CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability

Overview

CVE-2026-109619 is a high-severity vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from stale internal request-state, allowing attackers to manipulate freed memory. This vulnerability affects a wide range of PHP versions and products, including critical network devices, and is being actively exploited by threat actors, including state-sponsored groups and ransomware operators, often in conjunction with PHP2Shell exploitation.

Technical Analysis

• Vulnerability: CVE-2026-109619 is a stale internal request-state vulnerability in PHP.
• Mechanism: PHP contains various global state variables that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after being reset, leading to it referring to freed request memory. Subsequent requests can then read or branch on this stale state before it is fully initialized.
• Impact: Multiple strategies can trigger this condition, leading to unauthenticated remote code execution (RCE).
• CVSS v3.1: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Unchecked Return Value to NULL Pointer Dereference).
• Affected Versions:
  • PHP php versions >= 5.4.0 < 8.2.35
  • PHP php versions >= 8.3.0 < 8.3.36
  • PHP php versions >= 8.4.0 < 8.4.27
  • PHP php versions >= 8.5.0 < 8.5.12
  • Siemens ruggedcom_ape1808_firmware
  • Palo Alto Networks pan-os versions >= 10.2.0 < 10.2.7
  • Palo Alto Networks pan-os version 10.2.7
  • Palo Alto Networks pan-os version 10.2.8
  • Palo Alto Networks pan-os version 10.2.9
  • Palo Alto Networks pan-os version 10.2.10
• Attack Vector: Network-based (AV:N), unauthenticated (PR:N), requiring no user interaction (UI:N). The attack complexity is high (AC:H).

Detection

• Monitor web server access logs for unusual requests to PHP files, especially those with suspicious parameters, encoded commands, or patterns indicative of PHP2Shell exploitation. Look for unexpected HTTP methods or large POST bodies to unusual endpoints.
• Detect unexpected process spawns originating from web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, apache2, php-fpm) or their child processes. Look for cmd.exe, powershell.exe, sh, bash, python, perl, nc, wget, curl, or other command-line utilities.
• Monitor for the creation of suspicious files (e.g., .php, .txt, .log files containing web shell code) in web-accessible directories (/var/www/html, htdocs, wwwroot). Look for files containing common web shell keywords like eval(, system(, passthru(, shell_exec(, base64_decode(, $_GET[, $_POST[, or PHP2Shell specific strings.
• Analyze network flow logs for outbound connections initiated by web server processes to unusual or external IP addresses/domains, indicative of C2 communication or data exfiltration.
• Review PHP error logs for unexpected errors or warnings that might indicate exploitation attempts or memory corruption.

Sigma Detection Rules

Web Server Process Spawning Suspicious Shell

title: Web Server Process Spawning Suspicious Shell
id: 90c7e2b1-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects suspicious process creation by common web server processes, indicative of RCE exploitation of CVE-2026-109619.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\python.exe'
      - '\\perl.exe'
      - '\\nc.exe'
      - '\\wget.exe'
      - '\\curl.exe'
  condition: all of selection_*
level: critical

Suspicious PHP File Creation in Web Root

title: Suspicious PHP File Creation in Web Root
id: 4f1c7e2b-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects creation of new PHP files in web-accessible directories by web server processes, potentially indicating webshell deployment (e.g., PHP2Shell) after CVE-2026-109619 exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Apache24\\htdocs\\'
      - '\\nginx\\html\\'
      - '\\www\\html\\'
  condition: selection
level: high

Web Access Log – Generic PHP RCE Attempt

title: Web Access Log - Generic PHP RCE Attempt
id: 7e2b1d3f-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects common patterns in web access logs indicative of PHP RCE attempts, potentially targeting CVE-2026-109619. This rule may produce false positives and requires tuning.
logsource:
  category: webserver
  service: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - 'passthru='
      - 'shell_exec='
      - 'eval='
      - 'base64_decode='
      - 'id%20'
      - 'whoami%20'
      - 'cat%20/etc/passwd'
      - 'wget%20'
      - 'curl%20'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
  condition: selection
level: medium

