PHP2Shell: Critical on Paper, Hard in Practice

When details of two critical PHP vulnerabilities leaked on 20 October 2026, the comparisons to Log4Shell came within hours. The headline numbers invite it: a 9.2 CVSS score, no login required, and a flaw in the engine that runs most of the web. But severity on paper and difficulty in practice are different things. This article looks at why PHP2Shell is far harder to exploit reliably than the bugs it is compared to, how it stacks up especially against Heartbleed and Log4Shell, and why a convincing proof of concept says so little about what an attacker can do to your server.

PHP2Shell has made really big news in the past days, because it is pre-authentication remote code execution in the PHP engine itself, but turning it into a dependable exploit is much harder than it was for Log4Shell, and harder than getting useful data out of Heartbleed. The trigger is cheap. The hard part is the second half: the attacker must place attacker-shaped data into freed memory on the same worker, at the right moment, on a heap layout they can only partly see.

• Difficulty depends on the deployment. Apache mod_php in prefork mode is the setup where PHP and several vendors validated full code execution, while Sansec's testing found that public exploits failed…