{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-109619",
  "revision": 1,
  "title": "PHP2Shell — Fatal-Error Use-After-Free in PHP",
  "subtitle": "Backtrace use-after-free / OPcache",
  "summary": "After a fatal error, the scripting language (PHP) can keep state that points at freed memory, and a later request treats it as live data, which can lead to RCE without a login. Versions since 5.4 are affected, and attacks began before the patch.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 8.1,
    "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "cvss_vendor": {
    "score": 9.2,
    "version": "4.0",
    "source": "https://sansec.io/research/php2shell",
    "as_of": "2026-11-04"
  },
  "epss": 0.99999,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "exploit_override": {
      "source": "https://sansec.io/research/php2shell",
      "as_of": "2026-11-04",
      "note": "Public proofs of concept do not work against a default PHP installation."
    },
    "attack_complexity": "high",
    "kev_added": "2026-10-26",
    "kev_due": "2026-10-29",
    "prerequisites": "Network access to a PHP web endpoint and specific conditions on the target; public exploits mostly need a local file inclusion bug in the application."
  },
  "aliases": [
    "PHP2Shell"
  ],
  "affected": [
    "PHP 5.4 and later serving web requests",
    "PHP-FPM",
    "mod_php",
    "php-cgi",
    "FrankenPHP",
    "LiteSpeed"
  ],
  "remediation": {
    "patch_available": true,
    "workaround_available": true,
    "fixed_in": [
      "PHP 8.5.12",
      "PHP 8.4.27",
      "PHP 8.3.36",
      "PHP 8.2.35"
    ]
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.",
  "confidence": "medium",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-109619",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "exploitation.exploit_available",
        "exploitation.exploit_override"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "cvss_vendor"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "entries": [
        "PHP2Shell",
        "PHP-FPM",
        "mod_php",
        "php-cgi",
        "FrankenPHP",
        "LiteSpeed"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "entries": [
        "PHP2Shell",
        "PHP 5.4 and later serving web requests",
        "PHP-FPM",
        "mod_php"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers"
    },
    {
      "type": "writeup",
      "url": "https://sansec.io/research/php2shell"
    },
    {
      "type": "vendor_advisory",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    }
  ],
  "published_at": "2026-10-21T14:17:09.823Z",
  "issued_at": "2026-11-04T14:36:49.943Z",
  "tags": [
    "php",
    "php2shell",
    "use-after-free",
    "opcache"
  ]
}