PHP2Shell Leak Forces Early Patch, Putting Most of the Web at Risk

The Decade-Old PHP Bug That AI Finally Made Easy to Exploit

The patch was due Thursday, October 22. A leak on Tuesday changed that. On October 20, the two CVE IDs began circulating online with the wrong release time and an inflated CVSS score of 10.0, so the PHP project moved the release up by a day. Fixed builds landed on October 21.

Researchers independently traced multiple memory-safety bugs in the PHP engine to a shared root cause in how PHP handles out-of-memory errors. They are tracked as CVE-2026-109618 and CVE-2026-109619, rated up to CVSS 9.2. Because the bugs live below the application layer, even a “Hello World” app on an affected version can be vulnerable.

The worst case is Apache with mod_php, where an unauthenticated request can reach code execution with default settings before any application code runs.

What Happened?

Researchers found two memory-safety bugs inside the PHP engine itself. They are now tracked as CVE-2026-109618 and CVE-2026-109619, and both carry a CVSS score of 9.2. Because the bugs live below the application layer, a site with perfectly clean code can still be taken over.

Nearly every PHP release since version 5.4 is affected. Details slipped out publicly on October 20, a day before the embargo was set to lift, so the PHP team pulled its release forward. Fixed builds landed on October 21. Attack attempts showed up within hours.

What’s the Impact?

PHP powers roughly 69% of the websites whose server-side language is known. A working attack hands an intruder code execution as the web worker account, plus the ability to read passwords, session tokens, and API keys straight from server memory. One honeypot network recorded an exploit attempt on October 17, four days before anyone outside the disclosure group was supposed to know.

That detail is the real story here. The vulnerable code sat untouched for more than a decade because chaining it into a working exploit was brutally hard. The research team says frontier AI models collapsed that effort from months to days. The same compression now works for whoever is reading the patch notes.

How to Avoid This

• Patch today to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
• Check unsupported builds, since minimal source backports exist for 7.4, 8.0, and 8.1
• Hunt for PHP worker processes spawning shells or download tools
• Rotate credentials, tokens, and keys that lived in server memory
• Do not lean on the session upload progress toggle as your only cover

Indicators of Compromise

Published indicators are thin so far, and most of what is circulating is behavioral rather than a clean hash list. Threat researchers have shared a small set of source addresses tied to early exploit attempts, along with request-level and host-level signals worth hunting. One caution before you reach for a block rule: those addresses belong to shared anonymization infrastructure, so treat a hit as a reason to investigate, not proof of compromise.

Your Patch List Is Long. Your Attacker’s List Is Short.

Every exposed server is now in a footrace between a patch window and an exploit that already works. PHP2Shell matters. The harder question is which of your assets an attacker can actually reach today.

• Red AI Teammate attacks your own exposed surface and confirms what is genuinely exploitable, not just what scanners flag
• Cloud Security AI Teammate maps exposed PHP workloads so the patch list follows reachability, not CVSS alone
• AppSec AI Teammate routes the fix to the owner who can ship it and validates the build afterward
• SOC AI Teammate hunts the behavioral signals in your logs and assembles the case before anyone pages you
• Every consequential action waits for your approval, and every step leaves an evidence trail you can show an auditor

Attack. Harden. Prove. Repeat.