Summary
PHP2Shell is a pair of critical vulnerabilities in the PHP interpreter that allow unauthenticated remote code execution with the privileges of the PHP worker process. HYCU products do not include PHP and are not affected.
Date of publication
October 22nd 2026
Description
The following vulnerabilities are in scope of this advisory:
- CVE-2026-109618 (CVSS v4.0 9.2): When a request exceeds the PHP memory limit, PHP aborts it while internal request data is partially initialized, and request cleanup then uses that data. A crafted multipart upload can trigger this and lead to remote code execution before any application code runs.
- CVE-2026-109619 (CVSS v4.0 9.2): When a request ends with a fatal error, PHP does not clear global state that points into the freed request memory. A later request on the same worker uses the freed memory, which leads to remote code execution or disclosure of worker process memory. Session upload progress, enabled by default, is one of the exploitation paths.
Both vulnerabilities affect mod_php, PHP-FPM, and php-cgi. Fixed upstreamversions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Impact
HYCU products are not affected: they do not install any PHP packages or use any PHP functionality.
Mitigation
No action is required.
Comments
Please sign in to leave a comment.