP bodies can increase memory use and processing time. PCRE over large buffers can become expensive, particularly with broad repetition, (.\*) expressions, or patterns that scan for long runs. A high-volume attacker could turn an aggressive detection rule into a sensor-performance problem. The practical conclusion for a broadly distributed ruleset is simple: provide useful visibility, avoid brittle PoC fingerprints, and be conservative with resource-intensive signatures. CVE-2026-109618 is generally more network-detectable because its triggers have extreme request shapes. CVE-2026-109619 requires more stateful and host-level context. Because these indicators are limited and not entirely unique, users should expect potential false positives and validate alerts against their normal traffic before taking action. In both cases, IDS rules are compensating controls, not a patch. # RCE via OOM Corruption - CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). # RCE via Stale Global State - CVE-2026-109619 PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE) ## References > **[Security advisory: Critical remote code execution vulnerabilities, update now -...](https://www.php.net/archive/2026.php#2026-10-21-5)** > > PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. | PHP is a popular general-purpose scripting language that... [https://www.cve.org/CVERecord?id=CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) [https://www.cve.org/CVERecord?id=CVE-2026-109619](https://www.cve.org/CVERecord?id=CVE-2026-109619) > **[RCE via stale global state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)** > > \## Summary > > PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset ... > **[RCE via OOM corruption](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)** > > \## Summary > > PHP uses \`longjmp()\` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ... # Signatures - Released 2026-10-22 ```ET ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618) - 2072551 ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619) - 2072554 ET EXPLOIT PHP php2shell Excessive Empty Multipart File Controls (CVE-2026-109618) - 2072557 ET EXPLOIT PHP php2shell Excessive Multipart Part Count (CVE-2026-109618) - 2072556 ET EXPLOIT PHP php2shell Handler-mismatch Session Injection (CVE-2026-109619) - 2072548 ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618) - 2072549 ET EXPLOIT PHP php2shell Multipart Request without Content-Length (CVE-2026-109618) - 2072553 ET EXPLOIT PHP php2shell Nested Empty File Control OOM (CVE-2026-109618) - 2072550 ```