PHP2Shell: Critical PHP Vulnerabilities Put Millions of Websites at Risk
Two critical vulnerabilities in PHP — the server-side language behind most of the public web — are being exploited in the wild, and emergency patches are now available. Dubbed PHP2Shell, the flaws let an attacker with no account and no credentials run code on a vulnerable server, potentially taking full control of the machine. The PHP team rushed out fixes on October 21, a day ahead of schedule, after details of the bugs leaked early.
Key Takeaways
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution and is rated 9.2 out of 10 in severity.
- The flaws affect nearly every PHP version back to PHP 5.4 and hid in the code for over a decade before AI-assisted research found them.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating is the only complete fix — then restart your PHP workers.
- Attack attempts began before the patches shipped, so unpatched internet-facing servers should be treated as urgent.
What Are the PHP2Shell PHP Vulnerabilities?
PHP2Shell is the name researchers gave to two related flaws in the PHP runtime itself: CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on the CVSS v4.0 severity scale, and both stem from the same root cause — how PHP reacts when it runs out of memory in the middle of handling a web request.
In the first flaw, an out-of-memory error interrupts PHP before request data is fully built, leaving half-finished internal data behind that PHP later treats as valid. In the second, data belonging to one visitor’s request survives after its memory has been freed, and a later request handled by the same PHP worker process can end up using it. Chained together, the two bugs let an unauthenticated attacker execute arbitrary code on the server — and the second flaw can also leak memory from other requests, potentially exposing passwords, authentication tokens, API keys and certificates.
The bugs sat undetected for more than a decade. Security firms Wiz and Calif found and verified them with help from AI models — OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon — working with the PHP team ahead of disclosure. The confirmed attack path runs through PHP’s session upload progress feature, which has been enabled by default for over ten years. As Datadog’s analysis shows, the attack triggers while PHP is still cleaning up a failed request — before the website’s own code even runs.
Who Is Affected by the PHP2Shell Vulnerabilities?
Almost everyone running PHP. The flaws affect every release back to PHP 5.4, and because they live in the language runtime rather than in any application, a site is exposed even if its own code is perfectly secure. PHP powers roughly three-quarters of websites whose server-side language can be identified, including WordPress, Drupal, Joomla and Magento — Wiz demonstrated working exploits against current WordPress, Drupal and Joomla installations. Shodan counts around 1.9 million internet-exposed hosts running PHP, and the uncomfortable detail is that most of them run old branches: PHP 8.1 and earlier receive no official fix at all.
The risk is highest on servers running Apache’s mod_php, where worker processes persist between requests and a demonstrated exploit fires before any application code runs — bypassing login screens and security plugins entirely. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed setups are affected too. If you follow our daily tech coverage, this is the same pattern as other recent infrastructure scares: the vulnerable component is so widely embedded that the blast radius covers sites that never chose it directly.
Attacks Began Before the Patches Shipped
The disclosure did not go to plan. Details leaked on October 20, forcing the PHP team to move its release up a day. By then, attackers were already probing: Amazon’s MadPot honeypots logged a first exploit attempt on October 17, four days before the fix, and Cloudflare reported attack traffic against its customers on the morning of October 21, deploying emergency firewall rules hours before public disclosure. WatchTowr says it is observing in-the-wild exploitation attempts, and Hadrian reports exploitation at scale, mostly through the session upload progress path.
Governments reacted accordingly. CISA and the UK’s National Cyber Security Centre both issued alerts on October 21 urging organizations to find every PHP system and patch internet-facing ones first. The NCSC went further: where patching isn’t immediately feasible, consider taking the system offline. Some did exactly that — Finnish government services and websites belonging to the Dutch parliament were pulled offline as a precaution, as The Register reported.
Fixed PHP Versions: What to Update To
The PHP team is blunt: updating is the only safe choice. There is no complete workaround. The fixed releases are:
| PHP branch | Fixed version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Update to 8.5.12 or newer |
| 8.4 | 8.4.27 | Update to 8.4.27 or newer |
| 8.3 | 8.3.36 | Update to 8.3.36 or newer |
| 8.2 | 8.2.35 | Update now — 8.2 security support ends December 31, 2026 |
| 8.1 and older | No official release | End of life; source backports exist for 7.4, 8.0 and 8.1, otherwise migrate to a supported branch |
Check the full version number, not just the branch — a site on PHP 8.3.30 is on a supported branch and still exposed until it reaches 8.3.36. After upgrading, restart your PHP workers (Apache, PHP-FPM and other long-running processes), or the old vulnerable code keeps serving requests. Brandefense maintains a running summary of fixed versions and vendor packages if you want to cross-check your platform.
How to Protect Your Site Right Now
- Find every PHP installation — including the ones hiding inside control panels, staging sites and vendor software — and patch internet-facing servers first.
- Update to a fixed version and restart PHP. A WAF can blunt attacks but does not fix the runtime; Cloudflare’s free and paid WAF customers are protected by default, which buys time, not safety.
- If you’re on PHP 8.1 or older, there is no official patch coming. Apply a vendor backport if one exists or move to a supported branch — this is now urgent, not routine maintenance.
- Check for signs of compromise: unusual multipart POST requests, references to PHP_SESSION_UPLOAD_PROGRESS in logs, memory-limit errors, PHP worker crashes, and unexpectedly large PHPSESSID cookies. Because the flaws can leak memory, treat credentials and tokens held by an affected PHP process as potentially exposed.
We covered the week’s other major security and AI stories in yesterday’s roundup — and as always, we’ll update this post if the PHP team ships further guidance.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the researchers’ name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both come from PHP mishandling out-of-memory errors during request processing, and together they allow unauthenticated remote code execution on vulnerable servers.
Which PHP versions are affected by PHP2Shell?
Nearly all of them — every release back to PHP 5.4. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and get no official release, though source backports are available for 7.4, 8.0 and 8.1.
Is my WordPress site affected?
Very likely yes, if its server runs an unpatched PHP version. The flaw is in PHP itself, not WordPress, so WordPress or plugin updates will not fix it — the server’s PHP version must be updated, usually via your hosting provider or control panel.
Can a firewall or disabling upload progress protect me instead of patching?
Only partially. A WAF such as Cloudflare’s can block known attack patterns, and disabling session upload progress closes one confirmed attack path, but neither is a complete fix. The PHP team states that updating is the only safe option.
