PHP2Shell: Two Critical Vulnerabilities That Could Let Attackers Take Over Web Servers

Imagine visiting a website, entering nothing, and doing nothing unusual, yet a hidden weakness in the technology running that website could allow an attacker to execute malicious code on its server. That is the kind of risk cybersecurity professionals are dealing with after two critical vulnerabilities in PHP were disclosed in October 2026.

The vulnerabilities, tracked as CVE 2026 109618 and CVE 2026 109619, have attracted serious attention because they can allow remote code execution without requiring the attacker to log in first. Security researchers have also reported proof of concept exploits, making it especially important for organizations to identify affected systems and apply security updates. The PHP development team released patched versions on October 21, 2026. The European Union Agency for Cybersecurity and other security organizations have urged organizations to take immediate action.

Sources: Official PHP security announcement and CERT EU security advisory.

As someone learning cybersecurity and exploring attacker behavior to become better at detection and defense, I find incidents like this particularly important to understand. They remind me that a website can have strong passwords, a security plugin, and a carefully designed login page, yet still be exposed because of a weakness in the underlying technology.

So what exactly happened, why should website owners care, and what can cybersecurity professionals learn from it?Let's break it down in simple language. First, What Is PHP and Why Does It Matter?

PHP is a programming language commonly used to build websites and web applications. When you visit a website, many things happen behind the scenes. The website may retrieve information from a database, process a form, manage your login session, or generate the page you see on your screen.

PHP can handle many of these tasks.

It is widely used in content management systems, business websites, online stores, and other web applications. WordPress, for example, relies heavily on PHP.

Think about a small business website that allows customers to create accounts, contact the business, or place orders. If the website uses PHP, the PHP runtime may be an important part of the technology processing those requests. This is why a vulnerability in PHP itself can be more serious than a problem affecting one particular website feature.

The weakness may exist below the application code, in the software responsible for processing requests in the first place. If that underlying component is vulnerable, updating the website's theme or changing a user password may not solve the problem. The actual PHP installation needs attention.

What Happened in October 2026?

On October 21, the PHP development team released security updates addressing two critical remote code execution vulnerabilities. Both vulnerabilities received a CVSS 4.0 score of 9.2, indicating a critical level of severity

They are:

CVE 2026 109618

This vulnerability involves improper handling of memory when PHP encounters an out of memory condition.

In simple terms, a program uses memory to store information while it operates. PHP also has mechanisms to stop processing when a request exceeds its configured memory limit. The problem is that an interruption during this process can leave internal request data in an unsafe state. Subsequent cleanup operations may then handle memory incorrectly. Under the right conditions, an attacker can potentially exploit this behavior to execute malicious code on the server.

CVE 2026 109619

This vulnerability involves stale internal state that can remain after memory associated with a request has been released. Imagine a program finishing one task but accidentally retaining an old reference to information from that task. If the program later uses that reference before the state is properly reset, it may operate on information that is no longer valid. This type of flaw can create opportunities for memory corruption and, in this case, remote code execution. Both vulnerabilities are serious because exploitation can happen before an attacker has authenticated to the application.

These are not simply cases of someone guessing a weak password or bypassing a website's login form. The vulnerabilities affect how PHP handles internal operations.

According to the official PHP advisory, the risk applies to PHP installations serving web requests, including PHP FPM, Apache with mod php, php cgi, FrankenPHP, and LiteSpeed.

The PHP team identified mod php as the highest risk configuration among those discussed.

Source: CERT EU technical analysis.

What Is Remote Code Execution, and Why Is It So Dangerous?

Remote code execution, commonly called RCE, is one of the most concerning vulnerability classes in cybersecurity. It means an attacker can cause a vulnerable system to execute code supplied or influenced by the attacker from a remote location. The attacker may not need physical access to the server or a legitimate account.

The exact impact depends on the vulnerability, the privileges available to the affected process, and the security controls surrounding the system. However, successful exploitation could allow an attacker to do things such as:

Access sensitive information.

An attacker may be able to access files, application configuration, or information available to the compromised process.

Install malicious software.

Depending on the privileges available, an attacker may attempt to establish persistence, install additional tools, or maintain access to the system.

Steal application credentials.

Configuration files and environment variables sometimes contain database credentials, API keys, or other secrets. If these become accessible, the attacker may be able to use them to reach other systems. Manipulate website content.

An attacker could attempt to modify files, inject malicious content, or use the website to distribute harmful material.

Move toward other systems. If the compromised server can communicate with internal databases, management interfaces, or other business systems, the attacker may attempt to expand the attack.

These are potential consequences, not proof that every vulnerable PHP server will suffer all of them. The actual damage depends on how the server is configured, what information it can access, and whether additional security controls limit the attacker's actions.

Still, the central lesson is clear.

A vulnerability that allows unauthenticated code execution can turn a weakness in one software component into a serious business security incident.

How Could an Attack Affect a Real Business?

Let's consider a fictional example. A small online store uses PHP to operate its website. Customers create accounts, browse products, and submit orders. The website connects to a database containing customer and order information.

