PHP2Shell Vulnerabilities: Risks, Affected Applications and Immediate Security Measures

Introduction

Quick answer:  PHP2Shell is the name given to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a web server through a single crafted request. Both are rated CVSS 9.2. The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible.

If your business runs a website, customer portal, ERP front end, or internal tool built on PHP, this affects you directly. The weakness sits inside the PHP engine itself, so even well written applications are exposed until the runtime is patched. This guide explains what happened, who is at risk, and what to do today.

What Are the PHP2Shell Vulnerabilities?

PHP2Shell refers to a family of memory safety bugs in the core PHP runtime, grouped under two identifiers. Researchers from Wiz, OpenAI and Calif disclosed them together with the PHP security team, and patched releases arrived on 21 October 2026.

• CVE-2026-109618: a remote code execution flaw in how PHP handles out-of-memory errors while it is still setting up request data. Partly initialised data is later treated as valid during cleanup.
• CVE-2026-109619: a remote code execution flaw where PHP keeps request-specific state after the memory behind it has been freed, so a later request on the same worker can reach stale data.

Both carry a CVSS v4.0 score of 9.2 and can be triggered without authentication or user interaction.

How Do the PHP2Shell Vulnerabilities Work?

Both issues come from the way PHP abandons a request when it hits a fatal condition such as exceeding its memory limit. The runtime jumps out of the current operation, and in some code paths it leaves pointers or cache entries behind that were never cleaned up properly.

A follow-up request handled by the same worker can then touch that leftover state. With carefully shaped data, an attacker can turn this into memory disclosure or code execution. Researchers noted that triggering the bug is easier than weaponising it, since the attacker needs the right worker and the right memory layout. Even so, Wiz reported that AI tooling made adapting exploits to different PHP versions and configurations far more practical, which narrows the gap between a published flaw and a working attack.

One detail matters for defenders. The session upload-progress feature processes multipart requests before application code starts, so an endpoint that only prints a short response can still be reached. Application-level login checks do not help here.

Which PHP Versions and Applications Are Affected?

Wiz states that every PHP release from the past decade is affected by at least one of the bugs, reaching back to PHP 5.4. Datadog confirmed that PHP 5 through 8.1 are vulnerable and end-of-life, so they will not receive official fixes.

According to PHP, any installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Wiz demonstrated working attacks against WordPress, Drupal and Joomla, but stressed that these were examples and that even a minimal "Hello World" script on a vulnerable version can be exposed.

What Are the Security Risks of PHP2Shell?

The practical risks for a business include:

• Remote code execution with the privileges of the web worker account, which can lead to webshells, malware, and lateral movement.
• Memory disclosure, which may expose passwords, tokens, API keys, and certificates held by the PHP process.
• Data theft and defacement of any site or application on the affected server.
• Service disruption, because failed exploitation attempts can crash workers.

Huntress reported no confirmed exploitation across its partner base as of 21 October, while other researchers reported attacks starting to appear. Public technical write-ups are now available, so treat every unpatched internet-facing PHP server as a priority.

How to Check Whether Your PHP Environment Is Vulnerable

Start with a full inventory. Run php-v on every server, and check container images, hosting control panels such as cPanel and Plesk, and vendor appliances that bundle php.exe or php-cgi. Also review any ERP, CRM or portal software that quietly depends on PHP.

Compare each version against the fixed releases above. Anything older than 8.2, or on an 8.2 to 8.5 release below the fixed number, needs action. Imperva also offers a preliminary web-based assessment page, although its results may need further analysis to confirm exposure.

How to Fix the PHP2Shell Vulnerabilities

Updating PHP is the only complete remediation.

1. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's patched package.
2. Restart PHP-FPM, Apache or whichever service runs PHP so the new binary is loaded.
3. Patch internet-facing systems first, then internal ones.
4. Confirm the running version after the restart.

PHP's own advisory is available on the official PHP announcements page, and the technical details for each flaw are published in the GitHub security advisories for CVE-2026-109618 and CVE-2026-109619.

What If You Cannot Apply the PHP Security Patch Immediately?

Some environments cannot be upgraded the same day. In that case, reduce exposure while you prepare the update:

• Disable session upload progress by setting session.upload_progress.enabled = 0 in php.ini. Imperva says this removes the trigger for three of the five demonstrated techniques, while Datadog warns that it does not protect you fully. Treat it as a stopgap only.
• Consider turning off OPcache temporarily, after testing for performance impact.
• Place a web application firewall in front of exposed services. Several vendors have shipped virtual patches.
• Apply least privilege to the PHP process so a compromise reaches less.
• Take end-of-life servers off the public internet or restrict access by VPN.

For PHP 7.4, 8.0 and 8.1, the PHP security team has provided minimal source backports for organisations that compile PHP themselves. Many Linux and long-term-support vendors will also ship their own fixes, so check with your provider.

How to Identify Potential Signs of PHP2Shell Exploitation

Exploitation happens below the application layer, so ordinary application logs may show very little. Look for these indicators instead:

• Unusually large multipart form submissions followed by memory-limit errors or repeated HTTP 500 responses
• Unexpectedly large or malformed PHPSESSID values in response headers
• PHP worker processes such as php-fpm, apache2, or httpd launching shells, interpreters, or download tools
• New files in the web root, unfamiliar cron jobs, or new user accounts
• Unexplained worker restarts

If you suspect a compromise, isolate the server, preserve web server and PHP logs, and review for persistence mechanisms. Updating PHP does not remove a webshell that was already planted, so a clean-up and credential rotation should follow any confirmed intrusion.

How Businesses Can Reduce Future PHP Security Risks

Incidents like this one reward teams that already know what they run. A few habits make the next emergency far less stressful:

• Maintain a living inventory of runtimes, frameworks and bundled dependencies.
• Move off unsupported PHP versions on a planned schedule rather than during an incident.
• Automate version checks and patch alerts so your team hears about a critical release quickly.
• Run workloads with minimal privileges and keep secrets out of reach of the web process.
• Add runtime monitoring that flags web processes spawning shells.

This is also where automation pays off. Scheduled inventory scans, automated patch validation and alert routing turn a frantic weekend into a routine change window, which is a core part of any sensible digital transformation roadmap.

Conclusion: Respond to PHP2Shell Before It Becomes a Business Risk

PHP2Shell shows how a flaw in a shared runtime can reach millions of sites at once, and how quickly the gap between disclosure and exploitation is closing. The response is clear: find every PHP install, upgrade to a fixed release, apply temporary controls where you must wait, and watch for suspicious behaviour from PHP processes. Acting this week costs far less than recovering from a breach next month.