October 23, 2026
PHP2Shell: How Two Critical PHP Vulnerabilities Triggered a Global Security Alert
Part 1: Introduction, Background, and Why PHP2Shell Matters
By ExploitDNA
5 min read
1. Introduction
On October 21, 2026, the cybersecurity community faced a major security incident involving one of the technologies that powers a significant portion of the internet: PHP.
Several organizations reportedly took their websites and online services offline as concerns about two critical vulnerabilities in PHP spread. Reports described precautionary shutdowns affecting government services, online platforms, and other internet-facing systems. The situation raised an important question: how could two vulnerabilities in a widely used programming language create so much concern across the internet?
The vulnerabilities were disclosed under the name PHP2Shell and assigned two CVE identifiers: CVE-2026–109618 and CVE-2026–109619. Both were rated Critical, with CVSS v4.0 scores of 9.2. According to the PHP security advisories, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on an affected server.
What makes PHP2Shell particularly concerning is that the vulnerabilities exist in PHP's core runtime rather than in a particular website, plugin, or application. This distinction significantly expands the potential attack surface. An application may be fully updated at the application level and still be exposed if the underlying PHP runtime remains vulnerable.
The incident also highlighted a growing development in cybersecurity: the role of artificial intelligence in vulnerability research. According to Wiz Research, AI-assisted analysis played an important role in identifying these vulnerabilities and demonstrating their exploitability.
This article examines what PHP2Shell is, why the vulnerabilities matter, how the underlying bugs work, how AI contributed to their discovery, and what organizations should do to assess and reduce their exposure.
Sources: Wiz Research — PHP2Shell, Official PHP2Shell advisories.
2. What Is PHP, and Why Is It So Important?
PHP is a server-side programming language commonly used to build dynamic websites and web applications. Unlike static websites, which primarily deliver pre-existing HTML files, PHP-based applications can process user input, authenticate users, retrieve information from databases, manage sessions, and generate responses dynamically.
Consider a typical login process. When a user enters a username and password, the browser sends a request to the server. The server-side application processes the submitted information, checks the relevant records, and determines whether the user should be authenticated. PHP can perform these operations as part of the application's backend.
The same principle applies when a user submits a comment, uploads a file, updates an account, or interacts with an online store. PHP code can handle these operations and communicate with databases and other services.
PHP is widely deployed across the web, including in popular content management systems and web applications such as:
- WordPress — a widely used platform for websites, blogs, and online businesses.
- Drupal — a content management system used by organizations and government institutions.
- Joomla — a platform for building and managing websites.
- MediaWiki — the software behind Wikipedia and other collaborative knowledge platforms.
PHP is also used in custom applications, educational portals, government websites, hosting environments, and many smaller business websites.
Wiz Research describes PHP as powering approximately 70% of websites worldwide. That figure should be understood in the context of the report's methodology and the websites for which the underlying server-side technology can be identified; it does not mean that every website on the internet runs PHP.
Nevertheless, PHP's extensive adoption makes vulnerabilities in its core runtime particularly important. A security flaw affecting an individual plugin may put a subset of applications at risk. A flaw in the language runtime can potentially affect many different applications that depend on the same vulnerable component.
This is the central reason PHP2Shell attracted so much attention.
Source: Wiz Research — PHP2Shell.
3. Understanding PHP2Shell: Two Vulnerabilities, One Major Security Concern
PHP2Shell is the collective name used for two critical vulnerabilities discovered in PHP's core request-processing and memory-management behavior.
The vulnerabilities are:
CVE identifierVulnerability typePotential impactCVE-2026–109618Out-of-memory handling and memory corruptionRemote code executionCVE-2026–109619Stale internal state and use-after-free behaviorRemote code execution and potential memory exposure
Both vulnerabilities received CVSS v4.0 scores of 9.2, placing them in the Critical severity category.
The most important aspect of PHP2Shell is that successful exploitation does not necessarily require an attacker to possess a legitimate account on the affected website. The PHP project warned that unauthenticated remote code execution was possible under affected configurations.
