PHP Interpreter Flaws Allow Pre-Login RCE and Credential Theft

How a Programming Language Can Have Vulnerabilities

PHP is an interpreted language. The code developers write is just text; it cannot run directly. A separate program — the PHP interpreter, written mainly in C — parses, compiles, and executes that code at runtime. Because the interpreter is software, it can contain bugs. The two vulnerabilities discussed here reside in the interpreter itself, not in application code, so even perfectly written PHP applications cannot avoid them.

Request Flow and Why Login Pages Cannot Block the Attack

When a browser sends a login request, a web server (e.g., Apache) receives it first. Static content is served directly, but dynamic pages like login are handed off to the PHP interpreter. Two common integration methods exist: mod_php (interpreter embedded as an Apache module) and PHP-FPM (interpreter runs as a separate process pool). The highest-risk scenario identified by the PHP project is the mod_php configuration.

After Apache passes the request to the interpreter, the interpreter immediately begins parsing request data — form fields, uploaded files — before any application code runs. The PHP project's advisory explicitly states the flaw triggers

before any application code runs

meaning the vulnerability is exploitable before login checks or any other application logic execute.

Vulnerability 1: Memory Exhaustion During Request Parsing (CVE-2026-109618)

While preparing internal structures for a request, the interpreter may run out of memory. This can happen either because the request hits PHP's per-request memory limit or because the system cannot allocate more memory. Some interpreter code paths simply abort initialization when allocation fails, leaving data structures only partially initialized.

During cleanup, the interpreter mistakenly treats these half-initialized structures as valid data and processes them. An attacker can craft a request that deliberately triggers memory exhaustion at a precise moment, controlling the content left in memory. The subsequent erroneous cleanup then follows attacker-controlled data, ultimately leading to remote code execution (RCE). The PHP team verified a complete code-execution chain under default mod_php memory and input limits, though reliability depends on the exact PHP version and server environment.

Vulnerability 2: Use-After-Free Across Requests (CVE-2026-109619)

PHP interpreter processes (especially under mod_php and PHP-FPM) are long-lived and handle many requests sequentially. After a request finishes, its memory is freed. However, certain fatal errors can leave a dangling pointer — a record that still references the now-freed memory region.

When the next request arrives in the same process, the interpreter may follow that stale pointer and read the freed memory. Meanwhile, the memory allocator may have reassigned that region to new data, such as passwords, session tokens, or API keys from the new request. This Use-After-Free condition allows an attacker to leak sensitive information without achieving code execution first. Researchers demonstrated extraction of credentials and keys, and the leak occurs silently — the website appears to function normally.

Attack Scenarios

First vulnerability (RCE): Attacker sends a single crafted request to any public endpoint. The interpreter parses the request, hits engineered memory exhaustion during parsing, aborts initialization, and the faulty cleanup executes attacker-controlled code. No authentication required; the attack occurs before login checks.

Second vulnerability (data leak): Attacker sends a first request that triggers a fatal error leaving a dangling pointer. A second request (which can be a normal user request) is then processed by the same interpreter process, causing it to read the freed memory containing secrets from the second request. Again, no prior authentication needed.

Impact and Scope

The two vulnerabilities are collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Researchers demonstrated unauthenticated RCE on WordPress, Drupal, and Joomla. The PHP Foundation urges updates for all web-facing PHP deployments, explicitly naming mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed as affected integration methods. While exploit difficulty varies by integration, the Foundation confirmed PHP-FPM can also reach the vulnerable code via application-specific paths.

Disclosure was accelerated after details leaked; the official release moved from October 22 to October 21. Cloudflare subsequently observed active attack traffic and attempts to bypass protections. Successful exploitation yields the PHP process's privileges — typically sufficient to read configuration files, database credentials, and application source code.