PHP2Shell: The Biggest Web Threat in Decades

On the morning of October 21, 2026, the cybersecurity community faced what may be the most significant PHP vulnerability since Log4Shell. Two remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), dubbed "PHP2Shell" by independent researchers, received a CVSS score of 9.2 out of 10 — and, according to some assessments, a perfect 10.0 — and can affect all versions of PHP from 5.4 onward, which represents approximately 69.3% of websites whose server-side language is known, according to W3Techs data. The official patch was scheduled for 14:00 UTC that same day.

What happened

On the night of October 20, CVE identifiers and preliminary information about the two flaws circulated on Hacker News and social media. The PHP Foundation, on the same day, published a notice that it would release patches on October 21 at 14:00 UTC, with the caveat that the update could be released earlier if technical details became public or if evidence of exploitation in the wild was confirmed.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution without authentication. CERT-EU issued advisory 2026-018, naming both CVEs and classifying them as exploitable without credentials. The information was initially held under embargo until October 22, but the premature exposure accelerated the schedule.

Why the name PHP2Shell?

The "PHP2Shell" name was coined through independent reports from security researchers, including work by researcher LCFR and Calif.io, with an exploit chain demonstration shared by Kirill Firsov. The name derives from the ability of the exploit to obtain a shell on the vulnerable server, allowing the attacker to execute arbitrary commands — the same type of access that typically results from the most successful web server compromise.

Public reports suggest that CVE-2026-109618 involves a use-after-free bug in PHP's variable deserialization mechanism. The vulnerable code resides in the `session.upload_progress` handler, a component enabled by default on all PHP installations, which means that the victim application does not need to enable any special configuration to be exposed.

Researcher Qi Deng's technical analysis, published on the public repository `ikow/php2shell-poc`, details three distinct exploit chains:

- Chain A: Session injection via multipart form + LFI → RCE. It exploits the fact that `MULTIPART_EVENT_FORMDATA` accepts PHPSESSID from the POST body, ignoring `use_only_cookies`, and stores the raw filename in the session without validation. - Chain B: Use-after-free in `var_destroy` → RCE. A `unserialize()` payload with 2,000+ entries overflows the `VAR_ENTRIES_MAX` limit, moving objects to the dtor list and triggering `__destruct` without `BG(serialize_lock)`. - Chain C: Handler mismatch → `__destruct` → RCE. Servers with directories configured with different `session.serialize_handler` between requests can suffer handler mismatch.

All three chains verified on PHP 8.2.34 and 8.5.x in ASAN tests.

Which versions are affected?

The official list of patched versions would be released with the patch itself, but researcher Kevin Beaumont has already reported the expected versions:

- PHP 8.5.x → 8.5.12 - PHP 8.4.x → 8.4.27 - PHP 8.3.x → 8.3.36 - PHP 8.2.x → 8.2.35

What will not be patched: all PHP versions from 5.x to 8.1.x are end-of-life and will not receive fixes. This is a particular problem because many legacy infrastructures — especially government systems, hospitals, and shared hosting providers — still run PHP 7.4 or 5.6.

PHP core developer Gina Peter Banyard made it clear: "the only mitigation is patching / upgrading PHP." Release manager Joe Ferguson confirmed that `ini` settings do not solve the problem: "ini settings won't save you".

The potential impact

With more than 1.3 million internet-exposed hosts estimated by researcher Silas Cutler, the scope is comparable to Apache Log4j in 2021. Platforms such as WordPress, Drupal, Joomla, Laravel, and Magento run on PHP and would be directly in the crosshairs. The problem is further compounded by the fact that, according to the PHP Foundation, there is no partial mitigation configuration — the only reliable solution is to upgrade.

Cloudflare, which operates as a CDN for millions of PHP sites, has already deployed provisional WAF rules. CTO Dane Knecht confirmed the company is "seeing early attacks emerging" and updating mitigations as new vectors appear.

What to expect in the coming hours

According to Sansec, mass exploitation is expected to start within 15 minutes of the patch release — a pattern already observed in vulnerabilities such as Log4Shell and SpoolerForever. CISA has a history of including PHP vulnerabilities in its Known Exploited Vulnerabilities catalog: two previous PHP flaws were included after being used in ransomware campaigns.

The question: in an ecosystem where nearly 70% of websites run PHP and where half of the affected versions will not receive a fix, how many servers will go down in the next 48 hours?

Sources: The Verge, WIRED, Tenable

✓ Independent sources cross-checked and verified before publishing