Security Alert • Vulnerability Analysis

Active php2shell Exploitation: BitNinja Ships WAF Rule 410053 to Mitigate CVE-2026-109618 & CVE-2026-109619

Published in October 2026 • By the BitNinja Security Team

---

A pair of critical remote code execution (RCE) flaws targeting PHP's core session handling—tracked as CVE-2026-109618 and CVE-2026-109619 , collectively dubbed php2shell —have surfaced and are currently seeing active exploitation in the wild.

To help hosting providers and server operators shield their infrastructure immediately, the BitNinja security research team has rolled out a targeted mitigation: WAF rule 410053 . The rule is now live across both WAF2 and WAFPro engines.

Live Incident Note: Threat actors adapt quickly once an exploit becomes public knowledge. Because the situation around these zero-day vectors is continuously evolving, our security team is monitoring in-the-wild attack telemetry around the clock. We are prepared to iterate on rule 410053 or deploy complementary detection rules as new bypass techniques emerge.

How Rule 410053 Mitigates the Attack

The php2shell chain abuses the way PHP handles the PHP_SESSION_UPLOAD_PROGRESS mechanism when parsing incoming multipart forms. Specifically, the attack delivers crafted multipart requests combining the session upload progress field with injected NUL bytes inside specific form values, triggering an unsafe state that leads to remote code execution.

Rule 410053 inspects incoming multipart requests and immediately drops traffic attempting this malformed sequence. Critically, we have engineered this rule to avoid collateral damage: legitimate file uploads using standard session tracking functionality continue to function normally without false alarms.

Why This Is Especially Dangerous for Hosting Providers

If you operate multi-tenant or shared hosting servers, vulnerabilities of this nature present a distinct headache. Because PHP session tracking is widely enabled at the runtime level, every unpatched, actively supported branch of PHP is exposed until an upstream package update is applied.

In shared environments where hundreds of client websites share system boundaries under heterogeneous configurations, a compromise on a single forgotten vhost can quickly become an incident for the whole machine.

The situation is even more precarious for legacy sites:

• End-of-Life (EOL) Versions: Releases such as PHP 8.1 and earlier will not receive official upstream patches for these CVEs. Continued use of these unmaintained versions is extremely hazardous right now.
• Patching Lag: Coordinating updates across fleet-wide servers, staging environments, and customer web stacks takes time—a luxury threat actors are actively capitalizing on.

A Safety Buffer, Not a Permanent Substitute

Rule 410053 gives your team breathing room. It closes the immediate window of vulnerability while you schedule updates and audit your customers' application health. However, a WAF layer—no matter how robust—should accompany proper patching, not replace it.

Furthermore, because attack payload variations often shift rapidly over the lifespan of an active campaign, BitNinja is continuously observing threat intelligence across our global sensor network. If exploit payloads change shape or new variants appear, our team will fine-tune this rule or deploy companion rules in real time to ensure our fleet stays protected.

Action Items for Server Administrators

To defend your systems against the php2shell campaign, we recommend taking the following actions:

1. Confirm BitNinja Rule Delivery: Verify that WAF2 or WAFPro is running on your servers and that rule 410053 is actively received and enforced.
2. Apply Upstream PHP Patches: Update your PHP runtimes to the latest fixed releases as soon as your package manager or vendor builds become available.
3. Audit End-of-Life Versions: Flag instances running EOL PHP 8.1 or older and establish migration plans to bring them onto modern, supported releases.
4. Harden Upload Progress Settings: If your hosted applications do not specifically rely on PHP's built-in upload progress metering, consider setting session.upload_progress.enabled = Off in your global php.ini as an extra hardening measure.

We’ve Got Your Back Attacks like php2shell move fast, but our engineering and incident response teams are on it. We will continue monitoring the attack landscape closely and refining our defenses as this situation develops. If you notice any suspicious activity on your systems or need help verifying your WAF configuration, reach out to our 24/7 support team anytime.