TL;DR
PHP2Shell is the nickname for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. An attacker needs no login and no password. They send one web request and can run code on your server or read secrets from memory. If you run PHP 8.2, 8.3, 8.4, or 8.5, update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart every PHP worker. If you run anything older, that is a bigger conversation, and this page covers it.
Introduction
About 758,000 servers on the public internet run a version of PHP that will never get an official fix. That number comes from servers willing to say what they were running. Four out of five said nothing.
What is PHP2Shell?
Researchers named PHP2Shell after two memory flaws found in the PHP runtime in 2026. The runtime is the engine that turns your PHP files into a working website.
Three things set it apart from a typical CMS bug.
- It is not in WordPress or Drupal or your plugins. It is in PHP, so every site running an affected version is in scope, no matter how clean the application code is.
- It needs no account. The attacker does not have to log in, guess a password, or find a weak form.
- It reaches back to PHP 5.4, released in 2012. Researchers traced the affected code path that far.
The two CVEs at a glance
Both have the same score and allow the same worst case. They break in different ways.
- CVE / Bug type / CVSS v4.0 / What it allows
- CVE-2026-109618 / Out-of-memory handling / 9.2 / Remote code execution by an attacker with no account
- CVE-2026-109619 / Use after free / 9.2 / Remote code execution, plus confirmed memory disclosure
One correction worth making. Before the official release, draft CVE records circulated showing a score of 10.0. The PHP Foundation said that score was wrong. The real figure for both is 9.2.
How PHP2Shell leads to remote code execution
This section stays at the concept level. There are no steps here, and there will not be.
A crafted web request pushes PHP’s memory handling into a state it was never meant to reach. This happens while the request is still being set up, which is before any of your application code runs.
From there, the attacker gets PHP to reuse a piece of memory it already handed back and arranges for their own data to sit in it. That is the opening.
One path touches a PHP feature called session upload progress, which tracks how far a file upload has gotten. It ships turned on by default, so most servers have it whether they use it or not.
What it can do without running any code
The second flaw also leaks memory, and the PHP advisory confirms that. Researchers showed it can pull passwords, login tokens, API keys, and certificates from other people’s requests on the same server.
That matters for how you respond. A server can hand over its secrets without ever being taken over, so patching alone doesn’t close the book on a machine that sat exposed.
Which PHP versions are affected
- Branch / Status / What to do
- PHP 8.5.x / Fixed in 8.5.12 / Update
- PHP 8.4.x / Fixed in 8.4.27 / Update
- PHP 8.3.x / Fixed in 8.3.36 / Update
- PHP 8.2.x / Fixed in 8.2.35 / Update
- PHP 8.1, 8.0, 7.4 / No official release / Use your Linux distribution’s package or an LTS vendor build. PHP also published minimal source backports.
- PHP 7.3 and older, back to 5.4 / End of life, nothing coming / Move to a supported branch
The 7.4 to 8.1 row is the one most summaries get wrong. Those branches do not get a normal PHP release, but that is not the same as having no path. Several distributions shipped patched packages, and PHP published source backports for teams that build their own.
Which platforms and software are affected
Anything running on an affected PHP version is affected. That is a long list, and people often forget the ones running on odd ports.
- Apps and content systems: WordPress, Drupal, Joomla, Magento, Laravel, and any custom PHP you wrote yourself.
- Hosting and admin panels: cPanel, Plesk, CWP, phpMyAdmin, Adminer.
- Monitoring: Zabbix, Cacti, Nagios XI, LibreNMS.
- Network and phone gear: pfSense, OPNsense, FreePBX. These ship their own copy of PHP, so you’re on the vendor’s schedule.
- Mail, files, and the rest: Roundcube, Nextcloud, ownCloud, WHMCS, SuiteCRM, osTicket, GLPI, Moodle, MediaWiki.
- Containers: any image built on an older PHP base image, until you rebuild it.
- Vendors differ on timing, so check each product’s own notice rather than assuming.
Who is most at risk
PHP rates Apache with mod_php as the highest-risk setup. On those servers, a single request with no account behind it can trigger the problem before your application ever loads.
PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP are all still affected. The difference is how much has to go right for the attacker, not whether the bug is there.
Internet-facing comes before internal. An admin panel reachable from anywhere is a worse problem than the same panel on a private network.
The PHP you forgot you had
Most teams find patching easy and finding the servers hard. PHP hides in places a normal scan of ports 80 and 443 misses.
- Admin panels on ports like 2083, 2087, 8080, 8443 and 8880.
- Apps like phpMyAdmin or Roundcube living under a path on an otherwise static site.
- Servers with expose_php turned off, or a CDN stripping the version header, so the banner tells you nothing.
- Appliances and phone systems with their own bundled PHP.
- Old container images that keep running until somebody rebuilds them.
- Domains from an acquisition, an old agency, or a staging box nobody logged into since 2019.
Two separate bugs. One unauthenticated door.
Both flaws sit inside the PHP runtime, so they fire before your application code gets a say. Neither one needs a login, a plugin, or a bad password.
When memory runs out while request data is only partly set up, later cleanup treats that half finished data as if it were valid.
