PHP2Shell Vulnerability Explained: What It Is, Who Is Affected, and How to Fix It

Quick answer: PHP2Shell is the name for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the two flaws, which can allow unauthenticated remote code execution, and all PHP users are strongly encouraged to update immediately. The vulnerabilities affect all web servers running PHP 5.4 or later. Exploitation has been observed in the wild. If you cannot update today, apply PHP’s interim mitigations and consider taking the site offline. phpcloudflare

Key facts at a glance

What is PHP2Shell?

PHP2Shell is the collective name for two memory-safety bugs in how PHP handles abnormal request termination. They sit in the PHP runtime itself, not in WordPress, a plugin or your application code, so every PHP-based site on an unpatched runtime is exposed regardless of what it runs.

According to the PHP security advisory:

• CVE-2026-109618, RCE via OOM corruption: out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. php
• CVE-2026-109619, RCE via stale global state: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it. php

Successful exploitation can lead to full remote code execution without authentication or user interaction; other demonstrated effects include worker crashes, arbitrary file reads and server-memory disclosure. Memory disclosure matters on its own: researchers have demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens and API keys. impervaqualys

How the two flaws work (plain English)

Every PHP request allocates memory, does its work, then cleans up. The flaws appear when that sequence is interrupted. If processing stops unexpectedly, for example because it runs out of memory, PHP fails to clean up safely; the vulnerabilities arise when PHP handles an error and then tries to use data that was not fully set up or memory that has already been released. An attacker triggers that interruption with crafted HTTP requests and controls what PHP finds in the invalid memory. cloudflare

The exposure is widest where PHP runs earliest. PHP considers the risk highest for mod_php, with a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. php

This article deliberately stops at the conceptual level. Do not test exposure by running exploit code against production; use version checks and vendor confirmation instead.

Which PHP versions are affected?

Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. Users of the volunteer-maintained rpms.remirepo.net were urged to switch to distribution packages or build from source, as that repo would not have updates on release day. phpphp

Everyone serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP also hides in places you may not manage: the Dutch NCSC warns that PHP is embedded in appliances and management interfaces where administrators can’t update it themselves. phpebuildersecurity

Is PHP2Shell being exploited?

Yes. watchTowr has observed exploitation in the wild through its Attacker Eye honeypot network. Amazon Threat Intelligence identified an exploitation attempt dating back to 17 October 2026 in its MadPot telemetry, four days before public disclosure, and Cloudflare reported signs of early exploitation prior to the patch release. Official assessments vary by agency: CISA said it had not observed exploitation, while NSA said cyber actors are likely to weaponize the vulnerabilities. The NHS England National CSOC assesses future exploitation as highly likely. PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619 Fixes +3

Treat any internet-facing unpatched PHP server as a target now, not a hypothetical one.

Timeline: from discovery to emergency release

• 11 August 2026: The OOM-to-RCE issue was independently reported by Calif and OpenAI; additional attack vectors were later reported by OpenAI and Wiz. securityweek
• 19–24 August: Wiz Research discovered the first PHP vulnerability on August 19 and reported to the PHP security team on August 24. wiz
• 20 October: PHP gave advance notice of a security release scheduled for 21 October at 14:00 UTC, addressing two critical vulnerabilities rated CVSS v4.0 9.2, and reserved the right to release earlier if details became public or exploitation appeared. News of the vulnerabilities leaked in online forums, and Calif accidentally posted a proof-of-concept video; the patches were fast-tracked and released 24 hours early. phpCNBC
• 21 October, 03:02 UTC: Cloudflare customers using the free or paid WAF were protected by default against php2shell. cloudflare
• 21 October: Fixed releases published; NSA, CISA, UK NCSC, NHS and CERT-EU issue alerts.

Why governments took websites offline

Because the only complete fix is a patch, and many organisations could not deploy one instantly, several chose downtime over exposure. PHP2Shell forced 32 UK government services offline and left four partially unavailable, with no confirmed compromise. Government websites in Germany, France, Belgium, Finland and the Netherlands were also taken offline as a precaution, along with Australia’s own cybersecurity agency website. In the Netherlands, the Port of Rotterdam, the government portal Overheid.nl, football association KNVB, the five largest political parties and several hospitals went dark. PHP2Shell puts dozens of UK government services out of service +2

The advice behind those decisions was explicit. The NSA said that if an immediate update is not feasible, organisations should take the system offline until it can be fully mitigated; CERT-EU, the UK NCSC and Sweden’s CERT-SE gave similar isolate-or-patch advice. A maintenance page during a critical-vulnerability window is a precaution, not evidence of a breach. ebuildersecurity

Does PHP2Shell affect WordPress, Drupal and Joomla?

Yes, if the site runs on an unpatched PHP runtime. Security researchers have demonstrated successful exploits for both CVEs, achieving remote code execution in products integrating PHP such as WordPress, Drupal and Joomla. Because the flaws are in the PHP runtime, updating website code or plugins alone does not fix them; administrators need to update the PHP software running their applications, and if a hosting provider manages PHP, ask the provider to apply the update. digitalcloudflare

Keep WordPress core, themes and plugins current for every other reason, but understand that none of those updates touch PHP2Shell.

