PHP has rushed out emergency patches to address two critical-severity vulnerabilities collectively dubbed "PHP2Shell," which threaten unauthenticated remote code execution (RCE) across a massive portion of the global web infrastructure. Tracked as CVE-2026-109618, denoting an out-of-memory (OOM) corruption flaw, and CVE-2026-109619, representing a stale global state issue, both vulnerabilities carry a severe CVSS score of 9.2. Security researchers have confirmed that RCE is fully achievable on Apache web servers utilizing mod_php, leaving countless applications exposed to potential takeover.
According to the PHP Foundation, the gravity of these vulnerabilities stems from their location within core components of the language. Both issues reside deep inside parts of PHP that virtually every incoming web request touches: memory management and error handling. This central role within the architecture is precisely what made the vulnerabilities so acutely dangerous and extraordinarily difficult for maintainers to diagnose and fix.
Official patches addressing both security defects were rapidly bundled and pushed out into PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. In an effort to secure legacy systems still in production across the ecosystem, the maintainers also released minimal source backports for older iterations including PHP 7.4, PHP 8.0, and PHP 8.1. However, the window of safety proved narrow. Even before the official patches could be finalized and distributed, proof-of-concept (PoC) exploits targeting the two defects began circulating widely across digital channels.
Preemptive attack surface management firm WatchTowr reported that its sensors detected the very first in-the-wild exploitation attempts hitting honeypots and monitored assets around the exact same time the patches went live, though successful compromises were not observed immediately. Jake Knott, head of threat intelligence at WatchTowr, noted that while nobody appeared to have achieved sustained success in those initial waves, that relative safety was unlikely to last given the aggressive scanning activity observed by security teams.
Several other prominent cybersecurity organizations corroborated these warnings, noting active exploitation campaigns taking place even before the official patches landed. Hadrian published an alert hours prior to the official fix release, stating that php2shell was being exploited in the wild at scale, with the vast majority of observed attacks abusing PHP’s session upload-progress path. Hadrian also warned that additional exploit paths were anticipated to emerge both before and after the official fixes were shipped to the public. Additional early exploitation attempts leveraging a public proof-of-concept were tracked and reported by Patchstack, Cloudflare, and Vega Threat.
PHP’s core maintainers have cautioned that virtually all PHP installations responsible for handling web requests are potentially at risk of exploitation. This sweeping exposure covers a wide array of server configurations and deployment models, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. For administrators where immediate patching is not technically feasible, the PHP Foundation notes that alternative mitigation measures can be implemented to reduce exposure to specific attack paths, though such workarounds do not render an installation fully safe.
The implications of the PHP2Shell flaws extend well beyond simple code execution. Affecting nearly all PHP releases dating back to version 5.4, these vulnerabilities can additionally be leveraged by malicious actors to read sensitive process memory. This leaked memory often harbors active credentials, cryptographic API keys, and other critical secrets. Shahak Shalev, global head of scam and AI research at Malwarebytes, described the scenario as a goldmine for hackers, explaining that attackers can hijack legitimate websites to exploit their trusted reputations for phishing campaigns or to serve malicious software directly from trusted distribution channels, leaving the potential attack opportunities virtually endless.
Frontier AI Uncovers PHP2Shell
The discovery of the PHP2Shell vulnerabilities was the result of a coordinated effort involving prominent cybersecurity and technology entities, including Wiz, OpenAI, and Calif, who first uncovered the flaws in August. These organizations maintained a strict responsible disclosure timeline, keeping the details tightly contained while patches were developed and rigorously tested across the software ecosystem.
Wiz characterized these findings as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably within software history as a whole. The underlying memory-safety flaws had quietly persisted within the language’s core engine for decades, but demonstrating their true exploitability required an exceptionally complex chain of steps pushing against the absolute edge of what human researchers could practically achieve on their own.
Calif explained that an initial out-of-memory flaw in PHP was originally identified back in 2020, and subsequently rediscovered during an independent PHP security audit in 2024. Because direct exploitability could not be proven at the time, however, the finding was left unpatched. It was only through the application of frontier artificial intelligence models that the OOM weakness could be deeply analyzed, correctly mapped out, and eventually chained into a reliable remote code execution vector.
This critical OOM-to-RCE transition was independently reported to stakeholders by Calif and OpenAI on August 11. Additional complementary attack vectors were subsequently reported by OpenAI and Wiz. According to the PHP Foundation, these comprehensive reports made the full impact of the underlying memory problem undeniably clear, instantly elevating the remediation effort to the absolute top priority for the entire security team.
Wiz published an extensive technical deep-dive into PHP2Shell, explaining that CVE-2026-109618 and CVE-2026-109619 actually group four distinct memory-safety issues within PHP, though they do not encompass every possible variant. The cybersecurity firm warned that both tracked and potentially untracked variants of the underlying defect still exist within the legacy codebase. Because these security defects reside natively within PHP itself, they implicitly impact an estimated 70 percent of all websites active on the World Wide Web, entirely independent of the specific content management system running on top.
Wiz emphasized that PHP serves as the foundational programming language behind a massive swath of the internet, powering ubiquitous platforms such as WordPress, Drupal, and MediaWiki, the software that runs Wikipedia. Consequently, a severe vulnerability deeply embedded in its core engine affects websites across the entire digital ecosystem, even in scenarios where an individual site’s custom application code is otherwise entirely secure. Furthermore, the PHP Foundation noted that the integration of artificial intelligence into security research has helped surface a noticeably higher volume of PHP vulnerabilities than in previous cycles, with 15 new CVEs published since July 1 alone.
Early Leak, Early Warning
The coordinated disclosure of the PHP2Shell flaws had been carefully scheduled for public release on October 22. However, sensitive technical information unexpectedly leaked online early on October 20, forcing the PHP Foundation to make the difficult decision to push out the emergency patches a full day ahead of schedule.
Alongside the accelerated patch rollout, the Foundation published an urgent pre-announcement warning emphasizing that the critical bugs demanded immediate administrative attention. Several independent cybersecurity firms published parallel warnings, stressing that active exploitation by opportunistic threat actors could begin instantaneously. The situation was further exacerbated when a video demonstrating a working proof-of-concept was mistakenly published ahead of the agreed disclosure timeline. This accidental leak revealed granular technical details regarding the two weaknesses, which significantly accelerated the development of various independent exploit scripts across the threat landscape.
Complications also arose regarding early mitigation advice provided by the PHP Foundation to critical infrastructure organizations, which appeared to leak prematurely. Just six hours prior to the coordinated public release, security firm Chainguard published built container images containing the security fix it had received in advance. This premature distribution meant that any sophisticated attacker could study the security fix in binary form while ordinary PHP users and system administrators were still waiting for the official release window, effectively bypassing weeks of careful coordination among the reporting parties.
Despite these hurdles, collaborative defenses were mobilized rapidly. As part of the coordinated multi-party effort, Cloudflare successfully deployed protective web application firewall rules against the PHP2Shell vulnerabilities nine hours before the official public disclosure took place.
Industry experts stress that the emergency PHP security update serves as a stark reminder of the immense pressure organizations face when critical infrastructure vulnerabilities become public ahead of schedule. Security leaders like SimSpace co-founder and CTO Lee Rossey noted that before a patch is even released, IT teams need to maintain a clear inventory of precisely where PHP instances are running, who holds the authority to authorize urgent emergency changes, and how they will quickly verify that updates were applied successfully. Organizations are also urged to conduct thorough forensic checks to determine whether malicious actors managed to compromise those systems before the protective fixes were successfully put in place.
