PHP2Shell: The PHP Bug That Could Hand Attackers Your Server

While I was learning about recent cybersecurity updates, I came across PHP2Shell, a serious vulnerability issue affecting PHP. What caught my attention was that attackers could run malicious code on vulnerable servers without even logging in.

The PHP team released security updates on October 21, 2026, and anyone using the affected versions should update as soon as possible. PHP powers a huge number of websites and web apps, so a security flaw in its core can put many systems at risk.

-> What Is PHP2Shell?

PHP2Shell refers to two critical vulnerabilities identified as:

• CVE-2026–109618: Related to out-of-memory handling and memory corruption.
• CVE-2026–109619: Related to stale internal state and use-after-free behaviour.

Both vulnerabilities have a CVSS v4.0 score of 9.2, which makes them critical. An attacker doesn't even need to log in to run code remotely on a vulnerable server. The problem isn't tied to one website or app. It's in the PHP runtime itself, so it's really important to find out which of your installations are affected.

-> How Do These Vulnerabilities Work?

1. CVE-2026–109618: Out-of-Memory Corruption

PHP manages memory while it processes requests. If a request runs out of memory, PHP may stop its normal execution. The trouble starts when this leaves some internal data only partly set up. During cleanup, PHP may handle that data the wrong way, which could lead to memory corruption.

Under some conditions, an attacker can exploit this behaviour to execute code on the affected server.

2. CVE-2026–109619: Stale Global State

This vulnerability involves internal data that can continue referencing memory even after that memory has been released.

If the stale reference is used before the relevant state is properly initialized again, PHP may access invalid memory. This is a type of issue associated with use-after-free vulnerabilities.In the right conditions, this can also lead to remote code execution.

->Why Is It So Worrying?

What makes PHP2Shell especially worrying is how much damage a successful attack can do. Here are the main risks:

• Remote code execution: An attacker may run code with the same permissions as the PHP process.
• Sensitive data exposure: Information stored in the process memory could be at risk.
• Website compromise: A vulnerable web app could become the way in for more attacks.
• Server security risks: Depending on the setup, attackers may try to reach other resources or find a way to stay on the server.

Security researchers have already shown working proof-of-concept exploits, and NHS England Digital believes future exploitation is highly likely. So it's important to fix this quickly.

->Which PHP Versions Are Fixed?

The PHP team released security fixes on October 21, 2026.

Any earlier release in these branches is affected. PHP 8.1 and older versions also need attention, but the PHP project no longer gives them regular security updates. Some vendors may offer backported fixes for them.

->How Can We Stay Protected?

Based on the advisories, here are the steps to focus on first:

1. Check your PHP version: Find out which versions are running on your web servers, apps, and containers.
2. Install the security updates: Upgrade to a fixed release or apply a verified patch from your vendor.
3. Review server exposure: Start with internet-facing systems, and look closely at any that can't be patched right away.
4. Monitor logs: Watch for strange requests, unexpected processes, suspicious outbound connections, and file changes nobody approved.
5. Check older installations: Systems running end-of-life PHP versions need extra care, since they no longer get regular updates from PHP.

Temporary configuration changes may reduce the risk from some attack paths, but they don't fully protect you. The best fix is to update to a fixed version.

-> What I learned

For me, PHP2Shell is a reminder that cybersecurity isn't only about securing application code. The technologies and runtimes underneath also need regular updates and monitoring.

For anyone in cybersecurity, it's a good example of why vulnerability management matters. Knowing how to find affected assets, read a security advisory, prioritize patches, and watch for suspicious activity are all important skills.

A vulnerability can turn into a much bigger problem when updates are delayed. Staying informed and acting quickly can make a real difference.

References

1. PHP Security Release Announcement
2. NHS England Digital — Critical Vulnerabilities in PHP (PHP2Shell)
3. The Hacker News: "PHP Issues Emergency Patches for Two Critical Flaws" https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
4. Itdaily: "PHP2Shell: Major PHP vulnerability actively exploited ahead of patch availability" https://itdaily.com/blogs/software/php2shell-bug-php/