Kaspersky Flags Critical PHP Flaws and Adds Detection Rules for Exploitation

The PHP security team released emergency updates on October 21, 2026, at 14:00 UTC addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The release was expedited after information about the vulnerabilities leaked to the public before the scheduled embargo was lifted.

In a post on Hacker News, a user reported two remote code execution (RCE) vulnerabilities allegedly affecting all versions starting with PHP 5.4.0, and researchers confirmed their existence shortly afterward.

Vulnerability details and exploit circulation

Along with the leaked details, an exploit unofficially named PHP2Shell appeared online. A leaked demo video shows the exploit in action on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS. The authenticity of the demonstration and the exact behavior of the exploit had not been independently verified at the time of publication.

According to the researcher who published the PoC, the vulnerabilities relate to the handling of the multipart/form-data MIME type in conjunction with the session upload progress mechanism (session.upload_progress) in the PHP core and fall under the use-after-free and memory corruption categories. This means the flaws cannot be fixed via application code, and the only fix is to update PHP on the server.

The attack requires no authentication: an attacker with network access to a PHP application can execute arbitrary code with the privileges of the PHP process without authenticating.

The security advisories issued by the PHP team on October 21 confirm this information. The vulnerabilities affect PHP versions 5, 7, and 8. As of publication, the supported branches are 8.2 through 8.5.

Older branches, including PHP 8.1, 8.0, 7.x, and 5.x, have reached end of life, but due to the critical severity of the vulnerabilities, backported patches were also released for versions 7.4, 8.0, and 8.1. Sansec experts estimate that widespread exploitation could begin within 15 minutes of the update's release.

Recommended steps for administrators

Kaspersky recommended that administrators responsible for publicly accessible PHP web servers take steps before the patch is available, including taking an inventory of all PHP-based systems such as web servers, control panels, and third-party software.

It also advised disabling upload progress by setting session.upload_progress.enabled = Off using php_admin_flag in PHP-FPM pools, blocking multipart requests on nginx and Apache servers, considering temporarily isolating internet-connected PHP applications until fixes are released, being ready to install the patch immediately upon release, and planning to migrate servers running unsupported versions (8.1 and earlier) to the latest PHP branch.

Detection by Kaspersky solutions

Kaspersky solutions detect the described malicious activity at various stages of the attack.

When an attempt is made to exploit the RCE vulnerabilities, Kaspersky Endpoint Detection and Response promptly alerts the user to suspicious actions performed in the context of a web server on Linux and Windows machines, through rules including creating_windows_shell_from_a_web_servers_process, possible_web_shell_creating_via_exploit, spawning_process_from_webserver_more_filters_linux, webserver_interpreter_execution_linux, and executable_file_in_www_folder.

Kaspersky Anti Targeted Attack (KATA) detects exploitation of the PHP2Shell vulnerability in network traffic with the verdicts Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C. Kaspersky Endpoint Security, now available as Kaspersky Next, detects malicious post-exploitation activity through the Behavior Detection component with verdicts such as PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.

Kaspersky Vulnerability Management detects vulnerable software versions through the Vulnerability scanning and Agentless black-box scanning components.

The Kaspersky Managed Detection and Response service detects exploitation of the described vulnerabilities by monitoring activity characteristic of RCE, including spawning of suspicious processes by the web server; creation of suspicious executable files or scripts in the web application directory; creation of files with uncommon extensions in the web application directory; execution of reconnaissance or persistence commands by the web server process; and delivery and launch of web shells on the web server.

The service also detects other malicious activity not directly related to remote code execution.

To protect companies using the Kaspersky SIEM system, the product repository includes rules that help detect execution of suspicious executable files by web server processes on Windows and Linux machines, including R300_04_Windows shell started by a web application and R152_08_A running Linux shell process has a suspicious parent process, as well as detection of reconnaissance commands by the web server process through R286_05_Possible web-shell (Linux).

Kaspersky also recommended monitoring the creation of scripts or executable files in the web server directory when developing custom detection rules or conducting threat hunting.