In a major development for the global web infrastructure, the PHP Foundation has issued urgent security patches for two critical-severity vulnerabilities collectively dubbed "PHP2Shell." These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, represent a significant threat to the internet ecosystem, as they allow for unauthenticated remote code execution (RCE). With a CVSS score of 9.2, these vulnerabilities have been confirmed to enable full system compromise on servers running Apache with mod_php, though the scope of the risk extends far beyond any single server configuration.
The vulnerabilities reside in the core of the PHP engine, specifically within memory management and error handling—components that are triggered by nearly every incoming web request. The PHP Foundation has highlighted the central nature of these functions as the primary reason why the flaws were both exceptionally serious and notoriously difficult to rectify. Because these components are foundational to how PHP processes data, they affect a vast majority of PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Recognizing the gravity of the situation, the PHP Foundation released patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Additionally, the maintainers provided minimal source backports for older versions, including PHP 7.4, 8.0, and 8.1, to accommodate legacy systems that remain in widespread use. Despite these efforts, the path to remediation has been complicated by the emergence of proof-of-concept (PoC) exploits that began circulating even before the official patches were released to the public.
The Rising Threat of Exploitation
The window between the discovery of a vulnerability and its weaponization is often narrow, but in the case of PHP2Shell, the timeline was particularly chaotic. Preemptive attack surface management firm WatchTowr reported observing in-the-wild exploitation attempts hitting their sensors almost simultaneously with the release of the official patches. While these initial attempts did not immediately result in widespread successful compromises, security researchers warn that the situation is fluid and dangerous.
Jake Knott, head of threat intelligence at WatchTowr, noted that while early attackers were largely unsuccessful, the security community does not expect that state of affairs to persist. Several other cybersecurity firms corroborated this assessment, reporting active exploitation attempts even before the patches were available. Hadrian, a security firm that monitored the situation closely, reported seeing PHP2Shell exploited at scale just hours before the fixes were distributed, noting that attackers were primarily abusing PHP’s session upload-progress path. Furthermore, both Patchstack and Cloudflare confirmed they observed malicious activity early in the day, with Vega specifically documenting attempts that leveraged a publicly available PoC.
The implications for site security are dire. Because these flaws are embedded in the core of the language, they potentially affect nearly all PHP releases dating back to version 5.4. Beyond remote code execution, the vulnerabilities can be exploited to read sensitive process memory, potentially exposing credentials, API keys, and other proprietary secrets. Shahak Shalev, global head of scam and AI research at Malwarebytes, described the vulnerabilities as a "goldmine for hackers," explaining that attackers can hijack legitimate, high-reputation websites to facilitate phishing campaigns or serve malicious software through trusted channels.
Frontier AI and the Discovery of PHP2Shell
The discovery of these vulnerabilities is a landmark case for the use of artificial intelligence in security research. The PHP2Shell flaws were identified in August through a collaborative effort involving Wiz, OpenAI, and Calif. The organizations maintained a coordinated disclosure process to keep the information contained until the PHP Foundation could develop and distribute a robust fix.
According to Wiz, these findings are among the most significant in the history of PHP. While the underlying memory-safety issues had been present in the code for decades, demonstrating that they could be chained together to achieve remote code execution required an extreme level of complexity that was previously considered at the limit of what human researchers could achieve.
Calif revealed that the initial out-of-memory (OOM) flaw was first identified in 2020 but was not addressed at the time because its exploitability could not be definitively proven. It was later rediscovered during a comprehensive audit in 2024. By utilizing frontier AI models, researchers were able to perform a deeper analysis of the OOM weakness, eventually mapping out the necessary steps to turn it into a functional RCE exploit. OpenAI and Calif reported the OOM-to-RCE chain on August 11, with Wiz providing additional attack vectors shortly thereafter. This information became the top priority for the PHP Foundation’s security team, who worked tirelessly to address the flaws.
The impact is staggering when considering the scale of the PHP ecosystem. Wiz notes that PHP powers approximately 70% of all websites globally, including major platforms like WordPress, Drupal, and MediaWiki. This means that a vulnerability in the core engine can undermine the security of an entire website, even if the application code itself is perfectly written and secure. The PHP Foundation has noted that the integration of AI in security research has led to a noticeable uptick in vulnerability discovery, with 15 new CVEs published since July 1 alone.
Disclosure Challenges and Industry Response
The rollout of the patches was marred by an early leak, which forced the PHP Foundation to accelerate its release schedule. Originally planned for coordinated disclosure on October 22, the details of the vulnerabilities leaked online on October 20. In response, the Foundation moved up the patch release by one day and issued a pre-announcement warning to the public.
This premature disclosure was exacerbated by a video demonstrating a working PoC, which was mistakenly published, further accelerating the development of exploits. There were also reports that mitigation advice intended for critical infrastructure organizations had leaked. Notably, Chainguard published built images containing the fix six hours before the coordinated release. The PHP Foundation expressed frustration at this, noting that it allowed attackers to study the fix in binary form while the rest of the ecosystem was still waiting for the official release, effectively undermining weeks of collaborative work.
Proactive organizations took steps to mitigate the risk ahead of the official release. Cloudflare, for instance, deployed protections against PHP2Shell at its network edge nine hours before the public disclosure. However, for many others, the incident served as a wake-up call regarding the agility of their incident response teams. Lee Rossey, co-founder and CTO of SimSpace, emphasized that this emergency update underscores the necessity for organizations to have a clear understanding of where PHP is deployed within their environments, who has the authority to authorize urgent changes, and how they verify the integrity of their systems post-patching.
For those unable to apply the patches immediately, the PHP Foundation has suggested implementing mitigation measures. However, they stressed that these are merely temporary stopgaps that reduce exposure to specific attack paths and do not render an installation fully safe. The recommendation remains clear: administrators must prioritize upgrading to the latest versions of PHP as soon as possible to neutralize the threat posed by PHP2Shell and to secure their infrastructure against the inevitable wave of follow-up exploit attempts.
