diff --git a/docs/best-practices/security/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619-and-cve-2026-115560.md b/docs/best-practices/security/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619-and-cve-2026-115560.md new file mode 100644 index 00000000..a65f7d94 --- /dev/null +++ b/docs/best-practices/security/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619-and-cve-2026-115560.md @@ -0,0 +1,119 @@ +--- +myst: + html_meta: + description: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and CVE-2026-115560 + are critical vulnerabilities in PHP itself. Learn what Hypernode did, how to + check your PHP version, and what you should check in your shop. + title: 'PHP2Shell: Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619 + and CVE-2026-115560) | Security | Hypernode' +--- + +# PHP2Shell: Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) + +In October 2026, the PHP project fixed two critical vulnerabilities in PHP itself, known as PHP2Shell. A third, narrower vulnerability followed two days later. This article explains what these vulnerabilities are, what Hypernode did, and what you should check. + +These are bugs in PHP, not in Magento, Shopware or WooCommerce. You cannot fix them from within your shop code. They are fixed by updating PHP on the server, which Hypernode does for you. + +For a full analysis, see [PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)](https://sansec.io/research/php2shell) by Sansec. + +## What Happened + +| Date | Event | +| --------------- | ----------------------------------------------------------------------------------------------------------------------------------- | +| 20 October 2026 | PHP announced an emergency security release for 21 October. Details leaked before the release. | +| 21 October 2026 | PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 (critical). | +| 23 October 2026 | PHP published an informational advisory for a third issue, CVE-2026-115560. This issue is not fixed by the 21 October releases. | + +Both PHP2Shell vulnerabilities can allow an unauthenticated attacker to run code on the server through a normal web request. The exploit tool PHP2Shell combines both bugs into one attack that needs no login. Calif, one of the researchers who found the bugs, reported that this works against Magento 2.4.9, WordPress, Drupal, Joomla, Laravel, Symfony and other PHP applications. + +### How the Vulnerabilities Work + +Both vulnerabilities are use-after-free bugs, and relate to how PHP handles memory when a request ends abnormally. A fatal error during a request, typically an out-of-memory error when a request crosses the `memory_limit`, interrupts PHP before it cleans up. A later request, or a reused PHP worker, then treats the freed memory as live data. + +| CVE | Cause | Impact | +| --------------- | ------------------------------------------------------------------- | ------------------------------------------- | +| CVE-2026-109618 | Use-after-free in the upload progress unserializer | Remote memory disclosure and code execution | +| CVE-2026-109619 | Use-after-free in the fatal error backtrace, OPcache type confusion | Code execution | + +CVE-2026-109618 can also leak server memory on its own. PHP's upload progress handler can return freed memory to the client inside a `PHPSESSID` cookie. This memory can contain passwords, session tokens, API keys and TLS private keys from other requests. The handler runs before your application code, so the leak also works if your application never starts a session. + +Both Apache `mod_php` and PHP-FPM are affected. The vulnerable code dates back to PHP 5.4.0, released in 2012. + +PHP states that there is no complete mitigation, and that updating is the only safe choice. + +### How Likely Is an Attack? + +Cloudflare reported the first attacks at 07:43 UTC on 21 October 2026, before PHP released the fixed versions at 14:00 UTC. + +According to Sansec, mass exploitation is less likely than first expected. A PHP2Shell attack needs specific knowledge of the target server and specific conditions on it. Large attack waves, such as after Log4Shell, used a single request that worked against any vulnerable server. Nobody has shown such a request for PHP2Shell. A researcher who tested the public proof-of-concept exploits found that they do not work against a default PHP installation. Most of them need the application to have a local file inclusion bug, which is a severe flaw on its own. + +You do not need to take your shop offline. + +## Which PHP Versions Are Affected + +The affected range is reported as PHP 5.4 up to and including 8.5.11. PHP's own fixes only cover the branches that still receive security support, 8.2 to 8.5. The affected range therefore also covers PHP versions that no longer receive fixes from PHP. + +```{note} +PHP 8.2 is supported by PHP until 31 December 2026. If your shop runs on PHP 8.2, plan an upgrade to a newer version. +``` + +## What Hypernode Did + +- On 21 October 2026, Hypernode performed emergency maintenance. Hypernodes were temporarily taken offline, and a maintenance page was shown while PHP was updated. +- The official PHP fixes were rolled out to all supported PHP versions on the platform. +- Older PHP versions, below 8.2, were patched by Hypernode itself with a patch made by our security partner Freexian. This is part of PHP Extended Support. +- `session.upload_progress.enabled` is disabled in PHP-FPM, which is the part of PHP that handles web requests. + +Hypernode installed the patches for you. You do not need to update PHP yourself, or add the temporary mitigations that Sansec describes for self-managed servers. + +```{note} +A web application firewall (WAF), such as Sansec Shield, cannot protect you against PHP2Shell. The vulnerable code runs inside PHP, before your shop code and before the WAF. Updating PHP is the only fix. +``` + +## How to Check Your PHP Version + +Because older PHP versions received a backported patch, the version number alone does not tell you whether you are patched. Check the build date instead: + +```bash +php -v +``` + +Do this for the PHP version your shop uses. If you are unsure whether your Hypernode is patched, contact support. + +## CVE-2026-115560 + +CVE-2026-115560 is a separate and much narrower issue. It can only be exploited when all of the following are true: + +- `session.serialize_handler` is set to `php_binary` or `php_serialize` in the configuration. +- The application switches it to `php` at runtime with `ini_set()`, before `session_start()`. +- `session.upload_progress.enabled` is still enabled. + +Applications that never change the serialize handler at runtime are not affected through this route. PHP is fixing this issue in its regular release cycle, and recommends setting `session.upload_progress.enabled=0` until then. + +To check whether your code is in the narrow case, search for runtime changes of the handler: + +```bash +grep -rn "serialize_handler" /data/web/public /data/web/magento2/app /data/web/magento2/vendor +``` + +Adjust the path to where your shop lives. If this command returns nothing, your application does not change the handler at runtime. + +## What You Should Do + +1. Check that your shop does not run on a PHP version that no longer gets security fixes, and upgrade if it does. See [Supported PHP Versions and How to Change Them on Hypernode](../../hypernode-platform/php/supported-php-versions-and-how-to-change-them-on-hypernode.md). +1. Check your own code and third-party modules for `ini_set('session.serialize_handler'`, as described above. +1. Scan your shop for malware, because exploitation was reported shortly after the disclosure. See [How to Set Up Sansec eComscan on Hypernode](../../hypernode-platform/tools/how-to-set-up-sansec-ecomscan-on-hypernode.md) for how to run a scan. +1. If you find signs of compromise, reset all credentials and secrets, such as admin accounts, API keys, payment gateway tokens, and database and `env.php` secrets. See [How to Recover a Hacked Magento Shop](how-to-recover-a-hacked-magento-shop.md). + +```{note} +Hypernode does not clean up malware on customer shops. Your developer or a security partner has to do this. +``` + +## Sources + +- [PHP security advisory, 21 October 2026](https://www.php.net/archive/2026.php#2026-10-21-5) +- [PHP 8.4.27 release notes](https://github.com/php/php-src/releases/tag/php-8.4.27) +- [CVE-2026-109618 advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) +- [BleepingComputer on CVE-2026-115560](https://bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability) +- [Security Affairs on CVE-2026-115560](https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html) +- [Sansec on PHP2Shell](https://sansec.io/research/php2shell)