Critical "PHP2Shell" Vulnerabilities Deliver Unauthenticated Remote Code Execution Across the Web

PHP maintainers have rushed out urgent security patches to neutralize a pair of critical-severity vulnerabilities collectively dubbed "PHP2Shell." The severe flaws expose millions of web applications and servers globally to unauthenticated remote code execution (RCE), triggering a scramble across the cybersecurity industry as active exploitation attempts materialize in the wild.

The vulnerabilities are tracked as CVE-2026-109618, covering an out-of-memory (OOM) corruption flaw, and CVE-2026-109619, addressing a stale global state issue. Both security defects carry a severe CVSS score of 9.2. According to security advisories, remote code execution has been definitively confirmed on Apache setups utilizing mod_php.

The PHP Foundation emphasized the deeply embedded nature of the flaws in a public statement regarding the patches. Both issues reside within core segments of PHP that virtually every incoming web request interacts with—specifically, memory management and error handling. It is this central position within the architecture of the programming language that made the vulnerabilities both exceptionally serious and notoriously difficult to resolve.

Official patches addressing both CVE-2026-109618 and CVE-2026-109619 were bundled into PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Additionally, minimal source backports were made available for older iterations, including PHP 7.4, PHP 8.0, and PHP 8.1.

However, the release of these critical fixes came amid a chaotic backdrop. Before the official patches could be widely deployed, proof-of-concept (PoC) exploits detailing how to leverage the two security defects began circulating online, accelerating the threat timeline.

Preemptive attack surface management firm WatchTowr reported that its sensors detected the first in-the-wild exploitation attempts targeting the flaws around the exact time the patches landed, though successful compromises had not been observed at that initial stage. Even so, industry analysts warned that this window of safety would be short-lived. Jake Knott, head of threat intelligence at WatchTowr, noted that while nobody had successfully breached systems up to that point, they did not expect that defensive advantage to last for long.

Several other cybersecurity organizations reported observing exploitation attempts even before the official patches were finalized and released to the public. Hadrian issued an early warning noting that PHP2Shell was being actively exploited in the wild at scale, observing that the majority of incoming attacks abused PHP’s session upload-progress path. The firm also predicted that additional exploit paths would emerge both before and after the fixes officially shipped.

Additional early indicators of compromise were flagged across the security community. Patchstack and Cloudflare observed suspicious exploitation attempts earlier in the day, while Vega detected threat actors leveraging a public proof-of-concept in the wild to probe vulnerable installations.

According to PHP maintainers, the threat scope is remarkably broad. All PHP installations responsible for handling web requests are potentially at risk of exploitation. This expansive footprint includes widely used server configurations such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

For system administrators and organizations where immediate patching is not technically feasible, the PHP Foundation advised that alternative defensive measures can be implemented. However, the Foundation cautioned that these workarounds only reduce exposure to specific attack paths rather than making an installation fully safe.

The PHP2Shell flaws impact nearly every PHP release dating back to version 5.4. Beyond enabling unauthenticated remote code execution, the vulnerabilities can also be exploited by malicious actors to read sensitive process memory. This exposed memory frequently contains confidential data, including administrative credentials, API keys, and other critical secrets.

Shahak Shalev, global head of scam and AI research at Malwarebytes, described the scenario as a goldmine for hackers. Shalev noted that threat actors could hijack legitimate websites to leverage their established reputations for malicious activities such as phishing or serving malware from a trusted channel, noting that the opportunities for exploitation are practically endless.

Frontier AI Uncovers PHP2Shell

The discovery of the vulnerabilities represents a landmark moment in software security, driven by an intersection of advanced technology and human research. Wiz, working in collaboration with OpenAI and security firm Calif, initially discovered the vulnerabilities in August. The participating organizations maintained a coordinated, confidential containment strategy while patches were meticulously developed and distributed across the ecosystem.

