Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed on 21 October 2026, impacting the PHP interpreter at the Zend Engine level before any user code runs.
The flaws exploit the engine’s emergency exit via longjmp() during out-of-memory conditions and stale pointer reuse after fatal errors or timeouts, particularly when session.upload_progress tracking is active.
Patches were released only for currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12), leaving legacy PHP 5.6 installations without official fixes and especially vulnerable when running under Apache mod_php.
Original vulnerable architecture
The affected production environment uses Docker Compose on AlmaLinux with traffic flowing through Hitch TLS terminator, Varnish 6.0 LTS, and two Apache containers running mpm_prefork + mod_php (PHP 5.6.40 from Remi). Default settings included MaxConnectionsPerChild 1000, memory_limit 512M, and enabled session upload progress tracking, creating ideal conditions for both CVEs.
Layered mitigation strategy
The administrator applied four defensive layers. First, a dedicated zz-cve-2026.ini file disables session.upload_progress.enabled = 0 and sets memory_limit = -1, moving memory control to Docker cgroups while also tightening post_max_size, upload_max_filesize, and input limits.
Second, Docker resource limits cap each Apache container at 4 GB RAM, ensuring the kernel OOM killer terminates runaway processes without invoking PHP destructors. Apache configuration was changed to MaxConnectionsPerChild 1 and LimitRequestBody 33554432 to eliminate reuse of potentially corrupted worker memory.
Third, Varnish VCL rules block requests containing PHP_SESSION_UPLOAD_PROGRESS cookies or URLs and reject oversized POST bodies before they reach PHP backends.
Fourth, synthetic error responses for 403 and 413 status codes force Connection: close to prevent keep-alive drain attacks that could stall Varnish workers.
Testing results and edge cases
Verification confirmed that Varnish correctly returns 403 for malicious cookies on PHP routes while leaving Node.js backends unaffected. Direct Apache tests showed that LimitRequestBody and PHP’s post_max_size checks interact differently depending on whether an index.php handler is present, highlighting the need for defense-in-depth.
The complete set of controls neutralizes both PHP2Shell vectors on the unsupported legacy stack without requiring code changes or downtime.
Related articles
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.
Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A detailed technical breakdown reveals how an old HTC U11 Plus running Android 8 or 9 can have its Factory Reset Protection bypassed after a forgotten pattern lock. The method uses the device's own email client and credential storage system to force a new PIN without any PC or external tools. Multiple standard bypass attempts failed due to HTC Sense restrictions, including muscle memory recovery, Google account removal, Find My Device, and bootloader unlocking. The working exploit leverages the Exchange account setup flow to trigger Credential Storage Bypass, which overrides FRP flags by prioritizing certificate requests over setup wizard locks. A combined fingerprint and PIN option then allows creation of a new credential that survives reboot and passes the post-reset Google verification. The technique exploits architectural priority conflicts between the Biometric Framework and FRP enforcement in HTC Sense firmware.