PHP2Shell: When an Entire Language's Runtime Fails

The PHP security team released emergency patches on October 21, 2026 for two remote code execution (RCE) vulnerabilities that affect virtually every active PHP server on the internet. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell" by the community, reside directly in the PHP runtime engine — not in any framework or CMS — meaning even a three-line "Hello World" PHP page can be compromised remotely without authentication, even when the application's own code is completely secure.

The discovery was made collaboratively by security researchers at Wiz, Calif, and OpenAI. The severity was rated 9.2 on the CVSS v4.0 scale. The reach is so broad that the US National Security Agency recommended that sites unable to patch immediately take their servers offline, while the UK's National Cyber Security Centre (NCSC) issued a similar alert to British organizations.

What happened

It all started with a leak on the night of October 20. A post on Hacker News announced that two PHP RCE vulnerabilities, rated CVSS 10.0, would be disclosed on October 22. The post provided no technical evidence, limiting itself to a source cited as "trust me, bro." The security team at watchTowr confirmed the information was real, that the findings were under embargo, and that they could not reveal details before the scheduled date. PHP published its own notice that same night, moving the release date up to October 21 — one day earlier than planned — with the caveat that it might release even sooner should evidence of active exploitation appear.

The confirmation came at 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released with the patches. PHP core developer Gina Peter Banyard warned that no partial mitigation would completely block the attacks, and that updating was the only permanent defense.

The exploitation mechanics

Both vulnerabilities belong to the Use-After-Free class (CWE-416), but exploit different mechanisms within PHP.

CVE-2026-109618 is caused by memory corruption when the interpreter encounters an out-of-memory (OOM) condition. When memory is exhausted, PHP aborts the request using a longjmp() function. If this happens while the request's internal data is only partially initialized, the shutdown procedure treats invalid data as valid. In Apache mod_php configurations, this is particularly dangerous: the shutdown procedure is called unconditionally even if request startup fails, and automatic parsing of the request body can exhaust the memory limit before any application code begins running. A demonstrated exploit works with default memory and input limits.

CVE-2026-109619 involves stale global state in memory. The vulnerability allows an attacker to read the memory of a PHP worker process — including passwords, authentication tokens, API keys, and certificates from previous requests — without first achieving remote code execution. The confirmed exploitation path goes through session.upload_progress.enabled, which is enabled by default and can access session handling before PHP finishes configuring a request.

Both bugs have been present in the code since PHP 5.4 — over a decade of code. The class of vulnerability that encompasses them (Use-After-Free) was identified as a concern decades ago, but no action was taken at the time because no one believed an exploit would be feasible in the context of PHP.

Internet-wide impact

The scale of the problem is difficult to overstate. According to W3Techs data, PHP is used by 69.3% of websites whose server-side language is known — meaning approximately 70% of the entire public internet is exposed. Researchers at Mallory analyzed over 7 million PHP websites and found that 46.1% of sites disclosing their PHP version are running an EOL (end-of-life) release. Security researcher Silas Cutler estimated that over 1.3 million internet-exposed hosts are potentially vulnerable; a Shodan search by Henk Poley found over 1.9 million hosts.

The consequences were immediate. Even before the patches were released, Cloudflare updated its WAF rulesets to mitigate attacks and was already observing active exploitation attempts. The CERT-EU issued containment recommendations, and organizations across multiple countries took drastic measures:

- Dutch government (Overheid.nl): website taken offline - Finnish government: all public services taken offline - French Interior Ministry: all websites deactivated - Danish school communication platform: offline - Vienna and Freiburg universities (Germany): services unavailable - Wikimedia Foundation: support services shut down - 4chan and Something Awful: sites offline - Japan: Final Fantasy XIV, Umamusume: Pretty Derby, and various e-commerce sites taken offline

The NSA reinforced that, if updating is not immediately possible, the only safe alternative is to take the site offline entirely.

What to do

Updating the runtime to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only complete solution. But the picture is complicated for administrators with older versions: PHP 8.1 and older versions no longer receive updates from the PHP project (8.1 reached end of life in November 2025, and 8.2 reaches EOL on December 31, 2026).

The PHP team published source backports for PHP 7.4, 8.0, and 8.1 for those who need to compile from source or lack access to an LTS vendor. Linux distributions that ship older PHP packages may have backported the fixes — organizations using distribution packages should check their vendor advisories.

Temporary mitigation measures shared by the PHP team are partial and do not protect against all attack vectors:

- For CVE-2026-109618: set `memory_limit=-1` via php_admin_value in the FPM pool or Apache configuration (cannot be overridden by the app), keep `post_max_size` low (8M for unnecessary uploads, 32M when uploads are needed), and use container/cgroup limits with a policy that kills only the affected worker. Do not use `RLIMIT_AS` or `RLIMIT_DATA` as a substitute — PHP warns these can trigger the same vulnerable path. - For CVE-2026-109619: disable `session.upload_progress.enabled=0` and restart all workers. On PHP 8.5, also set `fatal_error_backtraces=0`. However, disabling upload progress may break legitimate file upload functionality that depends on progress tracking.

Corelight released open-source detection rules (Zeek and Suricata) for defensive teams that cannot apply patches immediately.

What this means

PHP2Shell is one of the most broadly impactful language-engine vulnerabilities ever discovered — comparable in scale to Heartbleed, but instead of affecting a cryptographic protocol used by specific servers, it strikes the programming language that runs your neighbor's blog, the local online store, the government portal, and the healthcare system. The fact that the bug class (Use-After-Free) was known for decades but not considered exploitable in PHP shows that the security of interpreted runtimes requires ongoing attention, not just point-in-time checks.

The discovery by AI researchers (Wiz, OpenAI, Calif) also raises an open question: as AI models and autonomous agents become tools for vulnerability discovery, where does legitimate security analysis end and exploit generation begin? PHP2Shell itself was found by researchers using AI as part of their process — and the same AI that discovered the flaw is now helping mitigate it.

Sources: BleepingComputer, The Hacker News, CyberSecureFox

✓ Independent sources cross-checked and verified before publishing