PHP2Shell is the nickname for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Together, they let an attacker run code on a server without logging in. PHP’s own team rated both flaws 9.2 out of 10 on the CVSS v4.0 scale. AWS first detected exploitation attempts on October 17, 2026, a full four days before the public patch arrived. If your stack runs PHP, the PHP2Shell vulnerability deserves attention today, not next sprint.
What Is the PHP2Shell Vulnerability?
PHP2Shell refers to a pair of flaws inside PHP’s core runtime, not a third-party package. CVE-2026-109618 causes a memory handling error during hash table updates. The second flaw, CVE-2026-109619, is a use-after-free bug that lets a worker reuse stale data from an earlier request. PHP’s security team confirmed both reach full remote code execution on default configurations. Neither flaw requires a login, an API key, or any special permission. Datadog Security Labs put it plainly: “PHP processes the malicious request before any application code runs.” No application-level defense gets the chance to react.
This kind of flaw is exactly why patch discipline sits at the center of modern DevSecOps practice. Teams that treat security patching as a routine, not an emergency, catch flaws like PHP2Shell faster. PHP still runs a large share of the production web, from WordPress sites to custom enterprise backends. A flaw this severe, in a runtime this common, reaches a broad slice of live infrastructure.
How the PHP2Shell Exploit Works
The two bugs share a root cause: PHP mishandles memory during routine operations. CVE-2026-109618 lives in PHP’s hash table code, inside a function called _zend_hash_str_add_or_update_i(). That function updates internal counters before it allocates a key. A failed allocation then leaves PHP’s internal state incomplete. PHP’s cleanup routine treats that incomplete state as valid data, and memory exhaustion follows. Any PHP script can trigger the vulnerable code path, even one that only prints a response.
CVE-2026-109619 works differently but reaches the same outcome. A PHP worker process can reuse stale state left over from a previous request. Confirmed exploitation paths include fatal-error backtraces on PHP 8.5 and file upload processing across multiple server setups. Attackers trigger this bug through a single unauthenticated HTTP POST request. Affected server types include Apache’s mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
Which PHP Versions Are Vulnerable
Every supported PHP branch released before October 21, 2026, contains these flaws. PHP’s official security advisory lists the fixed versions as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP also published minimal source backports for the older 7.4, 8.0, and 8.1 branches. Versions older than that receive no official fixes. Distributions like AlmaLinux backport fixes without changing the version number PHP reports. That means checking your vendor’s own advisory matters more than checking php -v alone.
Is PHP2Shell Being Exploited in the Wild
Yes, and the exploitation started before PHP even released a patch. AWS flagged suspicious requests tied to this flaw as early as October 17, 2026. Datadog confirmed multiple reports of active exploitation once PHP’s advisory went public on October 21. Researchers also observed broad, untargeted scanning across the internet for vulnerable servers. The Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026. Federal civilian agencies had until October 29 to patch under that directive.
Wiz Research discovered the underlying bugs months earlier using AI-assisted fuzzing techniques. The first flaw surfaced on August 19, 2026, and reached PHP’s team by August 24. A leak exposed the details online on October 20, a day before the planned joint release. That leak pushed PHP to ship fixes faster than originally planned.
How to Patch and Mitigate PHP2Shell
Patching remains the only complete fix for either vulnerability. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your branch. Teams on PHP 8.1 or older should apply the published source backports immediately. If an immediate upgrade isn’t possible, PHP recommends several stopgap settings. Disable session.upload_progress.enabled and, on PHP 8.5, disable fatal_error_backtraces as well. Set memory_limit to unlimited and cap memory at the container level instead. None of these settings close the hole completely, so treat them as a bridge, not a destination.
This episode reminds us that enterprise development tools need the same patch cadence as any production service. A dependency scanner that flags outdated PHP builds buys your team valuable lead time. Pair that scanner with alerts tied to CISA’s KEV catalog for the fastest response. The next PHP2Shell-style flaw will not wait for your next sprint planning meeting.
Key Takeaways
- PHP2Shell covers two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0.
- Neither flaw requires authentication; a single HTTP request can trigger remote code execution.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026.
- Exploitation began October 17, 2026, four days before the public patch shipped.
- CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026.
Frequently Asked Questions About PHP2Shell
What Does PHP2Shell Actually Do?
PHP2Shell lets an attacker run arbitrary code on a PHP server without any login. It exploits two separate memory bugs inside PHP’s own core runtime.
Which PHP Versions Fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 all contain the fix. Older branches need the published source backports instead.
Is PHP2Shell Being Actively Exploited?
Yes. AWS detected exploitation attempts starting October 17, 2026, before PHP shipped its patch. CISA later added both CVEs to its Known Exploited Vulnerabilities catalog.
Does PHP2Shell Require Authentication to Exploit?
No. A single unauthenticated HTTP request triggers both vulnerabilities. That is what makes PHP2Shell so dangerous for public-facing servers.
Can I Mitigate PHP2Shell Without Upgrading PHP?
Partially. Disabling session.upload_progress.enabled and capping memory limits reduce exposure. Only a full upgrade removes the vulnerability completely.
Does PHP2Shell Affect Frameworks Like Laravel or WordPress?
Any application running an unpatched PHP version is at risk, regardless of framework. Laravel, WordPress, and custom applications all run on the same vulnerable runtime.
Final Thoughts
PHP2Shell shows how a single memory bug in a widely used runtime creates outsized risk. Patching here isn’t optional busywork. It closes the only real path to remote code execution. If your infrastructure runs PHP anywhere, check your version today. Upgrade to the fixed release, or apply the backport if your branch predates support. Treat the stopgap mitigations as a short bridge, not a long-term plan. Exploitation is already active, so time matters more than perfection here.
Photo by Ilya Pavlov: Unsplash
A seasoned technology executive with a proven record of developing and executing innovative strategies to scale high-growth SaaS platforms and enterprise solutions. As a hands-on CTO and systems architect, he combines technical excellence with visionary leadership to drive organizational success.
