Vulnerability
PHP2Shell: the PHP bug that let attackers in before your app woke up
Two critical flaws in PHP let attackers run code without logging in. This is the story of how they were found, leaked, patched and exploited, and what you should do now. Topic: Security
4 min read
On October 21, 2026, a large part of the web went quiet. Government portals, game servers, forums and the Internet Archive went offline or into maintenance mode. The cause was not a hack of any one company. It was a pair of flaws in PHP itself, now known as PHP2Shell.
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in the PHP interpreter:
- CVE-2026-109618 ("RCE via OOM corruption"): an out-of-memory handling flaw.
- CVE-2026-109619 ("RCE via stale global state"): a use-after-free caused by state shared between requests on the same worker.
Both are rated 9.2 (critical) on CVSS 4.0, and both can allow unauthenticated remote code execution. Estimates put PHP on about 69% of sites whose server-side language is known, which is why this mattered so much.
The story: from a forgotten bug to a global scramble
2024: the warning nobody acted on. An audit of PHP, funded by Germany's Sovereign Tech Agency and done by Quarkslab, spotted the out-of-memory problem. No exploit path was found, and the team could not agree on a fix, so it stayed.
August 2026: AI changes the math. Calif researcher Ryan Austin, working with OpenAI's Patch the Planet program, reported an unconditional RCE with the same root cause on August 11. Wiz independently found its own bugs soon after and reported them on August 24. The name "PHP2Shell" came from Wiz. Both teams used frontier AI models to turn a decade-old weakness into a working exploit.
September 2026: the fix takes shape. OpenAI reported more attack vectors on September 18, and the PHP Foundation began a coordinated fix on September 21.
October 17: first signs. Amazon's honeypot network recorded an exploitation attempt four days before public disclosure.
October 20: the leak. PHP pre-announced an emergency release. The same day, Calif mistakenly published a video of its proof of concept, and a post appeared on Hacker News.
October 21: patch day. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day earlier than planned. Chainguard published fixed images hours before the release, which let attackers study the patch. Agencies including the NSA and CISA advised taking sites offline if they could not patch quickly.
October 23: a third flaw. PHP disclosed CVE-2026-115560, a session upload-progress issue that needs an unusual configuration.
Impact and exploitation
Cloudflare reported thousands of exploit attempts in the 10 hours before the announcement. That rose to millions after it. Imperva counted 482,342 requests against 21,998 sites in 103 countries in the first 24 hours.
On October 24, honeypots run by researcher Adel Karimi recorded 35 successful shell executions on PHP 8.4.26 under Apache mod_php. On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog. Security firm Dream also reported an attack chain that paired PHP2Shell with a Linux kernel flaw, Fragnesia (CVE-2026-46300). Dream says the chain rooted 25 PAN-OS firewall and management servers. Tenable did not verify that report.
Is it as bad as Log4Shell?
Not in the same way. Tenable's week of testing found that exploits had to be tuned to each target's PHP build, memory layout and process manager. Five exposed test sites were not compromised. That makes mass exploitation harder than Log4Shell.
The exception is systems that share one build, such as network appliances. One tuned exploit can reach all of them. Treat this as serious, but patch internet-facing appliances and management interfaces first.
How to fix it
- Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, and restart every PHP worker.
- Replace end-of-life PHP (8.1 and earlier). Use a vendor backport if one exists.
- Ask vendors whether their products embed PHP, including panels, appliances and CMS plugins.
- Put a WAF in front as a backstop, not a replacement for patching.
- Hunt for compromise. Look back at least to October 17 for worker crashes, out-of-memory errors and odd child processes.
FAQ
Which PHP versions are affected? All versions from 5.4 through 8.5 are affected. Only 8.2 to 8.5 have official fixed releases.
Can my application's login protect me? No. The flaw triggers during request handling, before your application logic runs.
Do I need to take my site offline? Agencies advised it only if you cannot patch quickly, especially on end-of-life PHP.
How Codebumble can help
We audit and patch PHP stacks, containers and hosting setups. Contact us for a quick exposure review.
Sources
- NCSC-NL PHP2Shell tracker
- Cloudflare Blog
- TechTarget timeline
- Tenable: why one exploit doesn't work everywhere
- Unit 42 threat brief
- BleepingComputer: CISA confirms exploitation
- Datadog Security Labs
- Wikipedia: PHP2Shell
Last updated: October 30, 2026.
#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #RCE #CyberSecurity #InfoSec #PatchNow #CISA #WebSecurity #AppSec #Codebumble