PHP2Shell: Two Critical Core PHP Flaws Enable Unauthenticated RCE Across the Web

Summary

PHP has shipped emergency patches for two critical vulnerabilities in its core runtime, together named PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619 , both carry a CVSS v4.0 score of 9.2 and allow an attacker without an account to execute code on a web server. Because the flaws sit inside PHP itself rather than in any application, a site can be exposed even when its own code is secure, including a minimal application running on an affected PHP version.

The vulnerabilities affect nearly every PHP release since version 5.4, which underpins an estimated 70 percent of websites, including software such as WordPress, Drupal, Joomla, Moodle, Nextcloud, Laravel, Symfony and MediaWiki. Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 , and multiple monitoring firms have since reported active exploitation attempts against unpatched servers.

Background

PHP2Shell, the name reflects the outcome the researchers demonstrated: turning a core PHP request into a remote shell. Researchers first reported one of the two underlying bugs to PHP on August 11, 2026, shared a proof of concept privately on August 14, and had it confirmed by August 15, with coordinated disclosure originally planned for October 22.

PHP moved its release up to October 21, by which point a third party had already built and published container images containing the patch, giving anyone who found them an early look at the fix. The researchers say AI tooling helped convert a decade-old class of memory bugs into working exploits far faster than manual research alone, with one researcher reportedly doing in about a week what would otherwise have taken a team months.

Vulnerability Details

CVE ID	CVSS Score	Affected Products	Vulnerability Type
CVE-2026-109618	9.2 (Critical)	PHP 5.4 through versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12	Out-of-memory (OOM) corruption enabling unauthenticated code execution as the PHP web worker
CVE-2026-109619	9.2 (Critical)	PHP 5.4 through versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12	Stale global state surviving across requests, triggering a use-after-free that enables memory disclosure or code execution

What Was Demonstrated

Researchers built working exploits against representative applications rather than against PHP in the abstract. Demonstration of pre-authentication remote code execution against WordPress, Drupal and Joomla running their latest container images at the time of testing was performed and separately application-agnostic memory disclosure that does not require any of those applications to be present was demonstrated. For CVE-2026-109619 specifically, PHP-FPM (FastCGI Process Manager) remote code execution was confirmed only through application-level code paths, while PHP's own analysis found FPM susceptible to CVE-2026-109618 without a complete exploit chain having been shown for that configuration.

Beyond code execution, both flaws allow an attacker to read live memory from a PHP worker process, including passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself, without first achieving code execution. Because this memory disclosure path does not require running attacker code, it is harder to detect with tooling that focuses only on malicious execution.

Impact

Several organizations took services offline as a precaution rather than in response to a confirmed breach. BambooHR took its service offline across the United States, Canada and Ireland, warned customers that payroll processing would be interrupted, and had not announced a restoration time as of the most recent update. In the Netherlands, government and education systems including MijnOverheid, DigiD, the lower house of parliament's website and the national cyber-security center's own site went offline; the center said it had not seen the flaw abused but urged organizations to patch regardless.

Cloudflare reported observing attack traffic against its customers following the leak and said attackers adjusted their payloads to evade the firewall rules it had deployed as a stopgap. As of the most recent reporting, no source has confirmed a successful server compromise tied to PHP2Shell, though multiple firms describe exploitation attempts as active and expect that to change quickly.

Why This Happened

The PHP Foundation has acknowledged that the underlying out-of-memory issue was flagged internally during a 2024 external audit, but a concrete path to code execution was not found at that time. According to the Foundation, competing proposed fixes each risked breaking compatibility, introducing denial-of-service conditions, or forcing changes on third-party extensions, and the team was unable to agree on an approach, stalling remediation for months. The Foundation has characterized this delay as a structural failure in its own decision-making process rather than a technical oversight, and says it has since changed how security decisions are made and added staff and tooling to catch comparable issues earlier.

The 2026 research effort that ultimately produced a working exploit relied heavily on AI assistance, with researchers noting that it traced the bug's lineage back to PHP research published in 2004. The firm also noted that current AI models do not reliably rediscover obscure, decades-old technical primitives on their own, meaning the researchers' domain knowledge of PHP's history remained a necessary input alongside the tooling.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1059	Command and Scripting Interpreter	Execution
T1505.003	Server Software Component: Web Shell	Persistence
T1212	Exploitation for Credential Access	Credential Access

Mitigation

1. 1. Update the PHP runtime on every server: install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on branch, then restart Apache, PHP-FPM and any long-running PHP workers. Updating an application such as WordPress or Laravel does not update the underlying PHP runtime; that must come from the server package, host or container image.
2. 2. Use the official source backports on unsupported branches: PHP 7.4, 8.0 and 8.1 no longer receive vendor updates, so the PHP security team has published source-level backports for those branches to support users building from source.
3. 3. If you cannot update immediately for CVE-2026-109618, set memory_limit = -1: this prevents application code from overriding the limit, but shifts memory-exhaustion handling to the operating system, so pair it with Linux cgroup v2 memory.max (or an equivalent OS mechanism) to contain resource consumption, and keep post_max_size low with request-size limits enforced at the web server or proxy. Do not substitute RLIMIT_AS or RLIMIT_DATA, as PHP's advisory warns these can trigger the same vulnerable path.
4. 4. If you cannot update immediately for CVE-2026-109619, set session.upload_progress.enabled = 0: and restart every worker; on PHP 8.5 also set fatal_error_backtraces = 0. This blocks the confirmed session-based attack path but not every variant, and the PHP team is explicit that no configuration change fully mitigates this flaw short of updating. PHP core developer Gina Peter Banyard stated before the release that patching is the only real mitigation, adding, "I sadly know too much."
5. 5. Apply post-patch hardening: limit max_input_nesting_level to the depth the application requires and test complex forms, and consider setting expose_php = 0 to reduce version disclosure, noting this is optional hardening and does not itself remediate PHP2Shell.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.