PHP2Shell: The Critical PHP Flaws Putting Millions of Web Servers at Risk

This is a fast-moving situation, so details may change. Check PHP's official advisory for the latest.

In the space of about four days in October 2026, two critical flaws in PHP went from a quiet exploitation attempt to a leak, an emergency patch release and global scanning. Together they are known as PHP2Shell, and security researchers are already calling them among the biggest vulnerabilities in years.

1. What is PHP?

PHP (Hypertext Preprocessor) is a widely used open-source scripting language for building dynamic websites and web applications. It sits behind a very large share of the web, including popular platforms such as WordPress, Drupal, Joomla and Magento. Because it runs on clouds, hosting providers, content delivery networks and millions of independently managed servers, a flaw in PHP itself can reach almost every corner of the internet.

2. How did the exploit happen?

PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP security team rated both 9.2 on the CVSS v4.0 scale. Both can lead to unauthenticated remote code execution (RCE), meaning an attacker can run commands on a server without logging in.
According to published technical write-ups:
CVE-2026-109618 is an out-of-memory corruption bug. Certain multipart form-parsing paths can push a request into an out-of-memory condition while staying within normal-looking PHP limits. Half-initialized data can then be treated as valid.
CVE-2026-109619 is a stale global state bug. If a fatal error skips a cleanup step, internal state survives after memory is freed, and a later request handled by the same worker can use it. This is a use-after-free that can lead to memory disclosure and full code execution.

Researchers say a single unauthenticated request can trigger the attack before any application code runs. Wiz demonstrated code execution against current WordPress, Drupal and Joomla container images, which indicates that exploitation does not depend on a bug in the application itself.

Timeline

1.  October 17: Amazon Threat Intelligence's MadPot honeypot network records an exploitation attempt, four days before public disclosure. Amazon says it is unclear how the attacker obtained the exploit information.
2.   October 20: Details leak online, including screenshots and videos of an exploit tool called PHP2Shell. The CVE identifiers circulate on social media, and watchTowr confirms remote code execution.
3.   October 21: Cloudflare deploys web application firewall (WAF) rules in the early hours (UTC) and reports early attacks. PHP then releases emergency fixes around 14:00 UTC, a day ahead of the original embargo.

3. What is the extent of the exploit?

Versions: Every release from PHP 5.4.0 through 8.5.11 is affected, which covers roughly fourteen years of deployments.
Setups: Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups using mod_php face the greatest danger.
Share of the web: Security journalist Brian Krebs reports that nearly 70 percent of websites need to update their core software, and warns that many sites may serve error pages as they are patched.
Expected abuse: Wiz expects attackers to mass-exploit the flaws to install web shells, which are web-based control panels for remotely running infected sites.
Expert reaction: Researcher Kevin Beaumont said the situation will lead to a mass of incidents and called it one of the biggest vulnerabilities in years.

4. Who and what services are affected?

No confirmed list of breached organizations has been published. What has been reported is who is exposed.
•        Applications: Researchers confirmed unauthenticated code execution against Magento 2.4.9 and ten other PHP applications: WordPress, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS.
•        Infrastructure: Cloud platforms, hosting providers, CDNs, and control panels such as cPanel and Plesk are exposed wherever they run a vulnerable PHP build.
•        Who has spotted attacks: Cloudflare, Amazon Threat Intelligence and watchTowr have all reported exploitation or attempts. The U.S. National Security Agency urged organizations to prepare updates or take systems offline if needed.

5. What mitigation has been implemented?

Emergency patches: PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These fix both vulnerabilities, and the PHP team is urging all users to update immediately.

1. WAF protection: Cloudflare put WAF rules in place to block known exploit vectors for sites behind its network. This is a stopgap and not a substitute for patching.
2. Detection content: Security vendors have published detection rules, such as Suricata signatures, and guidance for hunting for post-exploitation activity.
3. Restart requirement: After updating, every PHP-FPM and Apache worker must be restarted, because processes started before the update keep running the old code.
4. Temporary workaround: For CVE-2026-109619, one published stopgap is disabling session.upload_progress.enabled at the server level and restarting workers. Updating to a fixed release is the only complete fix.

Where a WAF or a patch stops an attack

attack flow · 2 decisions, 3 outcomes
A WAF rule can block known exploit patterns at the edge, but a request that matches none of them still reaches PHP. Only a patched PHP, with every worker restarted, removes the flaw.

6. What is the status now?

As of October 22, 2026, patches are available but exploitation is active and expected to grow. watchTowr has reproduced both flaws and says it is seeing exploitation attempts against both. Many sites are almost certainly still unpatched.
The fixed releases listed so far are only the 8.2 to 8.5 branches. The advisories reviewed for this article do not say what happens to older or end-of-life branches, which likely means those installs need to move to a supported version. Administrators should confirm this against PHP's official advisory.

7. How can this be prevented from happening again?

Immediate actions
1. Inventory every PHP runtime you run, including copies bundled inside applications, control panels and appliances.
2. Upgrade to a fixed release and restart all workers.
3. Put a WAF in front of public sites as a stopgap.
4. Check for compromise across the whole exposure window, starting from October 20 and not only from the date you patched. Look for unknown PHP files, web shells in upload directories and unusual outbound connections.
5. Rotate credentials and keys if you find any sign of intrusion.
Longer-term practices

• Run only supported PHP versions and automate patching.
• Subscribe to PHP and vendor security advisories so you can prepare before a scheduled release.
• Apply least privilege: restrict write access to code directories and disable unneeded risky functions.
• Keep logs, monitoring and restorable backups.
• Avoid exposing servers directly to the internet where a WAF or CDN can sit in front.

Sources

SecurityWeek, KrebsOnSecurity, Help Net Security, Tenable, Sansec, watchTowr, Huntress, Prophet Security, JetPatch, Digital Today and other security vendor write-ups published October 21-22, 2026.