PHP2Shell (CVE-2026-109618 & CVE-2026-109619): 9.2 Critical RCE Endangers 75% of the Internet — WordPress & PrestaShop Security Dossier

The global cybersecurity landscape was shaken this morning by the public disclosure of "PHP2Shell"—a catastrophic vulnerability pair residing deep inside the memory allocation and error recovery routines of the standard PHP interpreter. Tracked under CVE-2026-109618 and CVE-2026-109619, both flaws carry an alarming CVSS v4.0 base score of 9.2 (Critical).

Unlike typical application-level bugs found in vulnerable third-party plugins, PHP2Shell is embedded directly within the core engine of PHP itself (the Zend Engine). It affects all Server Application Programming Interfaces (SAPIs)—including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Even more critically, on deployments running Apache with mod_php, the attack can be triggered unauthenticated and before any CMS code (such as WordPress or PrestaShop core) even executes.

1. Technical Anatomy: How PHP2Shell Achieves Pre-Auth Remote Code Execution

To understand why PHP2Shell represents an existential threat to modern web servers, one must examine how the PHP interpreter historically manages fatal runtime conditions, particularly out-of-memory (OOM) threshold breaches.

A. The Flaw in Error Aborts: Abuse of longjmp()

When a script exceeds the directive memory_limit during incoming payload processing (such as parsing large multipart form boundaries, deserializing strings, or decoding headers), the Zend Engine encounters an unrecoverable failure. Rather than cleanly unwinding the execution stack through sequential C function returns, PHP uses the POSIX/C primitive longjmp() to execute an abrupt non-local jump back to the top-level request handler.

This abrupt jump bypasses mandatory destructor routines, leaves complex data structures partially initialized in the heap, and prevents internal reference counters from decrementing.

B. CVE-2026-109618: Out-of-Memory Heap Corruption

In CVE-2026-109618, an attacker crafts an unauthenticated HTTP request with mathematically calculated payload boundaries designed to trip the memory_limit precisely during the allocation of a multi-dimensional array or hash table. Because longjmp() interrupts the routine mid-stride, the memory manager’s subsequent request-cleanup cycle treats uninitialized or partially linked memory as valid Zend objects.

During memory free operations, the pointer traversal reads attacker-supplied values as memory pointers, allowing attackers to write arbitrary 64-bit addresses, overwrite function pointers (such as zend_execute_ex), and redirect execution flow directly into memory containing custom shellcode.

C. CVE-2026-109619: Stale Global State & Inter-Request Use-After-Free (UAF)

In CVE-2026-109619, the bug targets the persistent nature of modern multi-request worker pools (such as PHP-FPM worker pools and FastCGI daemons). When a request terminates abruptly due to a fatal memory fault, internal global pointers (such as output buffer streams, stream wrappers, or session registries) can retain dangling references into memory addresses that were deallocated at the end of the failed request.

When the worker picks up the subsequent HTTP request, it operates on these stale, dangling pointers. Attackers exploit this Use-After-Free condition across request boundaries to read sensitive process memory (extracting database credentials, encryption salts, and auth cookies) or forge vtable entries that deliver seamless Remote Code Execution.

2. The Numbers: Dissecting the Global Attack Surface

The mathematical surface area of PHP2Shell is staggering. Web infrastructure statistics paint a concerning picture of the global attack vector:

Metric / Indicator	Quantified Data	Cybersecurity Implication
Global PHP Market Share	75.4% of all websites	Affects over 1.2 billion internet-facing domains.
WordPress Exposure	43.5% of the entire Internet	~830 million sites run on PHP-backed WordPress cores.
PrestaShop E-Commerce Stores	300,000+ active merchants	Billions in transaction volumes vulnerable to silent skimming.
Vulnerable PHP Version Range	PHP 5.4.0 through PHP 8.5.11	A 14-year software vulnerability window.
EOL Unpatched Deployments	64.8% of active web servers	Servers running PHP 7.4 / 8.0 / 8.1 require third-party backports or manual mitigation.
CVSS v4.0 Rating	9.2 / 10.0 (Critical)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

3. Impact on E-Commerce & CMS: WordPress and PrestaShop Under Fire

For digital merchants and web publishers, the consequences of PHP2Shell extend far beyond temporary server downtime. Because the vulnerability grants execution privileges at the operating system user level (typically www-data, nginx, or apache), malicious actors weaponize the breach in several automated phases:

1. Silent Webshell Deployment: Once arbitrary code execution is gained, attackers inject stealthy PHP webshells disguised as legitimate system files (e.g., hidden inside wp-includes/, modules/, or deep within theme asset folders).
2. Payment Gateway & Credit Card Skimming: On PrestaShop stores, attackers tamper with payment module hooks (e.g., Mollie, Stripe, PayPal) or inject JavaScript listeners into checkout templates to harvest customer credit card numbers, CVVs, and billing addresses in real time.
3. Database Tampering & Shadow Admin Creation: Attackers directly manipulate MySQL/MariaDB databases, inserting rogue administrative accounts, modifying order statuses, or stealing user password hashes and customer personally identifiable information (PII).
4. SEO Spam & Cloaked Redirections: Once compromised, sites are infected with conditional redirections that serve pharmacy, gambling, or phishing malware exclusively to search engine crawlers, triggering catastrophic Google Search Console security penalties and total organic traffic loss.

4. Urgent Remediation Protocol

Every system administrator, e-commerce developer, and site owner must execute the following remediation roadmap immediately:

Step 1: Upgrade to Official Upstream Releases

If your infrastructure is running supported PHP versions, upgrade immediately to the patched releases issued by the PHP Foundation:

• PHP 8.5: Upgrade to 8.5.12 or later
• PHP 8.4: Upgrade to 8.4.27 or later
• PHP 8.3: Upgrade to 8.3.36 or later
• PHP 8.2: Upgrade to 8.2.35 or later

Step 2: Emergency Mitigation for EOL Servers (PHP 7.4 – 8.1)

If legacy modules prevent an immediate migration to PHP 8.2+:

• Ensure you are using your Linux distribution’s Enterprise LTS repositories (e.g., Ubuntu ESM, Red Hat Enterprise Linux, Debian LTS, or AlmaLinux) with backported patches applied.
• Migrate away from mod_php immediately to PHP-FPM, and configure strict process isolation and lower worker lifespans (e.g., pm.max_requests = 500) to curtail inter-request use-after-free exploitation windows.

Step 3: Deploy Deep-Scan Malware & Webshell Detection

Because weaponized bots scan internet IP ranges within minutes of zero-day disclosures, verifying the integrity of your CMS files, database records, and active modules is mandatory.

5. Conclusion: Beyond Reactionary Patching

The PHP2Shell vulnerability serves as a stark reminder that the modern web runs on shared foundation layers that are decades old. When memory safety bugs surface in the interpreter itself, perimeter defenses (like basic Web Application Firewalls) are frequently bypassed by crafted memory-pressure payloads.

Securing your e-commerce platform and business assets demands a defense-in-depth posture: continuous binary updates, strict server process isolation, and automated forensic scanners capable of auditing every file and database row for post-exploitation persistence.