PHP2Shell: emergency PHP releases fix unauthenticated RCE flaws rated CVSS 9.2

Emergency releases close two critical flaws

The PHP project shipped four emergency security releases on October 21 — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — fixing two vulnerabilities that can let an unauthenticated remote attacker execute code on the server. The PHP Foundation's announcement urges every PHP operator to update now, and Hacks.gr reports that the flaws reach back to PHP 5.4, with source-level patches also issued for out-of-support branches such as 7.4, 8.0 and 8.1.

The researchers who reported the bugs — teams from Wiz, OpenAI Codex Security and security firm Calif — have grouped them under the name PHP2Shell, severity CVSS 9.2, tracked as CVE-2026-109618 and CVE-2026-109619.

Two memory-safety failures at the engine's core

According to the PHP Foundation, the first flaw triggers when a request hits PHP's memory_limit at exactly the wrong moment: the engine can leave internal data half-initialized and subsequently mistake it for valid data, corrupting memory. On Apache with mod_php, a single unauthenticated request can trigger this before a single line of application code executes, and full remote code execution was demonstrated with default settings; RCE was also confirmed on PHP-FPM through application-level paths.

The second flaw is a stale-state bug. A fatal error at an unlucky point can leave internal state pointing at memory owned by a previous request, which a later request on the same worker may then reuse. A use-after-free and worker crashes were confirmed, and the reporter demonstrated remote code execution against a real-world application.

Both bugs sit in memory management and error handling — components nearly every request touches. The PHP2Shell research site stresses that the vulnerable code is in PHP itself, so even a secure application is exposed on an affected runtime. Demonstrations achieved pre-authentication code execution against WordPress, Drupal and Joomla, plus an application-agnostic path that reads worker memory — passwords, tokens, API keys, certificates — without executing code first.

A fix two years in the making

The PHP Foundation is frank about the timeline. Signs of the out-of-memory problem surfaced in 2024 while a Foundation-funded developer fixed findings from PHP's first external audit in years, performed by Quarkslab under Sovereign Tech Agency funding arranged via OSTIF. An exploit was theorized, but with no concrete attack path and every candidate fix carrying costs in compatibility, performance or extension-ecosystem disruption, work stalled for months — a structural failure, in the Foundation's own words, of its consensus-driven process and limited resources.

The calculus changed on August 11, 2026, when Calif researcher Ryan A, working under the Patch the Planet audit begun July 30, reported remote code execution with no preconditions sharing the same root cause. OpenAI independently reported the same issue that day; further vectors came from Wiz on August 24 and OpenAI on September 18. From August 11, the fix became the Foundation's top security priority.

AI runs through the story: the Foundation scanned PHP with Anthropic's Claude Mythos (via Alpha-Omega) and validates reports with OpenAI's Daybreak Red, while Hacks.gr notes researchers credit AI with turning long-dormant bugs into working attacks. Report volume has swollen too — 15 CVEs published since July 1, alongside 100-plus reports closed as invalid, duplicate or irreproducible.

Disclosure slipped ahead of schedule

Disclosure held until October 20, when the two CVE IDs began circulating on forums and social media with a wrong release time and an inflated CVSS of 10.0. The PHP project pulled its pre-announcement forward and moved the release from October 22 to October 21, weighing speed against distributors' need to package updates. Calif then mistakenly published a proof-of-concept video whose copies spread and accelerated community exploit development, and at 07:41 UTC on October 21 Chainguard broke the embargo by publishing patched container images more than six hours early.

Hacks.gr adds that Cloudflare logged the first exploitation attempts before patches shipped — none confirmed successful — and that Dutch government bodies and companies including BambooHR temporarily took services offline. The PHP security team says it monitored circulating proofs of concept and found none functional at disclosure.

Patch, then restart

The only complete fix, per the researchers, is installing a patched PHP release on every runtime and restarting Apache, PHP-FPM and any long-running workers — patching the application leaves the runtime beneath it untouched. Where immediate upgrades are impossible, partial mitigations include setting memory_limit = -1 (with OS-level caps such as cgroups, and never RLIMIT_AS or RLIMIT_DATA), lowering post_max_size and max_input_nesting_level, disabling display_errors, fatal_error_backtraces and session upload progress, and recycling PHP-FPM workers more often. Each covers only some attack paths. The fix also introduces a hard memory limit that terminates processes without running shutdown handlers — an operational change worth reviewing.

Why it matters

PHP powers roughly 70% of websites by the researchers' estimate, from WordPress to Wikipedia's MediaWiki, so a pre-authentication code-execution bug in the runtime itself — beneath all application logic — is about as broad as web exposure gets. The episode shows AI-assisted research compressing the gap between a theoretical engine quirk and a weaponized exploit, while a small, underfunded core team remains the main barrier between that gap and most of the web. And the leak, the stray video and Chainguard's early publication show how fragile coordinated disclosure becomes once identifiers spread socially — a pattern every project should expect to face.