Two critical unauthenticated remote code execution vulnerabilities in PHP — dubbed PHP2Shell — are being actively exploited in the wild. Patches dropped on October 21, but attackers had a four-day head start: exploitation attempts were detected as early as October 17, after a proof-of-concept tool leaked and broke the coordinated disclosure embargo. If you run PHP anywhere, this is not a “schedule for next maintenance window” situation.
What Is PHP2Shell #
PHP2Shell covers two distinct flaws in the PHP interpreter itself, discovered by Wiz using AI-assisted code analysis:
- CVE-2026-109618 — RCE via out-of-memory (OOM) corruption. When PHP runs out of memory while parsing request data, that data is left partially initialized. Request cleanup then treats it as valid. An attacker can force this with a crafted POST request containing a single ~3.5 MB form field name — no authentication required.
- CVE-2026-109619 — RCE via stale global state. Request-owned memory is freed but a pointer to it survives; a later request on the same worker reuses it. This path requires
session.upload_progress.enabled, which is on by default in most PHP configurations.
Both carry a CVSS v4.0 score of 9.2. Neither requires credentials. On Apache with mod_php, exploitation completes before your application code — or any WAF — gets a chance to run.
Every PHP Version Is Affected #
These are flaws in the PHP engine, not in a specific framework or plugin. Every PHP version from 5.4 onward is affected by at least one of the two CVEs. That means WordPress, Drupal, Joomla, Laravel, and any custom PHP application running on a vulnerable version is exposed.
To put a number on it: PHP runs roughly 77% of websites that use a server-side language. When Wiz disclosed the findings, Fortune called it “the vulnerability that could take down 70% of the internet.” That framing is hyperbolic, but the underlying exposure is real.
Patch Versions #
The PHP security team released fixes on October 21, 2026. Update to one of these versions immediately:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
After patching, verify with php -v. Then restart your PHP workers (PHP-FPM, Apache, or whichever process serves PHP requests) to replace old workers still in memory.
PHP 8.1 and older: php.net will not patch end-of-life branches. If you are on PHP 8.1, 8.0, 7.x, or 5.x, some distributions and managed hosts have shipped backports, but the correct answer is to upgrade to a supported branch now — not eventually.
Docker and Container Users: You Have One More Step #
This is the step most guides skip. Running apt upgrade php on your host machine does nothing for containers that have PHP baked into their image. An image built from php:8.1-fpm or any unpatched tag is still vulnerable, full stop.
What you need to do:
- Update your Dockerfile base image to a patched tag — for example,
FROM php:8.4.27-fpm - Rebuild the image with
docker build --no-cache - Redeploy the container
Any container that was running between October 17 and when you redeploy should be treated as potentially compromised.
If You Cannot Patch Immediately #
Patching is the only complete fix. That said, if you genuinely cannot patch right now, these two php.ini changes block the known attack paths:
; Blocks CVE-2026-109618 (OOM path)
memory_limit = -1
; Blocks CVE-2026-109619 (session upload path)
session.upload_progress.enabled = 0
Set these in your main php.ini and restart PHP workers. A few caveats: memory_limit = -1 removes the per-request memory cap, so pair it with a container or cgroup memory limit that will kill only the affected worker. Do not use ulimit -v as your memory cap — it makes mmap() fail, which is exactly the failure that triggers the vulnerable path for CVE-2026-109618.
These settings buy time. They do not replace the patch.
What Happened to the Disclosure #
The PHP security team had pre-announced an emergency release for October 21 at 14:00 UTC. That embargo broke the day before: a PoC tool named “PHP2Shell” surfaced on October 20, giving attackers an 18-hour window before the official patch — on top of the exploitation attempts Amazon’s Threat Intelligence team had already observed since October 17.
NCSC-NL, the Dutch national cybersecurity center, published its own operational guidance on GitHub — that level of government response signals how seriously the security community is treating this. CISA had not added either CVE to its Known Exploited Vulnerabilities catalog as of publication, but active exploitation is confirmed by Patchstack and Hadrian regardless.
Patch Now #
PHP2Shell joins a short list of vulnerabilities — Log4Shell, Heartbleed, ShellShock — where the blast radius is large enough that waiting is not a reasonable risk posture. Patches are out. Exploitation is active. If you run PHP, you know what to do.