php2shell: critical unauthenticated RCE in PHP core patched; Cloudflare blocks live attacks

Two core flaws patched in four PHP releases

On October 21, 2026, the PHP project published security updates for all supported branches — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — fixing two vulnerabilities rated CVSS 9.2 that enable unauthenticated remote code execution. According to the PHP security team's advisory, every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The team considers mod_php the most dangerous configuration, having demonstrated an exploit that fires from an unauthenticated request before any application code runs.

Wiz Research, which discovered and reported the issues, says every PHP version released in the past decade is affected by at least one of the bugs, going back to PHP 5.4. The coordinated disclosure also involved OpenAI, Calif and Quarkslab, according to Cloudflare, which was one of several infrastructure providers — alongside AWS, Google, Microsoft, Akamai, Fastly and others listed by Wiz — that prepared mitigations in advance of publication.

Memory errors that outlive a request

Both CVEs stem from how PHP handles failure conditions while processing requests. In CVE-2026-109618, out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and cleanup then treats that incomplete data as valid. In CVE-2026-109619, request-owned state survives after the memory backing it has been freed, and a later request handled by the same worker may act on that stale state.

Wiz's write-up identifies several concrete instances, including an upload-progress unserializer use-after-free and a fatal-error backtrace use-after-free, plus an OPcache type confusion. The consequences go beyond crashing a worker: attackers can read sensitive process memory — potentially passwords, authentication tokens, API keys and certificates belonging to other requests — or achieve code execution. Wiz chained the bugs into a single exploit script, php2shell, and demonstrated pre-authentication code execution against stock WordPress, Drupal and Joomla container images. Because the flaw sits in the runtime rather than the application, Wiz notes that even a minimal "Hello World" PHP script on an affected version is exposed.

Patching is the only complete remedy

The PHP advisory is blunt that no workaround fully resolves the issue, but lists measures that reduce specific attack paths. For the out-of-memory bug, it suggests setting memory_limit to -1 in a way applications cannot override (such as php_admin_value), capping post_max_size at 8M without uploads or 32M with them, and enforcing size, field-count and nesting limits at the proxy layer — while warning against RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable allocation failure. For the stale-state bug, it recommends disabling session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces, then restarting workers, and fixing attacker-reachable fatal errors.

PHP 8.1 and older no longer receive project updates, though the security team published minimal source backports for 7.4, 8.0 and 8.1 for those building from source. Linux distributions and LTS vendors received patches in advance. The team also flagged that PHP 8.2 reaches end of life on December 31, 2026, and that the volunteer-maintained rpms.remirepo.net repository would not have updates on release day.

Attack traffic already observed

Cloudflare disclosed that vulnerability details leaked before the scheduled release date and that it saw attack traffic targeting customers, with attackers mutating payloads in attempts to slip past its rules. The company developed web application firewall protections beginning in early October and deployed them roughly nine hours ahead of public disclosure; from 03:02 UTC on October 21, all WAF customers, including those on free plans, were protected by default.

Detecting php2shell required more than request inspection, since a request alone may not distinguish an exploit from legitimate traffic. Cloudflare built a new capability it calls full transaction detection, which combines request and origin-response signals within a single HTTP transaction and can block a matching response before it reaches the requester. The company emphasized that the WAF rules are an additional layer, not a replacement for applying the PHP update.

The AI dimension

A notable part of Wiz's account is how the exploit came to exist. The underlying flaws had been in the codebase for over a decade, but weaponizing them required chaining multiple bugs and adapting to each target's memory layout — work Wiz describes as close to impractical for manual research. Frontier AI models changed that calculus, letting researchers build and adapt working exploits across multiple applications in hours. Wiz compares the finding's significance to Heartbleed and Log4Shell and argues that as the effort and expertise needed for such work shrink, complexity alone can no longer be treated as a reliable defense.

Why it matters

PHP powers roughly 70% of websites, including WordPress, Drupal, Joomla and Wikipedia's MediaWiki. These flaws live in the engine itself, so secure application code and carefully maintained plugins provide no protection — only a PHP update does. Unauthenticated exploitation that can trigger before application code even runs, combined with a large installed base of unsupported versions that will never receive official fixes, makes rapid patching urgent. The AI angle matters beyond this incident: bugs long dismissed as too intricate to exploit may now be turned into working attacks quickly, forcing defenders to reassess what "practically exploitable" means.