php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE
In October 2025, two pre-authentication remote code execution vulnerabilities in PHP core—CVE-2026-109618 and CVE-2026-109619, collectively dubbed php2shell—were disclosed ahead of coordinated release. Discovered by researcher Calif, the flaws exploit dangling session pointer conditions and serializer issues to achieve unauthenticated RCE against Apache mod_php and PHP-FPM deployments respectively. Exploitation is technically feasible but highly conditional, requiring precise heap layout control, ASLR bypass via information leak, and version-specific offsets. High-value targets include edge appliances with PHP management interfaces such as Palo Alto PAN-OS and Citrix NetScaler, where even DMZ-resident RCE yields meaningful attacker leverage. Php2shell highlights a persistent and underappreciated risk pattern: low-severity findings such as exposed phpinfo pages aggregate into critical exploitation preconditions. As AI-assisted exploit development accelerates N-day weaponization timelines, organizations must reassess how informational disclosures compound with memory corruption vulnerabilities to enable targeted, high-impact intrusions against network perimeter appliances.
Kill Chain
