PHP2Shell flaws put nearly every PHP web server at risk
The PHP2Shell vulnerabilities allow an attacker without an account to execute code through the PHP runtime, the software engine that processes PHP pages on a web server. PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security advisory says installing an updated runtime is the only complete protection.
The two flaws are CVE-2026-109618 and CVE-2026-109619. Each received a 9.2 score under CVSS v4.0, a standard scale for rating vulnerability severity. Researchers at Wiz, Calif and OpenAI reported the problems, which affect nearly every PHP release going back to PHP 5.4. Because the defects are inside PHP rather than a website's application code, even a basic page with no complex application logic can be exposed.
According to the advisory, the affected ways of serving PHP include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php, which runs PHP inside the Apache web server, presents the highest documented risk. Researchers demonstrated that one unauthenticated request could trigger an exploit before the website's own code began running. Updating WordPress, Laravel or another application does not repair the PHP engine underneath it.
PHP-FPM, which runs PHP work in separate processes, behaves differently because a worker closes when a request fails early during setup. PHP's analysis indicates that PHP-FPM is susceptible to one flaw, although no complete exploit for that route had been demonstrated. The other flaw was shown to achieve remote code execution, meaning commands can be run from another system, through both mod_php and PHP-FPM. Its PHP-FPM route depends on an operation performed by the running application.
The impact is not limited to taking control of a process. The researchers also demonstrated reading live memory from PHP workers against applications they did not control. That memory can contain passwords, authentication tokens, API keys and certificates associated with other requests. This technique does not require the attacker to obtain code execution first and does not depend on a weakness in the application installed above PHP.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch in use. They must then restart Apache, PHP-FPM and any other long-running PHP workers so that the patched code is loaded. PHP 8.1 and older are no longer supported by the PHP project, although its security team published source backports, meaning fixes adapted for older code, for PHP 7.4, 8.0 and 8.1. PHP 8.2 is scheduled to reach end of life on December 31, 2026.
Linux distributions and long-term-support suppliers received patches in advance. Their packages may therefore contain the repair while retaining an older-looking PHP version number. Debian advises checking the package changelog for the relevant CVE identifier instead of relying only on the displayed version.
Temporary configuration changes address only parts of the attack surface. For CVE-2026-109618, the advisory recommends setting memory_limit=-1 so applications cannot change it, keeping post_max_size low and limiting request sizes at the web server or proxy. PHP warns against treating RLIMIT_AS or RLIMIT_DATA as replacements because they can activate the same vulnerable route. For CVE-2026-109619, administrators can set session.upload_progress.enabled=0 and restart every worker. PHP 8.5 systems should also set fatal_error_backtraces=0. Disabling session upload progress blocks confirmed session-related routes but not every possible variant, and it does nothing for CVE-2026-109618.
The update introduces a hard memory limit. If that limit is reached, PHP ends the process without running shutdown handlers, which are tasks normally performed as a request closes. Administrators should therefore review memory_limit and post_max_size against their applications' legitimate requirements after patching. For possible earlier compromise, the researchers recommend looking for unusual multipart requests, which are commonly used for file and form uploads, followed by memory-limit errors or repeated HTTP 500 server errors. Other warning signs include unexpectedly large PHPSESSID response cookies and unexplained PHP worker restarts.
Attack traffic has already been observed, but no specific server compromise had been confirmed at the time of the latest update. Cloudflare reported early attacks and later said attackers changed their payloads to evade firewall rules that it enabled by default at 03:02 UTC on October 21. The company described those rules as a temporary measure and urged patching. watchTowr initially reported no exploitation in the wild at 11:26 UTC, then said at 14:19 UTC that it was seeing active attempts against both vulnerabilities. Neither CVE was in CISA's Known Exploited Vulnerabilities catalog at that earlier point.
Some services were taken offline as a precaution rather than because of a confirmed intrusion. BambooHR suspended service in the United States, Canada and Ireland, warning that payroll would be interrupted without giving a restoration time. Dutch services including MijnOverheid, DigiD, the lower house of parliament's website, the national cyber-security center and several education systems also went offline, according to NOS. The center said it had not observed abuse but advised organizations to patch.
The disclosure schedule was disrupted before the fixes became available. A Hacker News post on October 20 named both CVEs and claimed they were due for disclosure on October 22. PHP issued advance notice that evening and moved publication to around its scheduled release time of 14:00 UTC on October 21. PHP rates both flaws at 9.2, not the 10.0 score claimed in the leak. The PHP Foundation later said Calif mistakenly published a video of a working proof of concept at about 20:00 UTC on October 20. Chainguard then released built images containing the patch at 07:41 UTC on October 21, roughly six hours before the official fix, allowing the changes to be studied while other users were still waiting.
The vulnerable code had existed for more than a decade. The PHP Foundation said a core developer noticed signs of the out-of-memory problem behind CVE-2026-109618 during a 2024 external audit, but no concrete route to code execution had then been established. Proposed repairs risked compatibility problems, denial-of-service conditions or changes for third-party extensions, and work stalled as the small team struggled to reach a decision. The Foundation described this as a structural failure and said it has since changed its security decision-making while adding staff and tools.
Reports submitted in 2026 by Calif, OpenAI and Wiz established a working exploit and raised the flaw's priority. The researchers said artificial intelligence models helped one researcher complete in about a week work they believed would otherwise have required a team for months.