PHP releases emergency patches for two critical PHP2Shell flaws

This is a new development in a story we reported earlier: CERT-EU warns of critical PHP flaws CVE-2026-109618 and CVE-2026-109619.

PHP maintainers released emergency out-of-cycle patches on Oct. 21, 2026, for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, affecting the core PHP engine. Each flaw carries a CVSS score of 9.2 out of 10 and lets unauthenticated attackers execute code on web servers running affected installations.

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Only PHP 8.2 and newer versions receive patches, leaving roughly half of PHP websites on unfixed older releases, and PHP 8.1 and older versions no longer receive updates from the project.

The PHP project supplied minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1, and administrators running PHP 7 or earlier should migrate to a fixed release. Every PHP version released in the past decade, back to version 5.4, is affected by at least one flaw.

Wiz Research, working with Calif and OpenAI, identified the vulnerabilities using AI tools including Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Wiz found the first flaw on Aug. 19, 2026, confirmed unauthenticated remote code execution against Drupal on Aug. 20 and against WordPress on Aug. 21, then reported both to the PHP security team on Aug. 24. PHP acknowledged the reports on Sept. 21 and began developing a coordinated fix. OpenAI said Calif researchers used its tools to find the PHP bugs two months before disclosure through the Patch the Planet program.

News of the flaws leaked Tuesday, a day before the scheduled update, after Calif and Wiz flagged them in August using AI tools and PHP kept the details confidential. Cloudflare CTO Dane Knecht said the company observed early attacks targeting the vulnerabilities before patches shipped. watchTowr head of threat intelligence Jake Knott said his firm saw exploitation attempts using AI-assisted proof-of-concept tools, though no successful exploitation had occurred to date. “Whilst nobody has been successful to date, we don’t expect that will last long,” Knott said.

The Record reported that hundreds of websites were taken offline on Wednesday as administrators responded to the warning and that Nintendo and other large organizations took services offline while addressing the bugs. Deutsche Welle reported that authorities in the European Union, United States, Germany, Japan, Australia, the United Kingdom and the Netherlands issued warnings and that several governments took websites offline before patches arrived; France took the Paris Police Prefecture website and local government pages offline, Germany’s government IT service took down PHP sites, Belgium’s Foreign Ministry blocked its online presence, and the Dutch cybersecurity agency acted as a precaution. Deutsche Welle also reported that the Wikimedia Foundation took down multiple systems as a precaution.

The PHP security team identified Apache mod_php as the highest-risk setup because an unauthenticated request can trigger the attack before application code runs. Researchers verified CVE-2026-109618 achieving remote code execution on Apache mod_php with standard input and memory caps, and separately confirmed mod_php and PHP-FPM attacks, though a suitable application operation is required for PHP-FPM exploitation.

The flaws arise from memory corruption when PHP requests end abnormally, leaving corrupted internal state that later requests can reuse. CVE-2026-109618 grants remote code execution as the web worker account via an out-of-memory corruption chain. CVE-2026-109619 enables unauthenticated heap use-after-free, memory disclosure, and remote code execution with web worker privileges.

Exploitation gains the web request process’s permissions, exposing application files and credentials, but not automatic full server administrator rights. Running multiple workers reduces the success rate per request but does not remove the vulnerability.

The vulnerabilities can expose sensitive process memory including passwords, authentication tokens, API keys and certificates. Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla using a single exploit script named php2shell, and separately demonstrated unauthenticated reading of passwords, tokens and API keys from PHP process memory. Even a simple Hello World application on an affected PHP version can be vulnerable because exploitation does not depend on application code flaws.

Using WordPress or Laravel does not automatically mean a site is vulnerable; administrators must check the running PHP version and configuration. VirusTotal estimates show over 5.1 million PHP hosts exposed online, with roughly 3.8 million having at least one port open. Estimates of PHP’s share of all websites range from 69% to 80% depending on the source.

Cloudflare deployed web application firewall rules against known PHP2Shell exploitation vectors and made them available to all customers including free users. Wiz Sensor version 1.0.12768 can automatically terminate processes exhibiting PHP2Shell exploitation behaviors through a built-in response policy.

Temporary mitigations include setting memory_limit to -1, limiting post_max_size, disabling session upload progress, and on PHP 8.5 disabling fatal error backtraces, then restarting workers. PHP maintainers warned that no configuration change blocks every attack path and only full patches provide complete remediation. PHP core developer Gina Peter Banyard said no mitigations would fully block attacks and only official patches provide permanent defense.

Users of the rpms.remirepo.net repository should switch to distribution packages or build PHP from source because the repository will not have updates available. Administrators should back up, test in staging, prepare a rollback, and verify site display, login and form submission after updating.

The UK National Cyber Security Centre urged organizations to update PHP immediately or disconnect systems until patched. Sophos official Don Smith said any vulnerable system that cannot be patched should be isolated from the internet until secured. Computer forensics expert Hal Pomeranz said many embedded installations will never be patched, creating a long tail for this vulnerability. Detectify researcher Joviane Jardim said organizations often only learn about a forgotten PHP server when an attacker finds it.

Detectify researcher Joviane Jardim said attackers are compiling lists of PHP servers by version and will compare patched and unpatched code as soon as fixes are public. Jardim said most attackers can build a working exploit in under an hour using AI, so exploitation waves should follow patch release.

OpenAI said it worked with PHP and other companies to test fixes, prepare guidance and coordinate the response with infrastructure providers. Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel and others helped prepare guidance and out-of-the-box mitigations. Wiz believes PHP2Shell could mark a turning point for the AI era similar to Heartbleed and Log4Shell. Wiz reported four exploitable bug instances under the two CVEs, plus other tracked and likely untracked variants that the patch eliminates.

Japan’s IPA issued an alert on Oct. 21, 2026 titled “[Request for Advance Preparation] Regarding the Scheduled Release of PHP Security Releases.” CERT-EU issued an alert regarding the PHP vulnerabilities.