Two critical remote code execution vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed on 21 October 2026, impacting the PHP interpreter at the Zend Engine level before any user code runs.
The flaws exploit the engine’s emergency exit via longjmp() during out-of-memory conditions and stale pointer reuse after fatal errors or timeouts, particularly when session.upload_progress tracking is active.
Patches were released only for currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12), leaving legacy PHP 5.6 installations without official fixes and especially vulnerable when running under Apache mod_php.
Original vulnerable architecture
The affected production environment uses Docker Compose on AlmaLinux with traffic flowing through Hitch TLS terminator, Varnish 6.0 LTS, and two Apache containers running mpm_prefork + mod_php (PHP 5.6.40 from Remi). Default settings included MaxConnectionsPerChild 1000, memory_limit 512M, and enabled session upload progress tracking, creating ideal conditions for both CVEs.
Layered mitigation strategy
The administrator applied four defensive layers. First, a dedicated zz-cve-2026.ini file disables session.upload_progress.enabled = 0 and sets memory_limit = -1, moving memory control to Docker cgroups while also tightening post_max_size, upload_max_filesize, and input limits.
Second, Docker resource limits cap each Apache container at 4 GB RAM, ensuring the kernel OOM killer terminates runaway processes without invoking PHP destructors. Apache configuration was changed to MaxConnectionsPerChild 1 and LimitRequestBody 33554432 to eliminate reuse of potentially corrupted worker memory.
Third, Varnish VCL rules block requests containing PHP_SESSION_UPLOAD_PROGRESS cookies or URLs and reject oversized POST bodies before they reach PHP backends.
Fourth, synthetic error responses for 403 and 413 status codes force Connection: close to prevent keep-alive drain attacks that could stall Varnish workers.
Testing results and edge cases
Verification confirmed that Varnish correctly returns 403 for malicious cookies on PHP routes while leaving Node.js backends unaffected. Direct Apache tests showed that LimitRequestBody and PHP’s post_max_size checks interact differently depending on whether an index.php handler is present, highlighting the need for defense-in-depth.
The complete set of controls neutralizes both PHP2Shell vectors on the unsupported legacy stack without requiring code changes or downtime.
