A pair of newly disclosed vulnerabilities in the PHP runtime has triggered an urgent global patching effort after researchers demonstrated that attackers can achieve unauthenticated remote code execution and expose sensitive server memory.
On October 21, 2026, the PHP project released emergency security updates addressing CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities have been rated CVSS 9.2, placing them firmly in the critical category.
The potential impact is enormous. PHP remains one of the foundations of the modern web. W3Techs reported on October 21 that PHP is used by approximately 69.3% of websites whose server-side programming language is known. That does not mean 70% of every website is exploitable, but it demonstrates the scale of the technology potentially exposed when a serious flaw appears in PHP itself.
What Is PHP2Shell?
PHP2Shell refers to two memory-safety vulnerabilities in the core PHP engine.
Unlike a vulnerability in a particular WordPress plugin, website theme or custom application, these flaws exist deeper in the PHP runtime itself.
CVE-2026-109618 involves unsafe handling of internal request data during out-of-memory conditions. Under certain circumstances, PHP can attempt to process partially initialized or corrupted information.
CVE-2026-109619 involves internal request state remaining accessible after the memory supporting it has already been freed, potentially allowing later requests to interact with stale data.
Researchers demonstrated that these conditions can be turned into memory corruption and ultimately remote code execution.
Why Is PHP2Shell So Dangerous?
The most concerning aspect is that exploitation may occur before normal application code executes.
An attacker may not need an account, authentication credentials or a vulnerability in the website application itself.
Wiz researchers demonstrated pre-authentication remote code execution against deployments of WordPress, Drupal and Joomla. Importantly, the CMS platforms themselves were not the underlying problem; the vulnerable component was PHP.
Researchers also demonstrated memory disclosure capable of exposing sensitive information held inside PHP worker processes, potentially including passwords, API keys and authentication tokens.
This makes PHP2Shell particularly serious for organizations running internet-facing PHP applications.
Who Is Affected?
The PHP project says installations serving web requests should be considered at risk, including environments using:
- PHP-FPM
- Apache with mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
PHP considers mod_php deployments particularly high risk, because researchers demonstrated that an unauthenticated request could trigger exploitation before application code runs.
Wiz reports that at least one of the vulnerabilities affects PHP releases going back to PHP 5.4, illustrating how long the underlying memory-management conditions existed before practical exploitation was demonstrated.
Is PHP2Shell Being Exploited?
Unfortunately, defenders should no longer treat this as a theoretical risk.
Amazon Threat Intelligence reported detecting a PHP2Shell exploitation attempt in its MadPot honeypot environment on October 17, 2026 — four days before public disclosure.
Following disclosure and publication of proof-of-concept material on October 21, AWS observed further activity and reported that PHP2Shell was being broadly exploited against its sensors.
This dramatically reduces the safe response window for organizations operating vulnerable internet-facing servers.
Which PHP Versions Fix PHP2Shell?
The PHP project released patched versions on October 21:
PHP 8.5 → 8.5.12
PHP 8.4 → 8.4.27
PHP 8.3 → 8.3.36
PHP 8.2 → 8.2.35
Administrators should upgrade immediately.
PHP 8.1 and older versions are no longer receiving normal security updates directly from the PHP project, although some operating-system and long-term-support vendors may provide backported fixes. PHP also published limited source backports for PHP 7.4, 8.0 and 8.1 because of the severity of the issue.
What Should Organizations Do Now?
The priority is straightforward: patch first and investigate immediately afterwards.
The PHP security team states that there is no complete configuration-only mitigation. Updating to a fixed version is the only complete remediation.
Security teams should also review server and application logs for suspicious activity, investigate unusual process execution or unexpected file modifications, and consider whether compromise may have occurred before October 21.
AWS recommends beginning retrospective investigations from at least October 17, based on the earliest exploitation activity it observed.
Web application firewalls may provide additional protection while patches are being deployed, but they should be treated as defence in depth rather than a substitute for upgrading. Cloudflare, for example, has deployed protections while still explicitly advising customers to patch their PHP environments.
PHP2Shell Is Also an AI Security Story
There is another reason PHP2Shell deserves attention.
Researchers said frontier AI models materially assisted the discovery, exploitation development, testing and patch validation process. A vulnerability class that had existed for more than a decade became much more practical to investigate once AI could help researchers iterate across complicated memory layouts and application environments.
That has implications far beyond PHP.
AI can help defenders discover vulnerabilities earlier, but it can also shorten the time attackers need to understand patches and develop working exploits.
The traditional assumption that organizations have days or weeks after disclosure to patch a critical vulnerability is becoming increasingly dangerous.
PHP2Shell demonstrates why vulnerability management must become faster, more continuous and more intelligence-driven.
For organizations running PHP, however, the immediate message is much simpler:
Identify your PHP systems. Patch them now. Then investigate whether attackers got there first.
Have knowledge, experience, or a powerful idea you want to turn into a book? Get your book published with DevOM Publishing:
https://www.devompublishing.com/
If your business needs cybersecurity services, AI security guidance, cloud security review, or protection against modern cyber threats, visit DevOM Consulting:
https://devomconsulting.com/