The business owner assumes the website is safe because the administrator uses a strong password and two factor authentication. However, the server is running a vulnerable PHP version.

An attacker discovers that the server is exposed and identifies the vulnerable software. If the attacker successfully exploits the vulnerability, they may gain the ability to execute code within the affected server environment.

What happens next depends on the permissions and configuration. The attacker might attempt to access application secrets, inspect files, install additional tools, or reach the database. If the server has excessive permissions or unrestricted access to other systems, the potential impact becomes greater. The business could face service disruption, data exposure, unauthorized website changes, recovery costs, and damage to customer trust.

Notice something important about this example. The business did not necessarily have a weak password. The initial problem was an exposed software vulnerability.

This is why security cannot depend on one control alone. Strong authentication remains important, but it does not replace patch management, secure configuration, network segmentation, monitoring, and incident response.

How Can Organizations Control the Risk?

The most important step is to install the appropriate security update. The PHP development team released the following fixed versions for the two critical vulnerabilities.

PHP branch Fixed version

PHP 8.5 8.5.12

PHP 8.4 8.4.27

PHP 8.3 8.3.36

PHP 8.2 8.2.35

Organizations should verify the correct version and package for their environment using the official PHP security announcement and their operating system or hosting provider's guidance.

PHP 8.1 and older branches no longer receive standard security updates from the PHP project. Some vendors may provide backported fixes, so organizations should verify their specific package status rather than assuming that the displayed version number tells the entire story.

Here are the practical steps I would prioritize when reviewing a system for this kind of exposure.

1. Identify Every PHP Installation

Start by finding where PHP is actually running.

Do not check only the main website.

PHP may be installed on web servers, application servers, containers, cloud workloads, and systems managed by hosting providers.

Check the PHP version, deployment method, and whether the installation is exposed to incoming web requests.

For a system you administer, a basic command is:

php -v

This displays the PHP version associated with the command line environment. However, the command line version may differ from the version used by the website. A server could run different PHP versions for different applications or services. Therefore, administrators should also verify the PHP version used by their web server or hosting platform.

2. Apply the Security Updates

Upgrade affected installations to an appropriate fixed release.

If PHP is managed by a hosting company, contact the provider and ask whether the affected runtime has been updated.

If it runs in a container, update the relevant image and redeploy the application according to the organization's change management process.

After updating, verify the running version. Do not assume that downloading an update automatically means every production service is now using it. Also test the application to confirm that it continues to operate correctly. The PHP team has stated that there are no complete mitigations for these two critical vulnerabilities. Updating is the primary solution, so organizations should not treat a firewall rule or a web application firewall as a replacement for patching.

3. Reduce Exposure Until Patching Is Complete

Sometimes an organization cannot update a production system immediately because it needs testing, approval, or coordination with a vendor. That does not mean the team should simply wait and hope for the best. Where an affected system cannot be patched promptly, consider temporarily restricting access or isolating it from public networks until a fix can be applied and verified. Any temporary restriction should be based on the actual architecture and business requirements.

A web application firewall may provide an additional layer of protection against some attack patterns, but it cannot guarantee protection against every exploit.

For these vulnerabilities, exposure reduction should be treated as a temporary risk management measure, not a permanent solution.

4. Review Server Permissions and Secrets

Patching addresses the known vulnerability, but good security practices can limit the damage if another weakness is discovered later. Review the permissions assigned to the PHP process.

The application should not have unrestricted access to files, credentials, or administrative functions that it does not need. Keep secrets out of public directories and source code. Store them using appropriate secret management mechanisms, restrict access, and rotate exposed credentials.

Also review which internal systems the web server can communicate with. A public website usually does not need unrestricted access to every server on the organization's internal network.

5. Investigate Possible Exploitation

Updating the software is essential, but it does not automatically tell you whether someone exploited the system before the patch was installed. If the server was exposed while vulnerable, review the available security logs and telemetry.

Look for unusual child processes started by web server workers, unexpected outbound connections, suspicious file changes, new scheduled tasks, and unexpected changes to application files. Correlate web server logs, operating system events, endpoint telemetry, network records, and cloud activity where available.

If there is evidence of compromise, follow the organization's incident response process. Preserve relevant evidence, contain the affected system, investigate the scope of access, and rotate credentials that may have been exposed. Do not assume that a clean scan or a successful software update proves the system was never compromised.

What Can Cybersecurity Professionals Learn From This?

This is the part I find particularly valuable.

As I continue learning cybersecurity, I want to understand not only what a vulnerability does but also how defenders can identify exposure, recognize suspicious activity, and respond effectively.

A critical PHP vulnerability provides several useful lessons.

Lesson 1: Vulnerability Management Is More Than Scanning

A vulnerability scanner can help identify software versions and known weaknesses. But a scan is only one part of the process.

Security teams need to know which assets are exposed, which applications depend on them, who owns each system, and how quickly the organization can apply a fix.

A useful vulnerability management process connects discovery with remediation.

