PHP2Shell Explained: 2 Critical PHP RCE Flaws Fixed

On 21 October 2026, the PHP security team shipped emergency patches for PHP2Shell, two critical remote code execution (RCE) flaws tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) under CVSS v4.0 and affect PHP 5.4 through 8.5, the language behind roughly 69% of websites. Attackers need no login and can trigger the bugs with a single crafted multipart/form-data request, making this one of the most severe PHP vulnerabilities in years.

What is PHP2Shell?

PHP2Shell is the name researchers gave to an exploit chain that combines two memory-safety bugs in PHP itself. The flaws were discovered independently by California-based security firm Calif, working with OpenAI, and cloud security company Wiz. Calif reported the first bug on 11 August 2026, and Wiz followed on 24 August. The name comes from a leaked screenshot and demo video showing a working exploit.

The two flaws work like this: when a PHP request fails badly - typically when it runs out of memory - the cleanup routine frees memory that other parts of the worker process still point to. An attacker can manipulate that broken state so the next request runs their own code on the server. This happens before any website code executes, so even perfectly coded applications are exposed.

critical PHP security vulnerabilities have repeatedly shown how difficult memory cleanup can be in long-running web processes.

How the attack works

CVE-2026-109618: RCE via OOM corruption

This flaw, described by PHP as 'RCE via OOM corruption', is reached through form-upload parsing. Tricks such as missing usable lengths, endless part headers, or empty file fields with nested names force PHP to jump out of normal execution and leave request memory in a broken state. On Apache's mod_php, a complete code-execution attack works with default limits before any application code runs.

CVE-2026-109619: RCE via stale global state

The second flaw, 'RCE via stale global state', involves memory belonging to the PHP worker being used after it is freed. PHP confirmed code execution through the fatal-error backtrace path on mod_php, and through the session upload-progress path on both mod_php and PHP-FPM. Every common way of running PHP on a web server is affected: PHP-FPM, mod_php (the most dangerous), php-cgi, FrankenPHP and LiteSpeed.

Researchers confirmed attacks against WordPress, Drupal, Magento, Joomla, MediaWiki, Nextcloud, Roundcube, phpMyAdmin, Laravel, Symfony and WHMCS. Wiz called the findings 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'.

What is confirmed, and what is not

Confirmed

• Two critical flaws in PHP core, not in a plugin or framework.
• Both rated 9.2 out of 10 (CVSS v4.0).
• Emergency patches released on 21 October 2026 at 14:00 UTC.
• Unauthenticated remote code execution validated on mod_php for both flaws, and on PHP-FPM through the session path.
• Exploitation observed in the wild: watchTowr saw attacks in its honeypots after Cloudflare reported early attempts.
• No setting provides a complete fix - only updating closes all paths.

Reported, not confirmed by PHP

• That every listed application is vulnerable: PHP confirmed the attack paths, not each specific application.
• How widespread active attacks are. CISA had not listed the flaws as exploited at the time of writing.
• Exposure estimates: one rough calculation put the number of exposed, possibly vulnerable hosts above 1.3 million.

What to do if you run PHP

Security experts across the industry gave the same advice: 'the only mitigation is patching / upgrading PHP', as PHP developer Gina Peter Banyard put it. Follow these steps:

1. Find every PHP you run. The command-line version can differ from the one your web server uses. Check PHP-FPM and Apache modules separately.
2. Update immediately. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and hosting providers ship their own builds - check their advisories.
3. Do not rely on settings. Workarounds like session.upload_progress.enabled=0 or memory_limit=-1 block only some paths. PHP's advisories say none is complete.
4. Buy time if you cannot patch. Cloudflare enabled firewall rules for all customers, including free plans. Taking an internet-facing PHP site offline is the safest choice until patched.
5. Check for signs of compromise. Look for unexpected PHP files, new admin users, unusual outbound connections and workers restarting without reason.

Why it matters

PHP powers blogs, shops, forums, government portals and most WordPress installations. Because the fix reveals the vulnerable code, attackers can now compare versions and build working exploits rapidly. Sansec warned that mass exploitation of web servers could begin within minutes of the release. Many sites also run end-of-life PHP 7 and PHP 5, which receive only source patches or nothing at all.

The impact was already visible on patch day: several European government websites went offline as a precaution, and Cloudflare's CTO said the company was 'seeing early attacks emerging'. A related concern is the security of certificate authorities and other critical infrastructure, which faced separate issues the same day.

FAQ

What is PHP2Shell?

PHP2Shell is a set of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running PHP 5.4 through 8.5.

Which PHP versions are affected?

All versions from 5.4 through 8.5. Patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source patches exist for end-of-life 7.4, 8.0 and 8.1.

How can I protect my server?

Update PHP immediately. No configuration setting fully blocks the attack. Use temporary mitigations only to bridge the hours until you can patch.

Has PHP2Shell been exploited in the wild?

Yes. Cloudflare reported early exploitation attempts before the patch, and security firm watchTowr observed exploitation in its honeypot network on 21 October 2026.

Does updating WordPress or a plugin fix the flaw?

No. The vulnerability is in PHP itself, below any application code. You must update PHP, not just your CMS or plugins.