PHP2Shell: Bunny Shield blocks critical RCE vulnerabilities pending patches

Two critical vulnerabilities in PHP's core, fixed via an emergency release on 21 October 2026, prompted Bunny.net to activate dedicated WAF rules on its CDN. For those managing PHP hosting, the news affects two fronts: the patch to install and, in the meantime, edge-level protection for servers not yet updated.

The two flaws

CVE-2026-109618 is an RCE via memory corruption during out-of-memory error handling: PHP can interrupt a request while internal data is only partially initialised, and the cleanup phase can then use that invalid data. The advisory describes multiple trigger methods via multipart requests, including those without declared length and with field names nested deeply.

CVE-2026-109619 is an RCE via uncleared global state: request state can remain accessible after memory is freed, and a subsequent request handled by the same worker may encounter that residual state before PHP resets it. PHP confirms one path via session upload-progress, plus other paths linked to fatal errors and early initialisation.

Both are classified CVSS v4.0 9.2. According to watchTowr, PHP released the patches on 21 October 2026 and watchTowr observed active exploitation in the wild via its honeypot network. Details of both flaws leaked online the day before the planned disclosure, forcing the PHP security team to bring forward the release.

Patched versions

PHP Branch	Patched version
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

PHP 8.2 receives security fixes only until 31 December 2026: those still on that branch should also plan for migration to 8.3 or later.

Bunny Shield WAF rules

Managed rule	What it blocks	Vulnerability covered
WAF-PHP-UPLOAD-PROGRESS-POC	Multipart requests with the PHP_SESSION_UPLOAD_PROGRESS default field	CVE-2026-109619, confirmed session upload-progress path
WAF-PHP-MULTIPART-NESTING	Multipart field names nested 20 levels or deeper	CVE-2026-109618, memory pressure from nested input

The rules only block if the customer's Shield Zone is in blocking mode; in log-only mode matching requests are not stopped. Bunny.net also notes that a custom upload-progress field is not intercepted by the rule for the default field, and that users with forms containing deeply nested fields should review security logs for false positives.

What to do immediately

Those managing PHP servers must audit every PHP origin in use, including those behind CMS platforms and custom applications, install the patched versions as soon as possible, and verify the actual version after updating. Those unable to patch immediately can disable session.upload_progress.enabled, a measure that reduces exposure but does not replace the patch.

Bunny Shield is a Bunny.net product, not Prime Software.