PHP2Shell: Two Critical PHP RCEs Being Exploited — Patch Now

Two critical unauthenticated remote code execution vulnerabilities in the PHP interpreter, collectively dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, are being actively exploited in the wild, with exploitation attempts detected as early as October 17, 2026, four days before the PHP security team released patches on October 21, 2026. Discovered by Wiz using AI-assisted code analysis, both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5.4 onward, exposing WordPress, Drupal, Joomla, Laravel and custom PHP applications; PHP runs roughly 77% of websites that use a server-side language. The PHP security team shipped fixes in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and php.net will not patch end-of-life branches including PHP 8.1 and older, so administrators on those versions must upgrade to a supported branch.

Two critical unauthenticated remote code execution vulnerabilities in PHP — dubbed PHP2Shell — are being actively exploited in the wild. Patches dropped on October 21, but attackers had a four-day head start: exploitation attempts were detected as early as October 17, after a proof-of-concept tool leaked and broke the coordinated disclosure embargo. If you run PHP anywhere, this is not a “schedule for next maintenance window” situation. What Is PHP2Shell PHP2Shell covers two distinct flaws in the PHP interpreter itself, discovered by Wiz using AI-assisted code analysis https://www.wiz.io/blog/php2shell-php-rce : - CVE-2026-109618 — RCE via out-of-memory OOM corruption. When PHP runs out of memory while parsing request data, that data is left partially initialized. Request cleanup then treats it as valid. An attacker can force this with a crafted POST request containing a single ~3.5 MB form field name — no authentication required. - CVE-2026-109619 — RCE via stale global state. Request-owned memory is freed but a pointer to it survives; a later request on the same worker reuses it. This path requires session.upload progress.enabled , which is on by default in most PHP configurations. Both carry a CVSS v4.0 score of 9.2. Neither requires credentials. On Apache with mod php, exploitation completes before your application code — or any WAF — gets a chance to run. Every PHP Version Is Affected These are flaws in the PHP engine, not in a specific framework or plugin. Every PHP version from 5.4 onward is affected by at least one of the two CVEs. That means WordPress, Drupal, Joomla, Laravel, and any custom PHP application running on a vulnerable version is exposed. To put a number on it: PHP runs roughly 77% of websites that use a server-side language. When Wiz disclosed the findings, Fortune called it “the vulnerability that could take down 70% of the internet.” https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/ That framing is hyperbolic, but the underlying exposure is real. Patch Versions The PHP security team released fixes on October 21, 2026 https://www.php.net/ChangeLog-8.php . Update to one of these versions immediately: - PHP 8.2.35 - PHP 8.3.36 - PHP 8.4.27 - PHP 8.5.12 After patching, verify with php -v . Then restart your PHP workers PHP-FPM, Apache, or whichever process serves PHP requests to replace old workers still in memory. PHP 8.1 and older: php.net will not patch end-of-life branches. If you are on PHP 8.1, 8.0, 7.x, or 5.x, some distributions and managed hosts have shipped backports, but the correct answer is to upgrade to a supported branch now — not eventually. Docker and Container Users: You Have One More Step This is the step most guides skip. Running apt upgrade php on your host machine does nothing for containers that have PHP baked into their image. An image built from php:8.1-fpm or any unpatched tag is still vulnerable, full stop. What you need to do: 1. Update your Dockerfile base image to a patched tag — for example, FROM php:8.4.27-fpm 2. Rebuild the image with docker build --no-cache 3. Redeploy the container Any container that was running between October 17 and when you redeploy should be treated as potentially compromised. If You Cannot Patch Immediately Patching is the only complete fix. That said, if you genuinely cannot patch right now, these two php.ini changes block the known attack paths: ; Blocks CVE-2026-109618 OOM path memory limit = -1 ; Blocks CVE-2026-109619 session upload path session.upload progress.enabled = 0 Set these in your main php.ini and restart PHP workers. A few caveats: memory limit = -1 removes the per-request memory cap, so pair it with a container or cgroup memory limit that will kill only the affected worker. Do not use ulimit -v as your memory cap — it makes mmap fail, which is exactly the failure that triggers the vulnerable path for CVE-2026-109618. These settings buy time. They do not replace the patch. What Happened to the Disclosure The PHP security team had pre-announced an emergency release for October 21 at 14:00 UTC. That embargo broke the day before: a PoC tool named “PHP2Shell” surfaced on October 20, giving attackers an 18-hour window before the official patch — on top of the exploitation attempts Amazon’s Threat Intelligence team had already observed since October 17 https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html . NCSC-NL, the Dutch national cybersecurity center, published its own operational guidance on GitHub https://github.com/NCSC-NL/php2shell — that level of government response signals how seriously the security community is treating this. CISA had not added either CVE to its Known Exploited Vulnerabilities catalog as of publication, but active exploitation is confirmed by Patchstack and Hadrian regardless. Patch Now PHP2Shell joins a short list of vulnerabilities — Log4Shell, Heartbleed, ShellShock — where the blast radius is large enough that waiting is not a reasonable risk posture. Patches are out. Exploitation is active. If you run PHP, you know what to do.