PHP2Shell: two critical unauthenticated RCE flaws fixed in PHP, already exploited in the wild

Two critical flaws patched in the PHP engine

On 21 October 2026 the PHP project released fixes for a pair of critical vulnerabilities in the language engine itself, collectively nicknamed PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both bugs permit unauthenticated remote code execution and carry a CVSS v4.0 score of 9.2, according to a dev.to write-up rounding up the vendor advisories. The first flaw stems from out-of-memory corruption, the second from stale global state.

Because the defects live in PHP rather than in a framework, theme or plugin, updating those layers offers no protection. The PHP project warns that every installation serving web requests is at risk, a set that includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Cloudflare's guidance, as relayed by dev.to, is that administrators must update the PHP runtime their applications actually run on.

Affected versions and fixes

Wiz assesses that every PHP release from the past decade, going back to 5.4, is vulnerable to at least one of the two flaws, and says frontier AI models helped its researchers both find the bugs and develop working exploits. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No official fixed build exists below 8.2, though the PHP security team has published minimal source backports for 7.4, 8.0 and 8.1 for organisations that compile from source or lack a long-term-support vendor.

End-of-life dates sharpen the pressure: PHP 8.1 stopped receiving support on 31 December 2025, 8.0 in November 2023 and 7.4 in November 2022. Security support for 8.2 ends on 31 December 2026, and 8.3 is covered until 31 December 2027, so the write-up suggests targeting 8.3 or newer for anyone upgrading anyway.

Verify the runtime that serves requests

Two warnings from Qualys make version checks harder than they appear. The installation reported by php -v on a command line may belong to a different setup than the one handling web traffic, and distributions that backport fixes often retain an older version number, so a vendor advisory is more reliable than the number itself. Practical verification routes include hosting control panels, WordPress's Site Health screen under Tools, Site Health, Info and Server, and response headers such as X-Powered-By where exposed, though the absence of that header proves nothing either way. Leaving a phpinfo() page online just to check is discouraged, since it discloses server details to anyone.

Exploitation reports conflict

Accounts of in-the-wild activity diverge. Amazon Threat Intelligence recorded a PHP2Shell exploit attempt on 17 October 2026, four days before the fixes landed, and after patching became available stated that the flaws are now broadly exploited, recommending investigations start from 17 October. CISA's alert published the same day said the agency had observed no exploitation at the time of publication; the AWS assessment is the more recent of the two.

Cloudflare has rolled out PHP2Shell protections automatically to every plan with its WAF enabled, including free tiers, yet still directs customers to patch. The PHP project similarly cautions that its temporary mitigations block only some attack paths and leave an installation unsafe. A WAF buys time during an update; it does not replace one.

Why it matters

An unauthenticated remote code execution flaw in the engine rather than the application means there is no remedy short of replacing the runtime, and the exposure stretches across roughly a decade of releases. Wiz demonstrated that the bugs can expose passwords, tokens and API keys held in server memory, so compromise goes beyond defacement to credential theft. With exploitation reportedly already widespread, CISA's guidance for organisations stuck on PHP 8.1 or earlier is stark: disconnect those systems until they can be patched or upgraded. The detail that frontier AI models helped produce working exploits also signals a shift in how vulnerability research is done, and a likely shortening of the window between disclosure and active attack.