CVSS v4.0 · 9.2Leftover state from one request still points at memory that has been handed back. A later request on the same worker can reach it.
CVSS v4.0 · 9.2The attacker runs their own code on your server, with whatever rights PHP has.
Passwords, tokens, API keys and certificates from other people’s requests, read without running any code.
The second outcome is the one teams miss. A server can leak its secrets without ever being taken over.
Is PHP2Shell being exploited?
Yes, attempts are real, and they started early.
Amazon’s honeypot network recorded an exploit attempt on 17 October, four days before the flaws were public. More followed on 21 October from different infrastructure with different payloads, which points to more than one group. A security vendor reported attacks hours before the fix shipped. Cloudflare described attempt volume climbing from thousands in the hours before the announcement into the millions afterward.
Here is the honest part. Based on available reporting, researchers testing the public exploit code found that none of it actually achieves code execution. Most attempts fail or crash the target instead. No confirmed compromise has been published.
That is a reason to patch quickly, not a reason to relax. Working exploit code for a flaw this widespread tends to arrive, and when it does, the exposed machines will not get a warning.
Public and fake proof of concept code
GitHub is filled with repositories claiming to exploit PHP2Shell. Some were built on theories their own authors later withdrew. Researchers also found fake exploits and prank malware posted as the real thing.
If you need to test, use an isolated lab and assume anything you download is hostile.
Someone was attacking it 4 days early.
The fix was moved up by a day after the CVE details leaked. By then a honeypot had already caught an attempt that nobody could explain.
Researchers hand both flaws to the PHP security team.
The team acknowledges the reports and starts building fixes.
A honeypot records an exploit attempt while the flaws are still secret.
CVE records circulate online before any patch exists.
PHP releases ahead of schedule. Attack volume climbs within the hour.
From private report to public exploitation was 58 days, and the last 4 of those were spent with attackers already probing.
Sources: PHP Foundation advisories, Amazon threat intelligence, Recorded Future, watchTowr
Timeline: how this unfolded
- 24 August 2026: Researchers report both flaws privately to the PHP security team.
- 21 September 2026: PHP acknowledges the reports and begins work on fixes.
- 17 October 2026: A honeypot records the first known exploit attempt, with the flaws still secret.
- 20 October 2026: CVE details leak online. PHP announces an emergency release for the next day, a day earlier than planned.
- 21 October 2026, 13:52 UTC: The fixes ship. Government agencies across the US, UK, EU, Germany, Australia, Japan and the Netherlands issue warnings the same day.
Why websites went offline
Hundreds of sites went dark on 21 October while their owners patched. Nintendo, the Charité hospital group in Berlin, the OBS Project, and the monitoring service Oh Dear were among them. Several governments pulled public services down as a precaution.
That looks dramatic until you read the PHP advisory, which says plainly that no configuration change fully fixes these flaws. Config tweaks reduce the odds. They do not close the hole.
So if you couldn’t patch within the hour, you had to choose between staying exposed and going dark. A lot of teams picked dark.
What to do next
- Find every PHP instance you own. Check odd ports, subpaths, appliances, and container images, not only your main web servers. Port 9000 is worth a look, since that is PHP-FPM’s default.
- Update to the fixed release for your branch: 8.2.35, 8.3.36, 8.4.27, or 8.5.12. On 7.4, 8.0, or 8.1, take your distribution’s patched package.
- Confirm the fix is really in there. Distribution packages often carry the patch under an older version number, so read the changelog and check that both CVE numbers are named.
- Restart every PHP worker. Installing a package does not change a process that is already running. Restart PHP-FPM, Apache, and LiteSpeed. For containers, rebuild on a fixed base image and redeploy.
- Treat exposed servers as leaky. If a machine was reachable before you patched, assume secrets in memory may have gone out. Rotate database passwords, API keys, and session signing keys, then look for signs of compromise.
- For anything you cannot patch today, cut off its internet access until you can.
How Secure.com helps
The slow part of PHP2Shell was never the patch command. It was finding every server running PHP, deciding which ones to touch first, and proving afterward that the fix actually took.
Secure.com’s AI Teammates do that work inside the limits your team sets, with people approving anything that changes a production system.
- The Infrastructure Security Teammate maps where PHP runs across your estate, including appliances and forgotten domains that scans miss.
- Exposure is ranked by what an attacker can actually reach, not by score alone, so the internet-facing mod_php box moves ahead of the internal one.
- Patch and restart work runs inside approved scope, and anything consequential waits for a human to say yes.
- Every action keeps its record, so the audit trail is ready without a second round of evidence gathering.
- The Red Teammate goes back and tests whether the fix holds, which turns “we patched it” into something you can show a board.
Start with one teammate.
Frequently asked questions
Who discovered PHP2Shell?
Is PHP2Shell in the CISA KEV catalog?
Can PHP2Shell leak passwords without running code?
Is Apache mod_php more at risk than PHP-FPM?
How many servers are still exposed?
Keep reading
How a Microsoft Word zero-day was exploited before the patch arrived. The same pattern readers just lived through: attacks landing before a fix existed.
Continuous attack surface management. The hard part of PHP2Shell was finding the PHP nobody remembered owning, an attack-surface problem.
