Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed on 21 October 2026, impacting the PHP interpreter at the Zend Engine level before any user code runs.
The flaws exploit the engine’s emergency exit via longjmp() during out-of-memory conditions and stale pointer reuse after fatal errors or timeouts, particularly when session.upload_progress tracking is active.
Patches were released only for currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12), leaving legacy PHP 5.6 installations without official fixes and especially vulnerable when running under Apache mod_php.
Original vulnerable architecture
The affected production environment uses Docker Compose on AlmaLinux with traffic flowing through Hitch TLS terminator, Varnish 6.0 LTS, and two Apache containers running mpm_prefork + mod_php (PHP 5.6.40 from Remi). Default settings included MaxConnectionsPerChild 1000, memory_limit 512M, and enabled session upload progress tracking, creating ideal conditions for both CVEs.
Layered mitigation strategy
The administrator applied four defensive layers. First, a dedicated zz-cve-2026.ini file disables session.upload_progress.enabled = 0 and sets memory_limit = -1, moving memory control to Docker cgroups while also tightening post_max_size, upload_max_filesize, and input limits.
Second, Docker resource limits cap each Apache container at 4 GB RAM, ensuring the kernel OOM killer terminates runaway processes without invoking PHP destructors. Apache configuration was changed to MaxConnectionsPerChild 1 and LimitRequestBody 33554432 to eliminate reuse of potentially corrupted worker memory.
Third, Varnish VCL rules block requests containing PHP_SESSION_UPLOAD_PROGRESS cookies or URLs and reject oversized POST bodies before they reach PHP backends.
Fourth, synthetic error responses for 403 and 413 status codes force Connection: close to prevent keep-alive drain attacks that could stall Varnish workers.
Testing results and edge cases
Verification confirmed that Varnish correctly returns 403 for malicious cookies on PHP routes while leaving Node.js backends unaffected. Direct Apache tests showed that LimitRequestBody and PHP’s post_max_size checks interact differently depending on whether an index.php handler is present, highlighting the need for defense-in-depth.
The complete set of controls neutralizes both PHP2Shell vectors on the unsupported legacy stack without requiring code changes or downtime.
Related articles
Dart and Flutter SDKs Patch Critical TLS Flaw Tied to Compromised eMudhra Certificates
Dart and Flutter teams released updates to block compromised intermediate certificates from the eMudhra certificate authority. The flaw affects applications built for Android, Windows, and Linux that rely on dart:io for HTTPS connections. Stable releases include Dart 3.13.7 and Flutter 3.47.8, while beta channels received Dart 3.14.0-315.3.beta and Flutter 3.50.0-0.2.pre. The root cause traces to insufficient randomness during key generation for eight eMudhra intermediate CAs disclosed in October 2026. Because dart:io uses its own BoringSSL implementation rather than system revocation lists, applications must be rebuilt and redistributed to users. Additional changes improve root certificate handling on Android 14 and later via Conscrypt APEX modules.
Vulnerability Management Evolution: From Manual Scans to Continuous Threat Exposure Management
This final installment of the Vulnerability Management for Beginners series examines how the discipline has transformed over recent years into an essential component of organizational risk management. The article highlights the dramatic increase in disclosed vulnerabilities, now approaching 48,000 per year, and stresses that fewer than one percent pose real-world risk. It details the shift toward automated asset inventory integrated with SIEM, EDR, and CMDB systems, alongside multi-factor prioritization combining CVSS, EPSS, KEV lists, and FSTEC methodologies. New practices such as EASM, automated penetration testing, BAS, and CTEM are presented as extensions of a mature foundational process rather than replacements. The piece also covers regulatory tightening in Russia through FSTEC Order No. 117, mandatory remediation timelines, and the impact of AI on both defense and attack surfaces. It concludes with a practical Monday-morning action list focused on asset counting, threat feed integration, SLA definition, and cross-team coordination between IT and security.
Fortinet Discloses Eight FortiOS Vulnerabilities Including Three Critical Flaws
Fortinet has published security advisories detailing eight vulnerabilities affecting its FortiOS operating system used in UTM appliances. Three of the issues received the highest severity rating of Critical. CVE-2026-126259 allows unauthenticated command execution with super-admin privileges in FGSP combined with configuration synchronization or auto-scale setups via crafted HA packets. CVE-2026-126254 stems from integer truncation in the BGP daemon and can propagate malicious attributes from configured iBGP peers. CVE-2026-126253 enables authentication bypass in the OSPF daemon, permitting unauthenticated LSA injection. The remaining five vulnerabilities were assigned lower severity ratings. Administrators are urged to apply the available patches promptly.
Microsoft Patches Over 1,000 Vulnerabilities in November 2026 Patch Tuesday Release
Microsoft has issued its November 2026 monthly security updates, addressing a total of 1,093 vulnerabilities across Windows, Office, Azure, SQL Server, SharePoint Server, Exchange Server, and Developer Tools. The update also covers a vulnerability in the third-party Tencent RapidJSON library identified as CVE-2026-124586. Among the fixes, 63 vulnerabilities received the highest severity rating of Critical, while 1,029 were rated Important. Privilege escalation issues accounted for the largest share with 535 cases, followed by 296 remote code execution flaws. Several vulnerabilities have already been confirmed as exploited in the wild. The release follows the standard Patch Tuesday schedule on the second Tuesday of the month.