PHP has rolled out patches for two critical-severity vulnerabilities named PHP2Shell that could provide attackers with unauthenticated remote code execution (RCE).
The issues are tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-2026-109619 (stale global state) and have a CVSS score of 9.2. For both, RCE was confirmed on Apache with mod_php.
“Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix,” the PHP Foundation says.
Patches for both were included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 were also released.
Before the fixes arrived, however, proof-of-concept (PoC) exploits targeting the two security defects started circulating.
Preemptive attack surface management firm WatchTowr says it has seen the first in-the-wild exploitation attempts hitting its sensors around the same time the patches landed, but has not observed successful attempts.
“Whilst nobody has been successful to date, we don’t expect that will last long,” WatchTowr head of threat intelligence Jake Knott said.
Several other companies reported seeing exploitation attempts, including before the patches landed.
“We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP’s session upload-progress path, and we expect more exploit paths to appear before and after the fix ships,” Hadrian reported a few hours before the fixes were released.
Patchstack and Cloudflare also observed exploitation attempts earlier in the day. Vega saw exploit attempts in the wild that leveraged a public PoC.
According to PHP’s maintainers, all PHP installations that handle web requests are potentially at risk of exploitation, “including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed”.
Where patching is not possible, users can implement measures that “reduce exposure to specific attack paths but do not make an installation safe,” the PHP Foundation says.
The two PHP2Shell flaws affect nearly all PHP releases back to version 5.4. They can also be exploited to read sensitive process memory, which may contain credentials, API keys, and other secrets.
“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel; the opportunities are endless,” Malwarebytes global head of scam and AI research Shahak Shalev said.
Frontier AI uncovers PHP2Shell
Wiz, along with OpenAI and Calif, discovered the vulnerabilities in August and kept them contained until patches were developed and distributed across the ecosystem.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz notes.
Calif explains that an initial OOM flaw in PHP was discovered in 2020, and then rediscovered during a PHP audit in 2024. Because exploitation was not proven, however, it was not patched. Courtesy of frontier AI models, the OOM weakness could be better analyzed and eventually turned into RCE.
The OOM to RCE issue was independently reported by Calif and OpenAI on August 11. Additional attack vectors were later reported by OpenAI and Wiz.
“The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation’s team working on security,” the PHP Foundation notes.
According to Wiz, which has published a technical deep-dive on PHP2Shell, CVE-2026-109618 and CVE-2026-109619 group four memory-safety issues in PHP, but do not cover all variants. Both tracked and likely untracked variants exist, the cybersecurity outfit says.
Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS.
“PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure,” Wiz says.
According to the PHP Foundation, AI has helped surface more PHP vulnerabilities than before, with 15 new CVEs published since July 1.
Early leak, early warning
The PHP2Shell flaws were planned for responsible disclosure on October 22, but information leaked online on October 20, and the Foundation decided to push the patches one day earlier.
It also published a pre-announcement warning that the critical bugs require immediate attention. Several cybersecurity firms published similar warnings, noting that the flaws’ exploitation could begin immediately.
A video demonstrating a working PoC was mistakenly published ahead of the disclosure timeline. It revealed some additional details on the two weaknesses and “contributed to accelerated development of various PoCs”.
Mitigation advice the PHP Foundation provided to critical infrastructure organizations may have leaked as well. Six hours before the coordinated release, Chainguard published built images containing the fix it received in advance.
“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure,” the PHP Foundation says.
As part of the coordinated effort, Cloudflare deployed protections against the PHP2Shell vulnerabilities nine hours before public disclosure.
“The emergency PHP security update shows how quickly organizations can be forced to respond when serious vulnerabilities become public. Before a patch is released, teams should already know where PHP is running, who can authorize urgent changes, and how they will confirm the update worked. They also need to check whether attackers reached those systems before the fix was in place,” SimSpace co-founder and CTO Lee Rossey said.
Related: Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Related: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Related: Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
