An explanation of CVE-2026-109618 and CVE-2026-109619: the two PHP2Shell vulnerabilities

Two vulnerabilities can have the same name, impact the same software, and be patched in the same release even if they involve different problems.

The same applies to CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities generally referred to as PHP2Shell.

The simplest way to differentiate between the two is that CVE-2026-109618 involves unsafe handling of interrupted memory operations, whereas CVE-2026-109619 involves an outdated internal state carrying over between requests. PHP considers both of them to be possible means of achieving unauthenticated remote code execution.

Website owners should bear in mind the shared remedial measures and make sure that both fixes are included in the PHP deployment. For developers and administrators, understanding the differences serves to explain why it cannot be assumed that one configuration change will address all the affected paths.

The article looks at the weaknesses of plain language and outlines how to carry out a useful security review. The information relating to specific incidents refers to the advisories available on October 30, 2026.

Why are there two CVE numbers?

A CVE number provides each vulnerability with a consistent reference in advisory notices, security tools, vendor notifications, and maintenance records.

The identifier by itself doesn't explain the vulnerability; you have to refer to the accompanying advisory to find out which component is affected, what the failure mechanism is, the conditions under which it occurs, and how it should be remedied.

Operationally two distinct identifiers are important since a statement like "PHP2Shell is handled" could be ambiguous.

Did the provider carry out both corrections? Did it impose a temporary restriction on one path? Did it check the services that were running, or did it simply download the updated package?

When raising maintenance requests, use both CVE identifiers since this makes the expected coverage clear and helps prevent confusion if more than one notice is issued during the same incident.

PHP2Shell Comparison at a Glance

The comparison set out below summarizes the main difference mentioned in the PHP advisories.

What the two descriptions have in common is that they refer to the internal runtime behaviour rather than to an ordinary website setting being entered incorrectly.

First, Understand Requests, Workers, and Memory

A request is an instruction or question which is sent to a website, and opening a page or filling in a form will result in requests being generated.

A worker is a running process or execution unit which carries out the work for the service; in certain deployments the workers can stay available to deal with further requests.

Memory serves as the temporary working space that software uses when it is processing information.

An application must have rules which specify how to allocate that space, how to initialise its contents, how to use it, and how to release it, and these rules also have to be safe in the event of a failure.

Let us consider an office which is handling customer forms. The staff will need working desks, temporary folders, and there must be clear rules stating what to keep or throw away after each task.

If the office's method of cleaning up is unreliable, the next issue might go beyond just a misplaced form, since someone might act upon incomplete information or make use of records that no longer pertain to the present task.

The analogy serves only to explain the concepts; computer memory has various properties and the real vulnerabilities depend on the conditions set out in the technical advisories.

CVE-2026-109618: Interrupted Work and Invalid Cleanup

The advisory issued by PHP states that when there is not enough memory the process can be suddenly terminated while the memory for the request has not yet been fully set up. The request shutdown procedure may then proceed using an invalid state.

Picture a worker putting together a set of folders that are numbered.

The worker has made a number of folders but has not completed the task of assigning their contents. When an interruption occurs, the setup is stopped. Later on, a different procedure is given instructions to deal with the whole set as if all the folders were ready.

The issue goes beyond the office having run out of space since the assumption upon which further work is based is no longer valid.

In software an incorrect assumption regarding memory can result in wrong reads, faulty cleanup decisions, or improper execution behaviour.

The fact that an error occurs does not by itself prove that exploitation has taken place; administrators must still be able to tell the difference between normal application failures and cases in which someone has turned unsafe behaviour into unauthorized access.

What differences are there in the repair?

PHP includes a patch which changes the behaviour that previously caused an unsafe abrupt exit when out of memory, by introducing a mechanism designed to prevent invalid states from being exposed during shutdown processing.

When an owner is looking at a maintenance ticket, the practical issue is whether the runtime that has been installed includes that correction.