Mitigations

1. Patch PHP: Upgrade PHP installations to the latest patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer, as soon as possible.
2. Patch Affected Products: Apply vendor-specific patches for Siemens ruggedcom_ape1808_firmware and Palo Alto Networks pan-os to versions that address CVE-2026-109619.
3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block exploitation attempts targeting PHP vulnerabilities, including known PHP2Shell patterns and generic RCE payloads.
4. Least Privilege: Ensure PHP processes and web servers run with the minimum necessary privileges to limit the impact of successful exploitation.
5. Network Segmentation: Isolate web servers running PHP applications from critical internal networks to contain potential breaches.
6. Regular Audits: Conduct regular security audits and penetration tests of PHP applications and underlying infrastructure to identify and remediate vulnerabilities.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-109619
• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• http://www.openwall.com/lists/oss-security/2026/10/21/16
• https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
• https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
• https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
• https://www.vulncheck.com/blog/php2shell-vulnerabilities
• https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059.004 — Unix Shell
• T1059.003 — Windows Command Shell
• T1505.003 — Web Shell
• T1590.005 — IP Addresses
• T1053.003 — Cron
• T1005 — Data from Local System
• T1608.001 — Upload Malware
• T1595.002 — Vulnerability Scanning
• T1583.004 — Server
• T1098.004 — SSH Authorized Keys
• T1552.001 — Credentials In Files
• T1041 — Exfiltration Over C2 Channel
• T1210 — Exploitation of Remote Services
• T1486 — Data Encrypted for Impact
• T1496 — Resource Hijacking
• T1105 — Ingress Tool Transfer
• T1588.005 — Exploits
• T1592 — Gather Victim Host Information
• T1133 — External Remote Services
• T1071.004 — DNS
• T1036.005 — Match Legitimate Resource Name or Location
• T1499.004 — Application or System Exploitation
• T1071 — Application Layer Protocol
• T1036 — Masquerading
• T1595 — Active Scanning
• T1090.002 — External Proxy
• T1090 — Proxy
• T1059 — Command and Scripting Interpreter
• T1078 — Valid Accounts
• T1573 — Encrypted Channel
• T1592.002 — Software
• T1203 — Exploitation for Client Execution
• T1499 — Endpoint Denial of Service
• T1059.006 — Python
• T1071.001 — Web Protocols
• T1046 — Network Service Discovery
• T1082 — System Information Discovery
• T1583.003 — Virtual Private Server
• T1102 — Web Service
• T1562.001 — Disable or Modify Tools
• T1070.004 — File Deletion
• T1021 — Remote Services
• T1083 — File and Directory Discovery
• T1136 — Create Account
• T1018 — Remote System Discovery
• T1003.003 — NTDS
• T1021.001 — Remote Desktop Protocol
• T1567.002 — Exfiltration to Cloud Storage
• T1587.001 — Malware
• T1489 — Service Stop
• T1087.002 — Domain Account
• T1053.005 — Scheduled Task
• T1219 — Remote Access Tools
• T1558.003 — Kerberoasting
• T1583.001 — Domains
• T1135 — Network Share Discovery
• T1059.001 — PowerShell
• T1588.002 — Tool
• T1490 — Inhibit System Recovery
• T1110 — Brute Force
• T1204.002 — Malicious File
• T1114.001 — Local Email Collection
• T1572 — Protocol Tunneling
• T1021.002 — SMB/Windows Admin Shares
• T1072 — Software Deployment Tools
• T1566.001 — Spearphishing Attachment
• T1070.006 — Timestomp
• T1074.001 — Local Data Staging
• T1555.003 — Credentials from Web Browsers
• T1056.002 — GUI Input Capture
• T1003.006 — DCSync
• T1057 — Process Discovery
• T1591 — Gather Victim Org Information
• T1056.001 — Keylogging
• T1555 — Credentials from Password Stores
• T1132.001 — Standard Encoding
• T1566.002 — Spearphishing Link
• T1573.001 — Symmetric Cryptography
• T1218.011 — Rundll32
• T1497.001 — System Checks
• T1539 — Steal Web Session Cookie
• T1027 — Obfuscated Files or Information
• T1102.002 — Bidirectional Communication
• T1140 — Deobfuscate/Decode Files or Information
• T1055.012 — Process Hollowing
• T1110.001 — Password Guessing
• T1087.001 — Local Account
• T1021.004 — SSH
• T1040 — Network Sniffing
• T1567 — Exfiltration Over Web Service
• T1552 — Unsecured Credentials
• T1552.004 — Private Keys
• T1087 — Account Discovery
• T1087.004 — Cloud Account