Tech Radar: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Zend Engine OOM Bailout Mechanics, Cross-Request Heap Use-After-Free & Production SRE Remediation Runbook
Tech Radar: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Zend Engine OOM Bailout Mechanics, Cross-Request Heap Use-After-Free & Production SRE Remediation Runbook Answer-First: The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) trigger pre-application remote code execution via Zend Engine bailout longjmp() mechanics and cross-request heap use-after-free in persistent worker pools (PHP-FPM, mod_php, FrankenPHP, LiteSpeed). Production SRE remediation requires immediately deploying patched PHP 8.4.27 or 8.3.36 runtimes, clamping multipart POST payloads, disabling session.upload_progress, and enforcing aggressive worker recycling via pm.max_requests. ...