PHP2Shell: Critical PHP RCE Flaws Are Under Attack, Patch Now

Two critical PHP flaws dubbed PHP2Shell allow unauthenticated remote code execution, and attacks have already begun. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

TheTechLane cover reading "PHP2Shell: Critical PHP RCE Flaws, Patch Now" beside artwork of a cracked server stack with red warning lights

Two critical bugs in PHP itself, nicknamed "PHP2Shell," can let an unauthenticated attacker run code on a web server, and attackers started probing for them before the patches even shipped. The PHP project released fixes on October 21, and every site running PHP on the web needs to update now.

Here's what you need to know:

  • The flaws are CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state). Both are rated CVSS v4.0 9.2.

  • Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says "there are no complete mitigations, updating is the only safe choice."

  • Apache with mod_php is the highest-risk setup. A single unauthenticated request can trigger the attack before any app code runs.

  • Amazon spotted an exploitation attempt on October 17, four days before public disclosure.

  • On October 23, PHP flagged a third, low-risk RCE vector (CVE-2026-115560) tied to session upload progress.

Timeline of the PHP2Shell vulnerabilities from a 2024 audit finding to the October 21, 2026 PHP security release and exploitation attempts

How PHP2Shell unfolded, from a 2024 audit to attacks in the wild.

What Happened

On October 20, the PHP security team gave advance notice of a critical release. A day later it shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the official security advisory on php.net. The advisory says every PHP install serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The first bug, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), lives in out-of-memory handling. If a request hits memory_limit at exactly the wrong moment, PHP can leave half-initialized data behind and later treat it as valid. CERT-EU says this can happen while PHP is parsing a form-based file upload.

The second, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), is a use-after-free. A fatal error can leave internal state pointing at memory from a previous request, and the next request on the same worker may use it.

The PHP Foundation's behind-the-scenes post is unusually candid. A Foundation-contracted developer first spotted signs of the OOM problem in 2024, during work on the Quarkslab audit. The fix then "stall[ed] and restart[ed] repeatedly over months," which the Foundation calls "a structural failure." Researcher Ryan A at Calif reported an unconditional RCE with the same root cause on August 11, 2026. OpenAI and Wiz then reported more attack vectors.

Disclosure didn't go to plan. The CVE IDs leaked online on October 20 with a wrong CVSS score of 10.0, so PHP pulled the release forward a day. Calif mistakenly published a proof-of-concept video, which was then copied around. And according to the Foundation, Chainguard broke the embargo more than six hours early by shipping patched images.

The leak had consequences. Amazon Threat Intelligence says it logged a PHP2Shell attempt against its MadPot honeypots on October 17, and that the bug is "now seeing broad exploitation attempts in the wild." SecurityWeek also reported that exploitation started days before the patches.

Why It Matters

PHP still powers a huge share of the web, from WordPress blogs to online stores, banks and government services. A bug in the engine itself, rather than in a plugin, means the usual "keep your CMS updated" advice isn't enough.

Working exploits are real, but they're not trivial yet. VulnCheck says "hundreds of proof-of-concept repos have flooded GitHub," but only a very small number are legitimate. Its own weaponized exploit works on PHP 8.4.10 to 8.4.26 and 8.5.10 to 8.5.11 under mod_php with default settings and display_errors=off, including default WordPress Docker installs.

There's an AI angle too. The Foundation says AI-assisted research has flooded its inbox: 15 CVEs published since July 1, plus more than 100 invalid, duplicate or unreproducible reports. Attackers have the same tools. As VulnCheck puts it, once the leak hit, "ten thousand LLMs were immediately pointed at PHP source code."

What It Means for Developers

Six-step PHP2Shell response checklist: update PHP, restart workers, rebuild containers, harden php ini, hunt for attacks, leave PHP 8 1 and older

What to do now: patch first, then harden and hunt.

  • Update first. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distro's patched package, then restart every worker.

  • Check your Docker base images. Rebuild containers pinned to older php: tags.

  • PHP 8.1 or older? The PHP project no longer ships updates for these. It has published minimal source backports for 7.4, 8.0 and 8.1, but the real fix is moving to a supported branch.

  • Can't patch today? PHP's interim steps reduce exposure but don't make you safe. Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not ini_set() or .user.ini), consider memory_limit=-1 via php_admin_value, and lower post_max_size. On PHP 8.5, set fatal_error_backtraces=0.

  • Hunt for attacks. Amazon suggests looking for POST requests containing PHP_SESSION_UPLOAD_PROGRESS in form uploads, and checking servers for unexpected processes or file changes.

If AI-driven attacks on web apps sound familiar, we covered how one hacker's AI agents broke into 100+ sites earlier this week.

What's Next

PHP says it will publish a full advisory for CVE-2026-115560, the session upload progress issue, with the next regular bugfix release. Until then, it recommends keeping session.upload_progress.enabled=0. The bug needs an unusual setup: an app has to switch session.serialize_handler to php at runtime with ini_set().

PHP 8.6.0 RC4, out the same day, includes the fixes. The final release candidate, RC5, is planned for November 5, 2026. PHP 8.2 reaches end of life on December 31, 2026.

What's still unclear is how the October 17 attacker got exploit details before disclosure. Amazon says it doesn't know. Also watch VulnCheck's research session on October 28, where it plans a deep dive into exploiting PHP2Shell. For another example of how quickly a leak turns into real damage, see our story on the OpenCode console breach.

FAQ

Is my WordPress site affected by PHP2Shell?

If it runs on an unpatched PHP version that serves web requests, yes. The bug is in PHP itself, not WordPress, so update PHP (or ask your host) to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Is PHP-FPM safe from PHP2Shell?

No. mod_php carries the highest risk, but PHP says all web-facing setups are affected, and the Foundation confirmed RCE on PHP-FPM through application-level code paths.

Can I just change php.ini instead of updating?

Not fully. PHP says the configuration changes only reduce exposure to specific attack paths. Updating is the only complete fix.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane. Learn • Build • Share Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.