{"slug": "php2shell-two-critical-php-rces-being-exploited-patch-now", "title": "PHP2Shell: Two Critical PHP RCEs Being Exploited — Patch Now", "summary": "Two critical unauthenticated remote code execution vulnerabilities in the PHP interpreter, collectively dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, are being actively exploited in the wild, with exploitation attempts detected as early as October 17, 2026, four days before the PHP security team released patches on October 21, 2026. Discovered by Wiz using AI-assisted code analysis, both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5.4 onward, exposing WordPress, Drupal, Joomla, Laravel and custom PHP applications; PHP runs roughly 77% of websites that use a server-side language. The PHP security team shipped fixes in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and php.net will not patch end-of-life branches including PHP 8.1 and older, so administrators on those versions must upgrade to a supported branch.", "body_md": "Two critical unauthenticated remote code execution vulnerabilities in PHP — dubbed PHP2Shell — are being actively exploited in the wild. Patches dropped on October 21, but attackers had a four-day head start: exploitation attempts were detected as early as October 17, after a proof-of-concept tool leaked and broke the coordinated disclosure embargo. If you run PHP anywhere, this is not a “schedule for next maintenance window” situation.\n\n## What Is PHP2Shell\n\nPHP2Shell covers two distinct flaws in the PHP interpreter itself, [discovered by Wiz using AI-assisted code analysis](https://www.wiz.io/blog/php2shell-php-rce):\n\n- **CVE-2026-109618** — RCE via out-of-memory (OOM) corruption. When PHP runs out of memory while parsing request data, that data is left partially initialized. Request cleanup then treats it as valid. An attacker can force this with a crafted POST request containing a single ~3.5 MB form field name — no authentication required.\n- **CVE-2026-109619** — RCE via stale global state. Request-owned memory is freed but a pointer to it survives; a later request on the same worker reuses it. This path requires`session.upload_progress.enabled` , which is on by default in most PHP configurations.\n\nBoth carry a CVSS v4.0 score of 9.2. Neither requires credentials. On Apache with mod_php, exploitation completes before your application code — or any WAF — gets a chance to run.\n\n## Every PHP Version Is Affected\n\nThese are flaws in the PHP engine, not in a specific framework or plugin. Every PHP version from 5.4 onward is affected by at least one of the two CVEs. That means WordPress, Drupal, Joomla, Laravel, and any custom PHP application running on a vulnerable version is exposed.\n\nTo put a number on it: PHP runs roughly 77% of websites that use a server-side language. When Wiz disclosed the findings, Fortune called it [“the vulnerability that could take down 70% of the internet.”](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) That framing is hyperbolic, but the underlying exposure is real.\n\n## Patch Versions\n\nThe [PHP security team released fixes on October 21, 2026](https://www.php.net/ChangeLog-8.php). Update to one of these versions immediately:\n\n- PHP 8.2.35\n- PHP 8.3.36\n- PHP 8.4.27\n- PHP 8.5.12\n\nAfter patching, verify with `php -v`. Then restart your PHP workers (PHP-FPM, Apache, or whichever process serves PHP requests) to replace old workers still in memory.\n\n**PHP 8.1 and older:** php.net will not patch end-of-life branches. If you are on PHP 8.1, 8.0, 7.x, or 5.x, some distributions and managed hosts have shipped backports, but the correct answer is to upgrade to a supported branch now — not eventually.\n\n## Docker and Container Users: You Have One More Step\n\nThis is the step most guides skip. Running `apt upgrade php` on your host machine does nothing for containers that have PHP baked into their image. An image built from `php:8.1-fpm` or any unpatched tag is still vulnerable, full stop.\n\nWhat you need to do:\n\n1. Update your Dockerfile base image to a patched tag — for example, `FROM php:8.4.27-fpm`\n2. Rebuild the image with `docker build --no-cache`\n3. Redeploy the container\n\nAny container that was running between October 17 and when you redeploy should be treated as potentially compromised.\n\n## If You Cannot Patch Immediately\n\nPatching is the only complete fix. That said, if you genuinely cannot patch right now, these two php.ini changes block the known attack paths:\n\n```\n; Blocks CVE-2026-109618 (OOM path)\nmemory_limit = -1\n\n; Blocks CVE-2026-109619 (session upload path)\nsession.upload_progress.enabled = 0\n```\n\nSet these in your main php.ini and restart PHP workers. A few caveats: `memory_limit = -1` removes the per-request memory cap, so pair it with a container or cgroup memory limit that will kill only the affected worker. Do not use `ulimit -v` as your memory cap — it makes `mmap()` fail, which is exactly the failure that triggers the vulnerable path for CVE-2026-109618.\n\nThese settings buy time. They do not replace the patch.\n\n## What Happened to the Disclosure\n\nThe PHP security team had pre-announced an emergency release for October 21 at 14:00 UTC. That embargo broke the day before: a PoC tool named “PHP2Shell” surfaced on October 20, giving attackers an 18-hour window before the official patch — on top of the exploitation attempts [Amazon’s Threat Intelligence team had already observed since October 17](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html).\n\nNCSC-NL, the Dutch national cybersecurity center, [published its own operational guidance on GitHub](https://github.com/NCSC-NL/php2shell) — that level of government response signals how seriously the security community is treating this. CISA had not added either CVE to its Known Exploited Vulnerabilities catalog as of publication, but active exploitation is confirmed by Patchstack and Hadrian regardless.\n\n## Patch Now\n\nPHP2Shell joins a short list of vulnerabilities — Log4Shell, Heartbleed, ShellShock — where the blast radius is large enough that waiting is not a reasonable risk posture. Patches are out. Exploitation is active. If you run PHP, you know what to do.", "url": "https://wpnews.pro/news/php2shell-two-critical-php-rces-being-exploited-patch-now", "canonical_source": "https://byteiota.com/php2shell-cve-2026-109618-patch-now/", "published_at": "2026-10-22 18:18:54+00:00", "updated_at": "2026-10-22 18:41:59.644323+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["PHP", "Wiz", "CVE-2026-109618", "CVE-2026-109619", "WordPress", "Drupal", "Laravel", "Fortune"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/php2shell-two-critical-php-rces-being-exploited-patch-now", "markdown": "https://wpnews.pro/news/php2shell-two-critical-php-rces-being-exploited-patch-now.md", "text": "https://wpnews.pro/news/php2shell-two-critical-php-rces-being-exploited-patch-now.txt", "jsonld": "https://wpnews.pro/news/php2shell-two-critical-php-rces-being-exploited-patch-now.jsonld"}}