# AlmaLinux patches critical php2shell RCE flaws CVE-2026-109618/109619 across all PHP streams

> **Key takeaway:** Two critical unauthenticated remote code execution vulnerabilities in PHP, collectively dubbed php2shell, have been patched across all supported PHP streams on AlmaLinux 8, 9, and 10, with production packages now available ahead of some upstream RHEL fixes.

**Published:** 2026-10-21T00:00:00+00:00 
**Source:** AlmaLinux Blog 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/almalinux-patches-critical-php2shell-rce-flaws-cve-2026-1096.html 

## Summary
AlmaLinux has released patched PHP packages for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities nicknamed php2shell that allow unauthenticated remote code execution via crafted HTTP requests. Both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP installation serving web requests, including PHP-FPM, mod_php, and php-cgi. The patches are now rolling out to production repositories for AlmaLinux 8, 9, and 10, covering all PHP streams the distribution ships, after community testing accelerated their release.

CVE-2026-109618 exploits out-of-memory corruption during multipart file uploads to achieve RCE before any application code runs, particularly against Apache mod_php with default limits. CVE-2026-109619 leverages stale global state between requests through PHP's session upload progress feature or early warning paths in configuration parsing, with confirmed exploitation against both mod_php and PHP-FPM. AlmaLinux backported fixes to streams where Red Hat had not yet released patches, and administrators can verify patched builds via rpm queries of php-common or php8.4-common.

## Vulnerability mechanisms and attack vectors
- **CVE-2026-109618 (out-of-memory corruption):** PHP's per-request memory abort mechanism jumps out of operations mid-execution, leaving half-initialized memory structures that cleanup code later reads; attackers trigger this with crafted multipart uploads containing excessive headers or empty file fields while staying within normal upload limits.
- **CVE-2026-109619 (stale global state):** Fatal errors including out-of-memory conditions fail to clear global state pointing into request memory, creating use-after-free conditions on the next request handled by the same worker process through session upload progress or early configuration warning paths.
- **Confirmed exploitation paths:** PHP validated full RCE against mod_php with default limits before application code execution for CVE-2026-109618; for CVE-2026-109619, RCE was confirmed through session upload progress against both mod_php and PHP-FPM, with the latter requiring application-dependent failure conditions.
- **AlmaLinux-specific scope:** mod_php is present only on AlmaLinux 8 and only loads under the prefork MPM, representing the highest-risk configuration; AlmaLinux 9 and 10 ship only PHP-FPM, which is the default across all releases.
- **Patch verification:** Administrators confirm patched status with `rpm -q php-common` on AlmaLinux 8/9 or `rpm -q php8.4-common` on AlmaLinux 10, and must restart php-fpm or httpd services after updating.

## Why it matters
The php2shell vulnerabilities represent a severe threat to the vast installed base of PHP-powered web infrastructure running on Enterprise Linux derivatives, with AlmaLinux's rapid backporting and community-tested release providing critical protection ahead of some upstream RHEL streams. For system administrators and hosting providers, the availability of production-ready patches across all supported AlmaLinux versions reduces exposure windows, though the pre-patch circulation of proof-of-concept exploits heightens urgency for immediate deployment. The incident also demonstrates how community-driven distributions can outpace their upstream sources on security-critical fixes when unauthenticated RCE conditions demand accelerated response.