For example, if a security team discovers ten vulnerable web servers, it should prioritize systems that are publicly accessible, handle sensitive information, or support critical business operations.

The team should then track whether each system has been patched and verify the result.

Finding a vulnerability without resolving it does not reduce the risk.

Lesson 2: Think Beyond the Initial Exploit

When defenders investigate a potential RCE vulnerability, they should consider what an attacker might do after gaining code execution.

This does not mean assuming that every possible consequence occurred. It means developing a clear investigation plan.

Did the affected process launch unexpected commands?

Did it create files in unusual locations?

Did it attempt to access sensitive configuration files?

Did it establish new network connections?

Were there changes to accounts, permissions, or scheduled tasks?

These questions help security analysts investigate activity that could indicate post exploitation. The initial vulnerability explains how an attacker may gain access. Post exploitation analysis helps determine what happened next.

Lesson 3: Build Detection Around Behavior

One useful detection idea is to monitor for unusual child processes launched by web server processes. For example, a web server unexpectedly starting a shell, scripting utility, or system administration tool may deserve investigation. However, legitimate applications sometimes launch external processes, so a detection should consider the normal behavior of the environment.

A suspicious process is not automatic proof of exploitation, and the absence of that process does not prove that the system is safe. Analysts can improve their detections by correlating process creation with web requests, outbound network activity, file modifications, and other available telemetry.

This is where knowledge of both attacker behavior and defensive monitoring becomes valuable.

Lesson 4: Do Not Trust a Single Security Control

A firewall, endpoint detection system, web application firewall, or vulnerability scanner can each contribute to security. None of them should be expected to solve every problem independently, a layered approach is more resilient.

Patching reduces the known vulnerability. Network restrictions reduce exposure. Least privilege limits what an application can access. Monitoring helps identify suspicious behavior. Incident response provides a structured way to contain and investigate compromise.

If one control fails, other controls may still reduce the damage.

Lesson 5: Test Your Assumptions in a Safe Lab

Cybersecurity professionals should practice investigating vulnerabilities in environments they own or are explicitly authorized to test.

For this incident, a useful defensive lab could involve a deliberately vulnerable, isolated web application or a safe simulation of post exploitation activity.

The objective would not be to attack real websites.

Instead, it would be to understand normal web server behavior, collect process and network telemetry, build detections, and test whether those detections generate useful alerts.

A lab exercise could include the following activities:

1. Establish a baseline of normal web server processes and network connections.
2. 2. Generate harmless, controlled activity in the lab that resembles suspicious behavior.
3. 3. Collect relevant logs using a SIEM or endpoint monitoring tool.
4. 4. Create a detection for unexpected process execution by the web server.
5. 5. Investigate the alert and document what happened.
6. 6. Improve the detection to reduce false positives.

This approach helps turn a security headline into practical learning.

It also reinforces an important distinction: understanding a vulnerability and safely detecting its possible consequences are valuable skills even when you are not conducting offensive testing.

What About the Additional PHP Vulnerability Reported on October 23?

The situation developed further after the initial release.

CERT EU reported an additional vulnerability, CVE 2026 115560, on October 23. It concerns PHP's session upload progress feature and a potential remote code execution scenario involving an unusual application configuration.

The available advisory information indicates that this issue has a narrower configuration dependent scope than the two critical vulnerabilities discussed above. It requires separate attention, and organizations should consult the latest PHP advisory for the relevant mitigation guidance.

This is an important reminder that patching the first two vulnerabilities should not end the investigation into related security announcements.

Security teams should follow the official PHP security page and their software vendors for new information rather than relying only on the first article they read.

Source: CERT EU Security Advisory 2026 018.

• Final Thoughts:

The recent PHP vulnerabilities are a reminder that even widely used and actively maintained software can contain serious security weaknesses. The important question is not whether a technology is popular, trusted, or used by millions of websites.

The important questions are whether the system is affected, whether it is exposed, whether the available fix has been applied, and whether there is evidence of exploitation. For website owners, the immediate priority is to identify affected PHP installations, apply the appropriate security updates, and investigate suspicious activity where necessary.

For cybersecurity professionals, this incident offers an opportunity to practice vulnerability prioritization, threat hunting, process monitoring, incident investigation, and risk communication.

Personally, this is why I believe learning attacker behavior is useful for defensive security. When we understand how a weakness might be exploited, we can make better decisions about what to monitor, what to investigate, and what to fix first.

A vulnerability is not just a CVE number in a report. It represents a potential path to compromise, and defenders need to understand the system behind that number.

The takeaway is simple: patch quickly, verify carefully, monitor intelligently, and never assume that one security control is enough.

If you manage a PHP based website, check your runtime and hosting provider's advisory today. If you are learning cybersecurity, use this incident as a case study to practice how a vulnerability moves from public disclosure to remediation and detection. That is how we turn security news into practical defensive knowledge.

Disclaimer: This article is for educational and defensive cybersecurity awareness. Technical details and fixed versions can change as new advisories are published. Always consult the official PHP security announcements and your software vendor before making production changes.

Follow for more:-)