Executive Summary

BGD e-GOV CIRT alerts organizations to two critical vulnerabilities in the PHP runtime, collectively discussed under the name PHP2Shell. The vulnerabilities can enable unauthenticated remote code execution in vulnerable PHP deployments, potentially allowing an attacker to execute code on a web server without first authenticating to the application.

The vulnerabilities affect PHP request-processing and internal state-management behavior:

·  CVE-2026-109618: Remote code execution associated with out-of-memory (OOM) handling and corruption of partially initialized request data.

· CVE-2026-109619: Remote code execution associated with stale global state and the use of request-related state after its backing memory has been freed.

The official security notice identifies PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments as potentially at risk. It highlights particular concern for mod_php, where an unauthenticated request has been demonstrated to trigger exploitation before application code executes.

Fixed releases are available for PHP 8.5, 8.4, 8.3 and 8.2. Organizations should upgrade the PHP runtime immediately. Configuration changes and network restrictions can reduce exposure while patching is arranged, but they do not provide a complete fix.

Vulnerability Details

CVE-2026-109618 — Out-of-Memory Handling

The vulnerability concerns PHP's handling of an out-of-memory condition while internal request data is only partially initialized. During request cleanup, the runtime may incorrectly treat invalid or incomplete data as valid.

Under exploitable conditions, this behavior can potentially lead to remote code execution.

CVE-2026-109619 — Stale Global State

This vulnerability concerns request-owned internal state that can remain accessible after the associated memory has been freed. A subsequent request handled by the same worker may use that stale state before normal initialization resets it.

Under exploitable conditions, the resulting invalid state handling can potentially lead to remote code execution.

These descriptions reflect the published vulnerability mechanisms; they should not be interpreted as evidence that a particular Bangladesh-based system has been exploited.

Affected Environments

Organizations should identify PHP installations running web-facing applications, including:

· PHP-FPM behind a web server or reverse proxy.

· Apache using mod_php.

· php-cgi deployments.

· FrankenPHP deployments.

· LiteSpeed deployments.

· PHP runtimes inside containers and application images.

· Managed or shared hosting environments.

· Web applications built with PHP frameworks or content-management systems.

Applications using PHP may include government portals, public-facing APIs, administrative systems, e-commerce platforms and internal web applications.

Important: Updating an application or framework does not necessarily update the PHP runtime underneath it. Administrators must verify that the runtime serving web requests has received the security fix.