How to fix PHP2Shell: step by step

1. Find the PHP version your site actually uses. php -v shows the command-line binary, which is often not what serves your site. The command-line php binary can be a different version from the one PHP-FPM or Apache runs. Check your hosting panel’s PHP selector, the FPM pool configuration, or a temporary phpinfo() page (delete it afterwards). watchtowr

2. Update to a fixed release. 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for your branch; a vendor-backported package for 7.4–8.1. Test on staging first if you can, but do not let testing delay a production patch by days.

3. Restart every process that loads PHP. Running processes keep the vulnerable code in memory until they restart; this matters especially for CVE-2026-109619, which exploits request state that carries over when PHP workers are reused. Restart PHP-FPM, Apache, LiteSpeed or your containers. qualys

4. Verify after restart. Confirm the running version again from the web context, not the CLI.

5. If a host manages PHP, get written confirmation. Ask: Was the vulnerable runtime present on my account? Has the fixed version been deployed? Is my site now using it? Have workers been restarted? Are any interim mitigations still applied, and will they be removed?

6. Keep WAF protection on while you patch. Cloudflare recommends applying the vendor update as soon as possible while keeping WAF protection enabled as an additional layer, and its analysts continue to update protections as new techniques emerge. cloudflare

7. Review logs and look for compromise. Check for unexpected PHP fatal errors or out-of-memory errors in the days before you patched, unexplained file changes, new admin users, and unusual outbound connections. If you find signs of compromise, treat it as an incident: preserve logs, rotate credentials and secrets the PHP process could read, and restore only from a verified-clean backup.

If you cannot patch today

PHP states that while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe. Summarised from the official advisory: php

• For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration; set a low post_max_size (8M if uploads aren’t needed, 32M if they are) with upload_max_filesize below it; use a container or cgroup limit as the availability boundary rather than RLIMIT_AS or RLIMIT_DATA, which can themselves trigger the vulnerable allocation failure. php
• For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker, using php.ini or FPM/server configuration rather than ini_set() or .user.ini; on PHP 8.5, set fatal_error_backtraces=0; remove invalid or deprecated per-request settings that emit diagnostics; and note that hiding diagnostics with error_reporting, display_errors or @ does not help. php

If none of these can be applied and the system is internet-facing, follow the NSA and NCSC guidance: take it offline until it is patched.

Does a WAF or a patch make you safe?

A WAF reduces exposure; it does not close the hole. Cloudflare observed attackers mutating the attack payload to try to bypass its protections, which is exactly why it tells customers to patch anyway. cloudflare

A patch closes the hole; it does not undo what came before it. If your server was reachable while vulnerable, assume an attacker could have run code or read worker memory, and check. Rotate database passwords, API keys and session secrets that lived in PHP memory. Patching plus verification plus investigation is the complete response; any one alone is not.

How AI found PHP2Shell

The flaw was not new; proving it exploitable was. Calif explains that an initial OOM flaw in PHP was discovered in 2020 and rediscovered during a 2024 audit, but because exploitation was not proven it was not patched; frontier AI models allowed the weakness to be analysed and turned into RCE. Calif found the first bug with help from OpenAI’s GPT-5.6 Sol during an audit funded through OpenAI’s Patch the Planet initiative; Wiz found the flaws independently weeks later using Wiz Atlas, Google’s Gemini 4 Argon and GPT-5.6 Sol. securityweekthenextweb

The lesson for defenders is uncomfortable but clear: AI lowers the cost of turning a known-but-unexploited bug into a working exploit, for researchers and attackers alike. The PHP maintainers said this leads them to reconsider the risk-reduction value of long coordinated-disclosure embargoes and adds pressure to already stressed vulnerability-management processes. Expect shorter embargoes and faster “patch now” cycles. techtarget

Frequently asked questions

Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 7.4, 8.0 and 8.1, use a distribution or LTS vendor package, or the PHP security team’s minimal source backports.

I’m on shared hosting. What do I do?
You can’t patch PHP yourself. Confirm with your host, in writing, that the fixed runtime is deployed on your account and workers were restarted. If the host can’t confirm, ask about interim mitigations or put the site in maintenance mode.

Does Cloudflare protect me from PHP2Shell?
Cloudflare’s protections are deployed automatically on all plans with WAF deployed, including Free, but Cloudflare itself says to patch. A WAF is a layer, not a fix. cloudflare

Can I just change a PHP setting instead of updating?
No. PHP says there are no complete mitigations and updating is the only safe choice. The settings listed above reduce exposure to specific known paths only. php

Is there a free way to check exposure?
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619. Run tools like this only against systems you own or are authorised to test. helpnetsecurity

Is the attack limited to cloud servers?
No. Any PHP installation serving web requests is affected: shared hosting, VPS, dedicated servers, containers, cloud instances and embedded appliances.

Who discovered it?
Researchers at Calif, OpenAI and Wiz, working with the PHP security team, between August and October 2026.

Sources

1. PHP security advisory (21 Oct 2026): https://www.php.net/archive/2026.php#2026-10-21-5
2. GitHub advisory, CVE-2026-109618: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
3. GitHub advisory, CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
4. Cloudflare, “Cloudflare deploys protections against php2shell vulnerability”: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
5. Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities”: https://www.wiz.io/blog/php2shell-php-rce
6. NHS England Digital cyber alert CC-4875: https://digital.nhs.uk/cyber-alerts/2026/cc-4875
7. UK NCSC: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
8. watchTowr FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
9. Qualys Threat Research: https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities
10. The Register, UK government services offline: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840
11. CNBC, why governments pulled sites offline: https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html