On 21 October 2026 the PHP project patched two linked flaws, CVE-2026-109618 and CVE-2026-109619, which security researchers named PHP2Shell. This is a plain-language explainer of the class of problem and where Howdah fits. It describes the attack only by its shape — how many parts and how large — and contains no working exploit.
What happens
When a browser uploads a form, it sends a multipart/form-data request: a body split into many “parts”, each with a small header and some content. PHP parses that body and builds $_POST and $_FILES before any of your application code runs.
As publicly reported, a crafted multipart request makes PHP use a lot of memory while it reads the headers of upload parts. A body well under PHP's default 8 MB post_max_size can still hold hundreds or thousands of tiny, nearly-empty parts. According to the reports, corrupted state from that can lead to remote code execution without the attacker logging in. The official fix ships for PHP 8.2 and newer; older branches get no official patch, and PHP 8.1 and earlier still run a very large share of the web.
Why only a PHP extension can stop it
The damage happens during PHP's own parsing, before your code runs. That rules out the usual places you might add a check:
- A firewall written in PHP (for example via
auto_prepend_file) runs after the upload has already been parsed into$_POST/$_FILES— too late. opcache.preloadruns once at server start, never per request.- A network firewall sees bytes on the wire, not how PHP will interpret them, so it cannot cheaply tell a giant legitimate upload from a part-flood.
- A compiled extension runs inside PHP's upload parser, so it can count parts as PHP reads them and stop the request early. That is what Howdah does.
What Howdah does — and what we verified
Howdah enforces limits on the number of parts and files, the size of names, and a memory budget, refusing a request that crosses them while the body is still being parsed. Those critical limits block by default, even in detect mode.
What we did and did not verify
Our tests reproduce only the harmless structure of such a flood: how many parts and fields, and how large. We did not reproduce the CVE's session.upload_progress header-parsing path, so we do not claim Howdah blocks CVE-2026-109618 on a stock configuration.
What we measured: PHP's own max_input_vars and max_file_uploads already keep the flood shape we built small on a default box. On a box where an admin has raised those caps, the same shape used 127 to 173 MB against a 128 MB limit, and Howdah's default limits refuse it long before that. Howdah's value is strongest on raised-cap servers and on old PHP with no official fix.
The incident details above come from public reports, which we are checking against the official advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp, and php.net); we will correct this page if they differ. You can see Howdah's verdict on a defanged, shape-only version of this flood in the browser demo, and exactly which PHP versions we have tested on the coverage page.
Howdah is open source; the core, the tests and the measurements are on GitHub.