PHP2Shell: The Request That Left Its Memory Behind

On 21 October 2026 the PHP project shipped an emergency release for two critical bugs in the language runtime itself. Together they are being called PHP2Shell. CISA told operators to patch now. The numbered flaws are CVE-2026-109618 and CVE-2026-109619. The PHP Foundation says the score that matters is 9.2, and that an early rumor of 10.0 was wrong.

This note is the shape of the failure, why a Remade-with-Rust service does not inherit it, and why the mata.network cloud is outside that path. The same day's other notes are the Node.js runtime release, the GitLab compiler patch, and the Cloudflare edge incident.

How PHP2Shell showed up

The coordinated disclosure was supposed to land on 22 October. On 20 October the two CVE numbers began circulating with a wrong clock time and that wrong score of 10.0. The PHP Foundation says technical detail did not leak with those numbers. The project moved the release forward to 21 October, about 13:40 UTC, so distributors could still hand people a package. The advisory index is on php.net.

What the runtime got wrong

Both flaws live in memory handling and error handling, the part of PHP that nearly every request touches. CVE-2026-109618 is an out-of-memory path: a request can be interrupted while internal data is only partly initialized, and later cleanup can treat that unfinished data as real. CVE-2026-109619 is stale state: a fatal error can leave a worker holding a pointer into memory that belonged to a finished request, and a later request on that same worker can use it. The PHP security team considers the risk highest on Apache with mod_php, where a request can reach the bug before application code runs. The same class of failure was also confirmed on PHP-FPM. PHP-CGI, FrankenPHP, and LiteSpeed are in the affected set because they serve web requests through PHP.

That is a property of the interpreter, not of one badly written plugin. Updating a theme or a package does not replace the PHP binary underneath it. WordPress, Drupal, and a long list of appliances are in scope when the PHP they embed is old.

Who has to patch

Install 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If the host is PHP 8.1 or older, the PHP project is not shipping those lines itself. Ask the distribution for a backport, or move to a fixed release. Where that cannot happen today, take the public PHP system offline until it can. A firewall rule can reduce noise. It is not the patch. CISA said it had not observed exploitation when it published. Cloudflare said it had already seen attack traffic and that customers still have to update PHP. Both sentences can be true. The action is the same.

Why a Rust rebuild is a different shape

Remade with Rust exists so a product does not borrow a C interpreter as the thing that runs every request. The program thesis is The Importance of Remade With Rust. The human version is why Digital Freedom needs Rust.

The class of bug

PHP2Shell is use of memory the language no longer owns: unfinished objects treated as live, and a freed request's state read by the next one. Safe Rust refuses that pattern at compile time. A value cannot be used after it is dropped. A half-built object is not a valid object another request can see. That does not mean a Rust program cannot have a logic bug, a bad parser, or an unsafe block that reintroduces the old world. It means the default path does not keep a pool of workers whose last request is still sitting in global fields.

What we ship instead

The web tier on this stack is Rust, compiled into a binary the operator can name. There is no mod_php, no PHP-FPM pool, and no extension ABI that has to stay compatible with thirty years of C modules. Memory allocators in the catalog, such as rusty_alloc, are themselves Rust. The foundation argument is rebuilding the foundation of the internet.

How the MATA cloud stays off this path

mata.network is a mesh and a home computer, described in MATA.NETWORK in the wild. Its services are Rust. A PHP2Shell request has nothing to land on, because there is no PHP worker in that cloud. The household products sit in the same family. dldeploy.com puts ESP32 devices on the LAN, as in dldeploy in the wild. ragconverter.com turns documents into local retrieval chunks, as in ragconverter in the wild. Neither is a PHP content system. House reporting on the rebuild is futureweb.news.

The house does not run that worker

Protection here is absence of the runtime, plus a language that does not share one request's guts with the next. It is not a claim that a firewall in front of an old PHP host is enough, and it is not a claim that Rust has ended software defects. The map is Vision.

What to do if you still have the old runtime

Inventory every place PHP is hiding, including appliances that never say PHP on the brochure. Move internet-facing ones to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or isolate them. Then decide whether the next version of that system should still be PHP. The sibling notes are Node.js, GitLab, and Cloudflare.