Although a developer repairing an application error might enhance stability, this action should not be taken as equivalent to verifying the runtime patch.

CVE-2026-109619: Old References Surviving Too Long

A second defect involves the internal state that a worker keeps on after the memory to which the worker refers has been freed. It is possible for a subsequent request to come across this outdated state before the normal initialization process replaces it. PHP refers to this as a use-after-free problem.

The example of returning to the office.

When a worker has completed a task he returns the temporary storage space so that it can be used again, but he leaves behind a reference card that points to the original location.

A new task starts. Although the card remains, the information which it previously identified is not any longer guaranteed to be available.

Carrying out that action might result in an error since the reference has outlived the item it was intended to identify.

The key distinction in a program is between the duration of a reference and that of the memory it refers to.

The reference should still be usable even after that relationship has become invalid.

Why Is the Next Request Important?

The advisory issued by PHP explains that certain operations have been demonstrated as taking place across separate requests that are handled by the same worker; one of these operations leaves state behind, and a subsequent operation then acts on that state.

The practical implication is that if you want to understand a failure then you have to consider a sequence of activities.

Focusing on a single individual request may cause a review to overlook the context which gives another event its significance.

Does running out of memory cause both of these problems?

The mechanisms may overlap and yet remain different vulnerabilities.

The way the system handles out-of-memory situations is at the heart of CVE-2026-109618; in the stale-state advisory, memory exhaustion is listed as one possible interruption, together with other methods by which the state can survive incorrectly.

For those defending the system, a well-known error message should not be considered a reliable indicator of the underlying CVE.

A memory overflow could be caused by a typical workload, an application issue, or by可疑 behaviour. The significance of such an event is determined by the surrounding evidence.

You should not refer to the exploited vulnerability based on a single crash message unless the investigation has supported that conclusion.

A useful report can say exactly what was observed while leaving the cause open:

A failure was encountered by a PHP worker when there was unusual activity in relation to the request. At this stage, the available evidence has not yet shown that code execution was successful or identified the vulnerability responsible.

This phrasing provides the response team with a clear starting point and at the same time does not turn a lead into a confirmed finding.

Are both of these flaws just as easy to take advantage of everywhere?

No single deployment label should replace an assessment.

The PHP assessment includes several web-serving environments within the scope of the risk and regards mod_php as the most risky configuration, there having been an example of an attack before the application code was executed.

The advisory for CVE-2026-109618 also makes a distinction between demonstrated behaviour and susceptibility which is supported by source analysis; these represent different levels of evidence.

When preparing the maintenance plan, the operator should identify the real server integration, the application deployment, and the installed fixes.

You should not assume that all vulnerable configurations are equally exploitable, any more than you should regard the lack of a demonstrated attack on one configuration as evidence that it is unnecessary to apply a patch.

The security review ought to be based on evidence relating to your deployment rather than on a general assumption regarding the server name.

Does Remote Code Execution Mean Full Server Control?

Remote code execution means an attacker can make unauthorized code run.

The access that results is determined by the security context of the process in question.

When you are evaluating the consequences, consider which files, databases, credentials, and connections the process might have access to. If more extensive control over the operating system is required, then the appropriate privileges or extra access must be obtained.

For example, a hypothetical account for a web service which has the permission to alter the application files carries a different level of risk from one that is only allowed to read a restricted application directory.

One should not assume either of the arrangements based on the name of the vulnerability.

The same distinction is important when talking about data theft since having access to a resource, the fact that it was accessed, and evidence that information left the environment all constitute separate findings.

Which of the PHP releases include both fixes?

The Canadian Centre for Cyber Security lists these fixed releases for the original vulnerabilities:

They are reference points which are specific to each incident. You should check for any subsequent applicable updates; the advisory also states that certain distributors and long-term support providers provide backported fixes.

Request from your provider the current package revision and the advisory that confirms coverage of both CVEs.

Store the evidence in your maintenance record, particularly in the case where the version reported does not match the upstream release numbering.