Wiz noted that these findings rank among the most severe vulnerabilities ever discovered in PHP, and arguably in the history of software. The underlying architectural flaws had quietly persisted within the codebase for decades, but demonstrating their actual exploitability required an exceptionally complex chain of steps sitting at the absolute edge of what human researchers could practically achieve on their own.

Calif explained that an initial OOM flaw in PHP was originally discovered back in 2020, and subsequently rediscovered during a routine PHP security audit in 2024. Because explicit exploitation could not be proven at the time, the issue was left unpatched. It was only through the application of frontier artificial intelligence models that the underlying OOM weakness could be comprehensively analyzed, mapped, and ultimately transformed into a functional remote code execution vector.

The sophisticated OOM-to-RCE chain was independently reported to maintainers by Calif and OpenAI on August 11. Additional related attack vectors were subsequently reported by OpenAI and Wiz. The incoming reports from Calif, OpenAI, and Wiz made the comprehensive impact of the out-of-memory problem unmistakably clear. From August 11 onward, resolving the defect became the absolute top priority for every member of the PHP Foundation team dedicated to security engineering.

According to a technical deep-dive published by Wiz, CVE-2026-109618 and CVE-2026-109619 group together four distinct memory-safety issues in PHP, though they do not encompass every possible variant. Wiz stated that both tracked and likely untracked variants of the vulnerability continue to exist.

Because the security defects reside directly within the core engine of PHP, they impact an estimated 70% of all websites globally, completely independent of the content management system powering them. Wiz emphasized that PHP serves as the foundational programming language behind a vast portion of the modern web, powering major platforms like WordPress, Drupal, and MediaWiki, the software that runs Wikipedia. Consequently, a fundamental flaw in its core engine affects websites across the entire digital ecosystem, even if the individual application code running on those sites is entirely secure.

The PHP Foundation also noted that the integration of artificial intelligence into vulnerability research has helped surface a noticeably higher volume of PHP vulnerabilities than in previous periods, resulting in 15 new CVEs published since July 1.

Early Leak, Early Warning

The coordinated disclosure of the PHP2Shell flaws was originally scheduled for October 22. However, sensitive details leaked online prematurely on October 20, forcing the PHP Foundation to alter its timeline and push out the emergency patches one day ahead of schedule.

Alongside the accelerated patch release, the Foundation published a pre-announcement warning emphasizing that the critical bugs required immediate, urgent attention. Multiple cybersecurity firms issued parallel warnings, alerting clients that widespread exploitation could begin immediately following the leak.

The premature disclosure was catalyzed when a video demonstrating a working proof-of-concept was mistakenly published ahead of the coordinated timeline. The leaked video revealed additional technical details concerning the two weaknesses, which significantly accelerated the independent development of various functional exploits by malicious actors.

Complications compounded when mitigation advice prepared by the PHP Foundation for critical infrastructure organizations appeared to leak as well. Just six hours prior to the official coordinated release, security firm Chainguard published pre-built container images containing the security fix it had received in advance.

The PHP Foundation expressed frustration over the incident, noting that any attacker could study the fix in binary form while every other ordinary PHP user was still waiting for the official release, thereby disregarding weeks of careful collaborative work toward a controlled, synchronized disclosure.

Despite the chaotic rollout, collaborative mitigation efforts blunted the initial wave of abuse. As part of the coordinated response, Cloudflare deployed targeted protections against the PHP2Shell vulnerabilities nine hours before the public disclosure went live.

Reflecting on the industry-wide scramble, SimSpace co-founder and CTO Lee Rossey noted that the emergency PHP security update demonstrates how rapidly organizations can be forced to respond when severe vulnerabilities enter the public domain. Rossey stressed that before a patch is even released, security teams should already maintain clear visibility over where PHP instances are running, know who possesses the authority to authorize urgent changes, and have established procedures in place to confirm whether an update was successfully applied. Furthermore, organizations must retain the forensic capability to check whether malicious actors managed to compromise those systems before the defensive fix was put in place.