Remote code execution, commonly abbreviated as RCE, is one of the most serious classes of security vulnerability. It means that an attacker may be able to cause a target system to execute code of their choosing remotely.
Depending on the privileges of the affected PHP process and the surrounding environment, successful exploitation could allow an attacker to:
- Access sensitive information available to the PHP process.
- Modify application files or website content.
- Install malicious code or establish persistence.
- Attempt to access credentials and other systems reachable from the compromised host.
- Disrupt services or use the affected server as a starting point for further attacks.
These are potential consequences, not proof that every vulnerable server was compromised. Actual impact depends on the deployment, exploitability, process privileges, and the attacker's objectives.
The vulnerabilities are also different from ordinary application-level bugs. A website might validate input carefully, require authentication for sensitive functions, and use security plugins. Those controls are useful, but they do not automatically correct a memory-safety flaw inside the PHP runtime itself.
The underlying runtime must be patched independently of the application.
Sources: PHP2Shell operational information — NCSC-NL, PHP2Shell advisory — University of Toronto.
4. Why a Vulnerability in PHP Can Affect So Many Different Websites
To understand the scope of PHP2Shell, it helps to distinguish between an application's code and the runtime that executes it.
Imagine a website built using WordPress. WordPress contains its own application logic, themes, and plugins, but it also depends on PHP to execute its backend code.
The same principle applies to Drupal, Joomla, and custom PHP applications. Although these applications have different features and codebases, they can depend on the same underlying PHP runtime.
If a vulnerability exists in that shared runtime, the impact may extend across multiple otherwise unrelated applications.
For example, an organization could have:
- An updated WordPress installation.
- No known vulnerable plugins.
- Strong account passwords and multifactor authentication.
- A vulnerable PHP runtime serving requests to the application.
The first three controls do not guarantee protection against a vulnerability that can be triggered in PHP before the application's own code runs.
The PHP project specifically identified Apache deployments using mod_php as a particularly concerning case because an unauthenticated request could trigger exploitation before application code executed. Other PHP-serving environments, including PHP-FPM, CGI, FrankenPHP, and LiteSpeed, also required assessment, although the exact exploitation conditions differ.
This does not mean every PHP application is equally exploitable. The PHP version, server API (SAPI), configuration, extensions, and request-processing lifecycle all influence the practical attack surface.
The important takeaway is that securing a PHP application requires securing both the application and the PHP runtime on which it depends.
Source: Official PHP2Shell operational guidance — NCSC-NL.
5. Why PHP2Shell Became an Urgent Security Issue
The urgency surrounding PHP2Shell came from the combination of three factors.
First, the vulnerabilities affected a widely deployed technology. PHP is used across a large and diverse ecosystem of websites, making it difficult for organizations to assess their exposure without a reliable inventory of their PHP installations.
Second, successful exploitation could have severe consequences. Unauthenticated RCE can potentially allow an attacker to execute code without first obtaining a valid website account. Where exploitation is reliable, this substantially raises the risk to internet-facing systems.
Third, the vulnerabilities required attention at the infrastructure level. Updating a website's CMS or removing a suspicious plugin is not sufficient if the vulnerable PHP runtime remains in place. Administrators and hosting providers needed to identify affected versions and apply the appropriate runtime updates.
These factors help explain why organizations may choose to restrict access to a service or temporarily take it offline while assessing exposure. However, a precautionary shutdown must not be confused with a confirmed compromise: an unavailable website does not, by itself, demonstrate that an attacker successfully exploited PHP2Shell.
The PHP project published patched releases on October 21, 2026, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations running older branches needed to consult the applicable vendor guidance, because support and patch availability vary across versions.
The immediate priority was therefore clear: identify affected systems, apply the appropriate security fixes, and investigate potentially exposed servers for evidence of compromise.
Source: PHP2Shell — NCSC-NL.
Part 2: We'll dive into the technical root causes behind PHP2Shell, uncovering how memory corruption and use-after-free bugs can turn seemingly small coding flaws into critical security vulnerabilities.