Why Temporary Mitigations Need Careful Review

The path which the temporary control involves should be described.

PHP states that configuration measures help to reduce those particular exposures while updates offer the full solution for the two original vulnerabilities.

For an owner, “we applied a mitigation” should lead to a few practical questions:

– What vulnerability and what path does it deal with?

— At what place was the control carried out?

• What was done to verify its effective configuration?
• What exposure remains?
• Who is going to carry out the update?

You should not copy any configuration changes unless you have discussed their effects with the administrator, since a change made to deal with one situation might also have an impact on availability or application behaviour.

You should keep the temporary work open until the operator has confirmed the final state intended.

Is CVE-2026-115560 one of these two faults?

Not at all; that matter is dealt with in the PHP notice issued on October 23.

The advisory from Canada states that this situation calls for a rare combination of settings and the way the application behaves and was not included in the updates issued on October 21.

Track additional notices separately.

The maintenance ticket relating to the two original CVEs should not simply turn into a statement asserting that all subsequent PHP issues have also been resolved.

Have the two original vulnerabilities been included in CISA's catalog?

It has been confirmed by the Canadian Centre for Cyber Security that the vulnerabilities CVE-2026-109618 and CVE-2026-109619 were included in CISA’s Known Exploited Vulnerabilities catalog on October 26, 2026.

It doesn't indicate which defect was responsible for each suspicious occurrence in a given environment.

An investigation still requires evidence that links the observed activity to a cause. The pressure to take corrective action should be kept separate from any certainty regarding a specific incident.

How to Organize a PHP2Shell Review

1. Identify each deployment

Make a record of the website, the hosting environment, the active PHP package, and the person in charge.

Make it include the public staging sites as well as the older installations.

2. Ask for coverage of both CVEs

When making the request, use the complete identifiers and ask for evidence at the package level not just for a general assurance.

3. Check the services that are running

Make sure that the correct software is active on all relevant workers, containers, and server instances.

Make a record of the items that were checked and the times at which they were checked.

Section 4: The Application Functions of Testing

After the change, check the workflows that are important to visitors and staff.

We need to deal with document compatibility issues and assign the subsequent tasks.

5. Assess Earlier Exposure

Inquire whether the activity records available are sufficient for the purpose of launching an investigation.

Keep patch verification and compromise assessment as separate results.

Frequently Asked Questions

Are the two CVEs for PHP2Shell duplicates?

On the contrary, they involve different internal failure mechanisms, even though they have the same broader incident name and were released with fixes.

Do I have to install PHP twice in order to fix them?

Certainly. Here is the rewritten text in English, adhering strictly to all the rules provided:

Check that the selected runtime update or vendor package contains the necessary corrections.

Can an application update take the place of a PHP update?

Do not assume this. You need to check application maintenance and runtime maintenance separately.

Does the fact that a PHP crash occurs prove that exploitation has taken place?

By no means is a crash an observation; it requires investigation to determine its cause and the security consequences.

Should I decide which CVE is more important before I apply the patch?

In the case of an affected deployment, it is necessary to obtain coverage for both. Knowing the technical differences should help in carrying out the remediation rather than postponing it.

Keep the Comparison Connected to Action

The difference between the two flaws helps to account for the advisories: one relates to unsafe interruption and cleanup, the other to the state continuing beyond the period for which it is valid.

Ask accurate questions based on that understanding; find out which package is the one in use, check that both fixes have been applied, and record any uncertainty that remains.

A good response should be concluded by providing evidence of the actual deployment and by designating a clear owner for each task that has not been resolved.

Sources

1. PHP security advisory: CVE-2026-109618 — RCE via OOM corruption.
2. PHP security advisory: CVE-2026-109619 — RCE via stale global state.
3. PHP official announcements: Critical RCE advisory and related notices.
4. CISA: Known Exploited Vulnerabilities Catalog.
5. Canadian Centre for Cyber Security: AL26-026 — Critical vulnerabilities impacting PHP.