PHP2Shell's two critical PHP flaws, explained

PHP2Shell is the nickname for two security flaws in PHP, the programming language that runs WordPress, Drupal and many other websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP fixed both on October 21, 2026. PHP rates each one 9.2 out of 10 and says an attacker with no account can use them over the internet.

The stakes went up on October 26. That day the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its catalog of bugs known to be exploited, according to Tenable. Federal civilian agencies must fix them by October 29.

What PHP2Shell is and who found it

PHP2Shell is one name for two separate bugs. Accounts differ on who coined it. Recorded Future's Insikt Group says Wiz Research found the flaws and named them, working with the security firm Calif and with OpenAI. Tenable traces the name to a video of the exploit chain shared by researcher Kirill Firsov, who credited LCFR of Calif.io.

The PHP Foundation credited Calif, OpenAI and Wiz, among others. Calif and Wiz both said they used AI models in the research. Calif says the earliest affected code path dates back to PHP 5.4.0, Tenable reports.

How the two flaws work

Both bugs sit in the code PHP runs at the start and end of every web request. That code runs before a site's own code, such as a WordPress plugin, gets a chance to act.

A web server keeps a pool of long-running PHP processes called workers. Each worker answers one request, cleans up, and takes the next one. That reuse means leftovers from one request can affect the next.

CVE	PHP's label	What goes wrong
CVE-2026-109618	OOM corruption	PHP runs out of memory while building a request's internal data. The cleanup step then treats the half-built data as valid.
CVE-2026-109619	Stale global state	Data from one request keeps pointing at memory that has been freed. The next request on the same worker can use it before PHP resets it.

OOM stands for out of memory. Both flaws involve what programmers call a use-after-free bug: the program keeps using a piece of memory after handing it back. An attacker who controls what lands in that memory can steer the program.

Recorded Future says the bugs include a use-after-free in the code that reads session upload progress data. That is a PHP feature for tracking file uploads. It has been in PHP since version 5.4.0 and is on by default, Recorded Future reports, citing VirusTotal data. One related bug leaks memory from the worker. Per Wiz, that can expose passwords, login tokens, API keys and certificates from other people's requests.

Who is exposed to PHP2Shell

PHP says every installation that serves web requests may be affected. It names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, which are the main ways a web server runs PHP. PHP rates mod_php, which runs PHP inside the Apache web server itself, as the highest risk. There, one request with no login can trigger a demonstrated exploit before any application code runs.

An attack does not work everywhere. Field Effect, a security firm, says success depends on the PHP version, operating system, web server, worker settings and memory layout. It "does not appear universally reliable across all affected environments," the firm wrote.

Researchers have still shown full takeovers of popular apps. According to Tenable, Calif confirmed code execution without a login on specific versions of WordPress, Drupal, Joomla and Magento. Trail of Bits got shells, meaning command-line control of the server, on MediaWiki, Symfony, Laravel and phpBB.

PHP also hides inside products people do not think of as PHP. Field Effect lists Palo Alto Networks, Citrix, F5, HPE, NetApp, QNAP and Trend Micro among vendors with affected products. Help Net Security reported on October 22 that Palo Alto says every version of its PAN-OS and Panorama software is affected, with no fixed release yet.

Tenable cites a Shodan search by Henk Poley that finds more than 1.9 million internet-exposed hosts running PHP. Running PHP does not by itself make a server vulnerable.

What changed and when

Date (2026)	Event
August 19	Wiz finds the first flaw with AI-assisted research tools
August 24	Wiz reports the flaws privately to PHP's security team
September 21	PHP acknowledges the report and starts on fixes
October 17	Amazon's decoy servers log an exploit attempt
October 20	PHP announces an emergency release for the next day
October 21	Details leak online hours before PHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35
October 23	PHP discloses CVE-2026-115560, a separate upload progress flaw
October 26	Trail of Bits reports working exploits; CISA lists both flaws as exploited

PHP had planned the release for October 22, the PHP Foundation says, and moved it up after the leak. We covered the advance notice and then the October 21 release as they happened. Amazon later said its honeypots, decoy servers built to attract attackers, caught an attempt four days before disclosure. It does not know how the attacker got the details early.

At release, the PHP Foundation said it "did not identify any functional exploits" among the code circulating online. That changed within days. Tenable reports that a researcher's honeypots running PHP 8.4.26 were exploited on October 24. Trail of Bits had working exploits against PHP 8.2 through 8.5 by October 26. Recorded Future still cautions that "the available reporting does not establish the full extent of successful exploitation or confirmed compromises."

The October 23 flaw is a separate problem that the October 21 releases do not fix. PHP calls it "an unlikely remote code execution vector in session upload progress." According to Field Effect, it affects apps that change session.serialize_handler while the program runs, before calling session_start(), with upload progress turned on.

What this means for developers

Updating is the only complete fix. Everything else buys time.

• Update, then restart every worker. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Tenable notes that a new package does not patch processes already running. Calif says the old code stays in memory until a restart.
• Save memory first if a server was probed. Google Cloud's guidance, written with Mandiant, says to capture worker memory before restarting. A restart wipes the evidence.
• Treat settings changes as a stopgap. PHP's interim fix for the first flaw is memory_limit=-1, set so apps cannot override it. For the second it is session.upload_progress.enabled=0, plus fatal_error_backtraces=0 on PHP 8.5.
• Check session code for CVE-2026-115560. If an app changes session.serialize_handler before session_start(), turn off upload progress until PHP's next regular release.
• Watch for SimpleXML crashes. Tenable reports a regression, php-src issue #24488, in 8.4.27 and 8.5.12 that can crash some SimpleXML apps. A fix was merged but not released as of October 26.
• Look past your own servers. Firewalls, storage boxes and security tools can bundle PHP, so read each vendor's advisory. Review logs back to October 17.
• Plan an upgrade from PHP 7.4 to 8.1. Those branches get only minimal source patches, no official release. Ask your distribution or support vendor about a backport.