On October 20, 2026, details of two critical PHP bugs leaked online. One day later, PHP shipped emergency patches. The community named the bugs PHP2Shell.
Why should you care? Because the bug is not in your app. It is in PHP itself. And PHP runs about 70% of the web.
Let’s go.
Quick Facts
| Item | Detail |
|---|---|
| Name | PHP2Shell |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical, CVSS v4.0 score 9.2 (both) |
| Impact | Unauthenticated Remote Code Execution (RCE) |
| Bug type | Memory safety (out-of-memory handling and use-after-free) |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| No official patch | PHP 8.1 and older (end-of-life) |
| Disclosed | October 21, 2026 (details leaked October 20) |
What is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities in the PHP core. The name tells you the goal: PHP request in, shell out.
The name also reminds people of Log4Shell. Same idea: one bug in a base component, and a huge part of the internet is exposed.
An attacker does not need an account. Network access to the server is enough. They send a request and the server can run their code.
The Two Bugs
CVE-2026-109618: The Out-of-Memory Problem
When PHP starts handling a request, it sets up some internal data. If the server runs out of memory at the wrong moment, that setup is stopped halfway.
Then PHP runs its cleanup code. The cleanup code thinks setup finished normally. So it works on data that was never filled in properly.
Bad data plus cleanup code can mean memory corruption. And memory corruption can lead to code execution.
CVE-2026-109619: The Stale-State Problem
This one is a use-after-free style bug. PHP frees some memory, but a pointer to it is still alive.
The next request handled by the same worker can touch that old state before PHP resets it. That means the attacker can use leftover data from freed memory.
Why Is This So Dangerous?
- No login needed. Pre-auth RCE is the worst case.
- It is in PHP core. Updating WordPress, Laravel, Drupal or plugins does not fix it.
- One request can be enough. The attack can start before any of your app code runs.
- Huge attack surface. Shared hosting, SaaS apps, CMS sites, appliances and admin panels all run PHP.
- Old versions have no fix. PHP 8.1 and older are end-of-life. Those servers must be upgraded or isolated.
What can an attacker do after RCE? Drop a web shell, steal data, install a cryptominer, add persistence, and move deeper into the network.
How Was It Found?
This is the interesting part. AI helped, but humans were in the loop.
- Calif found the first bug on August 1, 2026, as part of OpenAI’s “Patch the Planet” initiative. Researcher Ryan Austin used OpenAI’s GPT-5.6 Sol during an audit. They reported it to PHP on August 11 and found the second bug on August 21.
- Wiz Research found the bugs on their own, on August 19, using Google’s Gemini 4 Argon. They reported to PHP on August 24.
- PHP maintainers wrote and shipped the fix.
Two teams, two different AI models, same result. That should tell us something: AI is making vulnerability research much faster, for defenders and attackers.
It was not “AI alone”. Researchers picked where to look, guided the models, and checked the results. AI was a strong helper, not a replacement.
Timeline
| Date | Event |
|---|---|
| Aug 1, 2026 | Calif finds the first bug |
| Aug 11 | Calif reports to PHP |
| Aug 19 | Wiz finds the bugs independently |
| Aug 21 | Calif finds the second bug |
| Aug 24 | Wiz reports to PHP |
| Oct 20 | Technical details leak online |
| Oct 21 | PHP releases emergency patches, public disclosure |
The leak broke the normal coordinated disclosure plan. PHP had to release the patch a day early. watchTowr also said they reproduced CVE-2026-109618 before patched packages were out, and public PoC code started to appear.
So the gap between “CVE is public” and “attacks start” was very short.
Am I Affected?
Run this on your server:
php -v
Then compare with the fixed versions:
| Branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No official fix, upgrade now |
Important: Linux distros often backport fixes without changing the version number. So php -v may look old even if the fix is in. Check your distro’s security notice or package changelog:
apt changelog php8.3-fpm | grep -i "CVE-2026-10961"
Change the package name to match your setup. If you use shared hosting, ask your provider to confirm the patch.
How to Fix It
- Update PHP to a fixed release, or the vendor package that includes the backport.
- Restart the PHP process. The new version only loads after a restart.
- Upgrade EOL versions. If you run PHP 8.1 or older, move to a supported branch. If you cannot do it today, put the app behind strict network controls.
- Do not trust a WAF alone. A WAF can help as a temporary layer, but it is not the fix.
- Memory limit setting. PHP’s advisory describes enforcing a memory limit as a partial mitigation for the out-of-memory path. There is no config-only fix for both bugs. Treat this as a bridge, not a solution.
- Replace temporary mitigations with the real patch as soon as possible.
My Take as a Pentester
This is a good reminder of three things:
- Your stack is part of your attack surface. We spend time on app bugs (IDOR, SQLi, auth), but the runtime can be the weak point.
- Asset inventory matters. If a client cannot say which PHP version runs where, they cannot patch fast.
- Patch speed is a security control. The window between disclosure and mass exploitation keeps getting shorter.
Conclusion
PHP2Shell is a big deal because it is pre-auth, it is in PHP core, and PHP is everywhere.
If you liked this post, subscribe to the newsletter and follow me on X: @0xSilentGhost.
Stay safe. Patch fast.
References
- Wiz Research: https://wiz.io/blog/php2shell-php-rce
- Calif Research: https://calif.io/php2shell/
- OpenAI, Patch the Planet: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
- ThreatLocker: https://www.threatlocker.com/blog/php2shell-why-organizations-must-patch-critical-php-vulnerabilities-now
- Dark Reading: https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
- Techzine: https://www.techzine.eu/blogs/security/145168/php-shuts-the-internet-why-php2shell-affects-every-company/
- Itdaily: https://itdaily.com/blogs/software/php2shell-bug-php/
- The Next Web: https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz