Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed on 21 October 2026, impacting the PHP interpreter at the Zend Engine level before any user code runs.
The flaws exploit the engine’s emergency exit via longjmp() during out-of-memory conditions and stale pointer reuse after fatal errors or timeouts, particularly when session.upload_progress tracking is active.
Patches were released only for currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12), leaving legacy PHP 5.6 installations without official fixes and especially vulnerable when running under Apache mod_php.
Original vulnerable architecture
The affected production environment uses Docker Compose on AlmaLinux with traffic flowing through Hitch TLS terminator, Varnish 6.0 LTS, and two Apache containers running mpm_prefork + mod_php (PHP 5.6.40 from Remi). Default settings included MaxConnectionsPerChild 1000, memory_limit 512M, and enabled session upload progress tracking, creating ideal conditions for both CVEs.
Layered mitigation strategy
The administrator applied four defensive layers. First, a dedicated zz-cve-2026.ini file disables session.upload_progress.enabled = 0 and sets memory_limit = -1, moving memory control to Docker cgroups while also tightening post_max_size, upload_max_filesize, and input limits.
Second, Docker resource limits cap each Apache container at 4 GB RAM, ensuring the kernel OOM killer terminates runaway processes without invoking PHP destructors. Apache configuration was changed to MaxConnectionsPerChild 1 and LimitRequestBody 33554432 to eliminate reuse of potentially corrupted worker memory.
Third, Varnish VCL rules block requests containing PHP_SESSION_UPLOAD_PROGRESS cookies or URLs and reject oversized POST bodies before they reach PHP backends.
Fourth, synthetic error responses for 403 and 413 status codes force Connection: close to prevent keep-alive drain attacks that could stall Varnish workers.
Testing results and edge cases
Verification confirmed that Varnish correctly returns 403 for malicious cookies on PHP routes while leaving Node.js backends unaffected. Direct Apache tests showed that LimitRequestBody and PHP’s post_max_size checks interact differently depending on whether an index.php handler is present, highlighting the need for defense-in-depth.
The complete set of controls neutralizes both PHP2Shell vectors on the unsupported legacy stack without requiring code changes or downtime.
Related articles
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.
Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket
Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.
Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression
The Node.js development team disclosed ten vulnerabilities across multiple versions of the JavaScript runtime on October 21, 2026. Four of the issues received a High severity rating, with one carrying a remote code execution risk through improper handling of Brotli-compressed data. The flaw tracked as CVE-2026-111497 affects Node.js 26.x, 24.x, and 22.x branches and stems from out-of-bounds memory writes during decompression. Additional High-severity problems involve DNS name resolution truncation when NUL characters are present and hostname verification bypasses in TLS certificate validation. The project also resolved three Medium and three Low severity issues related to certificate validation, snapshot entropy reuse, and file-access permission checks. Updated releases Node.js 26.12.1, 24.22.1, and 22.23.4 incorporate fixes for both the core issues and vulnerabilities in bundled components such as c-ares, OpenSSL, SQLite, and Undici. Users of unsupported older branches are advised to migrate to currently maintained versions.
HPE Discloses 72 Vulnerabilities in AOS-10 and AOS-8 Wireless LAN Operating Systems, 33 Rated Critical
Hewlett Packard Enterprise has published a security advisory detailing 72 vulnerabilities affecting its wireless LAN operating systems AOS-10 and AOS-8. The flaws impact mobility controllers, gateways, access points, and virtual machines running these platforms. Thirty-three of the issues received the highest severity rating of Critical, with eight vulnerabilities scoring the maximum CVSSv3.1 base score of 10.0. Specific examples include a buffer overflow tracked as CVE-2026-79847 in AOS-10, plus command injection and SQL injection flaws in AOS-8 that allow unauthenticated remote code execution. No exploitation of these vulnerabilities has been observed at the time of disclosure. The advisory was released on October 22, 2026, and organizations are urged to apply available patches promptly.