PHP2Shell Vulnerability: How the PHP Emergency Unfolded

Two critical flaws in PHP turned a planned disclosure into a global emergency in under 36 hours. Maintainers shipped out-of-cycle patches on October 21, a full day early, after an anonymous forum post leaked the details. Both bugs allow unauthenticated remote code execution across the language behind roughly three quarters of all websites, and researchers named the pair PHP2Shell. Each PHP2Shell vulnerability traces back to August, when AI models found a defect that had sat in the engine for 14 years.

What the PHP2Shell vulnerability actually breaks

PHP tracks the flaws as CVE-2026-109618 and CVE-2026-109619, and rates both at 9.2 under CVSS v4.0. They share one root cause. When a request ends abnormally, PHP can leave its own memory corrupted, and an attacker who controls that moment runs code as the web worker. The first PHP2Shell vulnerability abuses out-of-memory corruption, while the second exploits stale global state to trigger a heap use-after-free.

The attack surface covers almost every way of serving PHP:PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP’s security team ranks mod_php highest, because a demonstrated exploit fires before any application code runs. That matters for site owners, since careful coding in a theme or plugin offers no protection here. Wiz researchers proved pre-authentication remote code execution against WordPress, Drupal and Joomla.

Scale is what turns a serious memory bug into an internet-level problem. PHP runs 75 to 80 percent of all websites, and current estimates put over 5.1 million PHP hosts online. Roughly 3.8 million of them expose at least one open port. Around 79% run versions the project no longer supports, so no official fix will ever reach them.

Where the PHP2Shell vulnerability started

The discovery began in August at the security firm Calif, whose researchers audited PHP source code using GPT-5.6 Sol. That work ran under OpenAI’s Patch the Planet initiative. Calif found multiple paths to remote code execution on August 1 and reported the first bug on August 11. OpenAI’s own team then investigated and found a more complete version of the same weakness in September.

Wiz reached the problem independently on August 24, using Gemini 4 Argon alongside its internal Atlas tooling. Credit for the PHP2Shell vulnerability research therefore sits with three separate groups. OpenAI appears as finder on CVE-2026-109618 and as reporter on CVE-2026-109619, with Calif and Wiz listed alongside. Wiz also built exploit chains and validated the patch, which let maintainers confirm the fix actually closed the hole.

A defect that sat still for 14 years

OpenAI president Greg Brockman said the underlying flaw had lived in PHP for 14 years. A limited version surfaced in 2024, but nobody treated it as significant then. The AI-assisted audit closed that gap between a bug existing and someone grasping its impact. It also bought defenders roughly two months of private preparation before the PHP2Shell vulnerability went public.

How the disclosure plan collapsed

Maintainers planned to disclose on Thursday, October 22, with patches and vendor protections ready at the same moment. That plan held until October 20. A now-deleted Hacker News post then published the CVE numbers, claimed both flaws scored a perfect 10.0, and named the date. Researchers at watchTowr confirmed within hours that the bugs were real and said they had reproduced one.

PHP responded by warning its announce list and moving the release to October 21 at 14:00 UTC. One detail from that leak still circulates in an incorrect form. The post claimed CVSS 10.0 for each PHP2Shell vulnerability, but PHP’s own assessment puts both at 9.2. The inflated score never had evidence behind it.

Cloudflare deployed managed firewall rules at 03:02 UTC on October 21, about nine hours before disclosure. Those protections covered free and paid customers by default. PHP core developer Gina Peter Banyard warned that no workaround fully blocks the attacks. Administrators should treat firewall rules and config changes as cover, never as a cure.

Attackers moved before the patch did

Amazon’s threat intelligence team detected an exploit attempt against its MadPot honeypot network on October 17. That was four days before anyone went public. The traffic came from an IP tied to a commercial anonymization service, which points to a deliberate actor. How that actor obtained exploit details under embargo remains unknown.

Amazon identified multiple proof-of-concept exploits roughly 12 hours before the scheduled disclosure. Each PHP2Shell vulnerability drew fresh attempts within hours of the patches landing, and payload variety suggests several separate actors. Cloudflare reported early attacks on patch day, then logged spikes of thousands of exploit attempts. Investigators now recommend hunting backwards through logs to October 17 rather than starting from patch day.

Amazon’s security chief pointed to the structural change behind that speed. AI-assisted analysis makes it cheap to turn a patch diff or an advisory into working exploit code. Usable exploits for the PHP2Shell vulnerability appeared within hours of the fix. Any organisation waiting for a scheduled maintenance window is gambling.

What businesses running PHP should do now

Patching closes each PHP2Shell vulnerability for good, and the fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone on PHP 8.1 or older needs to contact their distribution or LTS vendor, because the project no longer ships updates there. PHP’s team did publish minimal source backports for 7.4, 8.0 and 8.1. Shared hosting customers should confirm that their provider has updated the underlying runtime.

Incident response deserves as much attention as patching, because exploitation started before disclosure did. A patched server is not automatically a clean one. Teams should review error logs for memory-limit fatals from October 17 onward and look for unexpected processes running as the web worker. Credentials that lived on affected hosts need rotating.

If you cannot patch immediately

The PHP team shared mitigations that reduce exposure to each PHP2Shell vulnerability without closing the holes. For CVE-2026-109618, set memory_limit=-1 so applications cannot override it, keep post_max_size low, and apply a container or cgroup limit. For CVE-2026-109619, disable session.upload_progress.enabled and restart every worker. None of this replaces the patch.

What this means for everyone else

Most people following the PHP2Shell vulnerability do not run a web server and have no patch to apply. The risk still reaches them, because the sites holding their data run on this software. A successful attack lets an intruder read databases, alter pages and plant code that harvests whatever visitors type in.

Practical steps are limited for ordinary users, but a few still matter. Treat unexpected password resets or account notices over the coming weeks with suspicion, and check accounts directly rather than through emailed links. Change any reused passwords, because one compromised site spreads fastest through credential reuse. Multi-factor authentication removes most of the value of a stolen password.

The gap between discovery and attack keeps shrinking

The coordinated response to the PHP2Shell vulnerability worked better than most recent equivalents. Researchers found the flaws before attackers did, and maintainers had two months to build an intricate fix. Major infrastructure providers had protections live before the announcement, and agencies in the US, UK, Netherlands and EU published guidance the same day.

The failure sat in the final stretch of an otherwise disciplined process. One anonymous post cost defenders a full day, and someone was probing for the flaw four days before that post appeared. AI-assisted research and AI-assisted exploitation now both move faster than the human coordination built around them. Organisations still planning updates around monthly windows have their argument for changing that.