Security
Application Security
What It Is
PHP2Shell refers to two critical vulnerabilities in PHP's core runtime - CVE-2026-109618 and CVE-2026-109619 - both rated CVSS v4.0 9.2 (Critical). Together they allow unauthenticated remote code execution (RCE) on PHP web servers, meaning an attacker doesn't need any credentials to run arbitrary commands on a vulnerable host. PHP2Shell is a pair of high-impact computer vulnerabilities concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution by a potential malicious user to gain remote control of the website host.
The Underlying Bugs
CVE-2026-109618 is RCE via out-of-memory corruption: an out-of-memory error can stop PHP while request data is only partly set up, and cleanup then treats it as valid - particularly during early request handling like multipart parsing into superglobal request/file arrays, where request memory can be reachable but only partially initialized when an allocation fails.
CVE-2026-109619 is RCE via stale global state: global state owned by one request can survive after its memory is freed, because fatal errors skip reset or non-fatal diagnostics repopulate it after cleanup. A later request on the same worker then reads or branches on those stale pointers before normal initialization.
Both stem from PHP's historical use of longjmp() for fatal errors (including out-of-memory) and incomplete cleanup of request-owned or global state that persists across requests on the same worker process. One widely-cited vector is a heap use-after-free in PHP's session upload-progress mechanism.
Discovery and Disclosure Timeline
The vulnerabilities were discovered with help of AI in August 2026, and their existence was publicly announced on 20 October 2026.
PHP had planned to release a patch on October 21 at 14:00 UTC, but information about the vulnerabilities, including their CVE IDs, leaked early - reportedly because a company called Calif accidentally posted a proof-of-concept video demonstrating an exploit chain.
The patches were fast-tracked and released about 24 hours early, and the NSA issued a warning shortly before that.
Amazon Threat Intelligence identified an exploitation attempt dating back to 17 October, four days before public disclosure, and Cloudflare reported signs of early exploitation before the public patch, deploying temporary WAF rules as a stopgap.
Impact and Scope
Because this is a bug in the PHP language runtime itself rather than any one application, exposure is enormous: websites running vulnerable PHP versions are exposed regardless of CMS, including those built on WordPress, Drupal, and Joomla. Qualys' own telemetry assessment framed it as affecting nearly all PHP installations they scanned. Researchers compared its severity to Heartbleed. It's being actively exploited in the wild, as reported by watchTowr.
Practically, successful exploitation hands an attacker shell-level command execution on the web server process - typically manifesting as anomalous child processes spawned directly by PHP worker processes like php-fpm, php-cgi, or apache2 - which can lead to full host compromise, data theft, lateral movement, and persistence.
Prevention / Mitigation
Patch immediately - this is the only full fix: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, matching the branch in use; PHP states no configuration change fully closes the vulnerability.
Interim mitigation (not a full fix) for older/unpatched systems includes disabling the vulnerable feature where possible, e.g. setting session.upload_progress.enabled to 0, and limiting exposure around multipart form/file-upload handling.
Detection: look for anomalous child processes spawned directly from PHP worker processes, unexpected outbound connections from web server processes, and WAF/IDS signatures vendors have published (Qualys QIDs, Snort/Suricata rules referenced by Qualys: 520310, 533086).
Inventory first: identify every PHP instance across your estate (including ones embedded in appliances/CMS platforms), since many orgs don't have full visibility into PHP versions in use.
Apply vendor-provided temporary WAF rules (e.g., Cloudflare's stopgap rules) as a bridge while patching rolls out, not as a substitute for patching.
Elliot