PHP2Shell Under Attack: Patch PHP 8.2 Through 8.5 Now

PHP2Shell is the name for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both allow unauthenticated remote code execution as the web worker account, and several security vendors saw exploit attempts before and right after the release. Because the bugs sit in PHP itself, every PHP application is in scope. Update PHP first; the configuration workarounds are partial.

What happened

The PHP project pre-announced a critical security release on October 20 and shipped it on October 21. The two advisories, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, credit researchers from Wiz, Calif and OpenAI, who reported the issues privately in August. Wiz named the pair PHP2Shell after confirming unauthenticated code execution against WordPress, Drupal and Joomla deployments.

The release went out under pressure. Recorded Future's Insikt Group says an archive with leaked vulnerability details was submitted to VirusTotal in the early hours of October 21, and the PHP Foundation told SecurityWeek the leaked fix let attackers study the patch in binary form before users could apply it. Reports differ on whether the leak began on October 20 or October 21; the effect is the same.

Both CVEs carry a CVSS 4.0 score of 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N). The high attack complexity and "attack requirements present" values reflect that exploitation depends on runtime conditions, not that it is hard to attempt.

Is PHP2Shell being exploited?

Exploit attempts are confirmed; confirmed compromises had not been publicly reported when this was written.

Cloudflare CTO Dane Knecht said Cloudflare saw early attacks against both flaws before patches shipped and deployed temporary WAF rules, which he described as a stopgap.
Patchstack had reports of multiple exploitation incidents from hosting partners by 07:34 UTC on October 21, according to Recorded Future.
Hadrian reported exploitation "at scale" a few hours before the fixes landed, and Amazon later told SecurityWeek it saw attempts four days before the release.
watchTowr saw attempts hit its sensors around patch time but had not seen a successful one, and warned that will not last.

Neither CVE was in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.10.23. The UK NCSC urged organizations to update immediately or take affected systems offline until patched.

Who is affected

Any PHP build that serves web requests on the 8.2, 8.3, 8.4 or 8.5 branch below the fixed versions. The PHP advisories rank exposure by server API (SAPI):

Apache mod_php: highest risk. The advisories say remote code execution was validated against mod_php, with default limits for CVE-2026-109618, because mod_php runs request shutdown even when request startup fails. We explain the difference in mod_php vs PHP-FPM and why the SAPI changes your risk.
PHP-FPM: CVE-2026-109619 was validated for code execution through session upload progress on a normal dynamic pool. For CVE-2026-109618, source analysis supports exposure but no complete FPM exploit was demonstrated.
LiteSpeed LSAPI and FrankenPHP: likely or conditionally exposed by source analysis, not validated. The advisory is explicit that unvalidated does not mean immune.

The exposure numbers are large. VirusTotal counts about 5.1 million internet-facing IPs running PHP. Modat counted 4,384,302 PHP services, and about 79% of those that disclose a version run branches the PHP project no longer supports, with PHP 7.4 alone on 878,761 services.

Unsupported branches are a real problem here. PHP 8.1 and older no longer get official releases; the project published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source, and some distributions and LTS vendors ship their own backported packages. PHP 8.2 reaches end of life on December 31, 2026. Our guide on why end-of-life PHP versions need a retirement plan covers what to do with the long tail.

Technical analysis

Both bugs share a root cause: PHP can leave memory in a bad state when a request ends abnormally.

CVE-2026-109618, RCE via OOM corruption. PHP uses longjmp() to abort a request on an out-of-memory error. Some code paths allocate before request memory is fully initialized, so the cleanup that follows can read or branch on uninitialized memory.
CVE-2026-109619, RCE via stale global state. Some global state points into request memory and is not always reset, or is repopulated after reset. A later request handled by the same worker can then use memory that was already freed (a use-after-free), which leads to memory disclosure and code execution with the worker's privileges.

Exploitation happens below the application layer, before the application's own code runs. That is why the flaws reach every CMS and framework, and why application logs may show nothing.

What to do now

Update PHP. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package. Both advisories call updating the only complete fix. Include PHP bundled inside containers, appliances, control panels and managed hosting, not only the packages you installed yourself.
Restart every worker. A new binary does nothing for workers that are still running the old one.
Apply the partial mitigations where you cannot patch today. Set session.upload_progress.enabled=0 administratively; the PHP project recommends keeping it off even after patching if you do not use the feature, and our walkthrough on how to disable PHP session upload progress covers where to set it so it cannot be overridden. On PHP 8.5, set fatal_error_backtraces=0. The primary configuration mitigation for CVE-2026-109618 is memory_limit=-1 enforced administratively with a conservative post_max_size; the advisory warns not to use RLIMIT_AS or RLIMIT_DATA because hitting those limits triggers the vulnerable path.
Filter at the edge. If an application does not accept multipart form data, block it before it reaches PHP. Make sure origin servers cannot be reached directly around your CDN or WAF.
Hunt backwards. Amazon's report puts first attempts around October 17, so start log reviews before that date. Look for PHP memory-exhaustion errors, "Maximum execution time exceeded", fatal errors on unusual routes and unexpected child processes of the web server. The advisory notes clean logs do not prove safety. If you find a web shell or unexplained files, follow our guide on what a web shell is and how it gets on a server and treat the host as compromised: rotate the credentials it could read.

What to watch next

PHP published a third, lower-risk issue on October 23, CVE-2026-115560, tied to session upload progress under an unusual runtime configuration. It will be fixed in the next regular release, and the PHP project again recommends session.upload_progress.enabled=0 until then. Expect a CISA KEV addition if exploitation is confirmed, and expect public proofs of concept to improve: Recorded Future notes that some current ones rely on a technique a researcher has already shown to be invalid.