PHP2Shell: How a Hacker Could Turn a PHP Bug Into Remote Code Execution

Imagine finding a door that nobody knew was open

Imagine you are a security researcher investigating a website.

You check its login page. You look at its APIs. You test its access controls. Everything seems reasonably secure.

But then you discover something interesting.

Before the website even checks whether a request is allowed, the PHP runtime processes that request. If the runtime itself contains a serious vulnerability, the application's login system might never get a chance to protect it.

This is the idea behind PHP2Shell.

On October 21, 2026, PHP released security updates for two critical vulnerabilities, CVE-2026–109618 and CVE-2026–109619. Both were rated 9.2 under CVSS v4.0 and could potentially allow remote code execution without authentication. Source: Official PHP release announcement

Let's look at the problem from a hacker's perspective.

1. First, the hacker looks for the weakest layer

When investigating a target, an attacker does not always start with the website's login page.

They may first ask a few questions.

• Is the website running PHP?
• Which PHP runtime version is deployed?
• Is that runtime exposed to requests from the internet?
• Does it contain a known vulnerability?
• Can an unauthenticated request reach the vulnerable code?

Why does this matter?

Because a vulnerability in the underlying runtime can affect more than one application.

Imagine a building with several offices. Each office has its own lock, but all the offices depend on the same faulty main entrance.

Improving the office locks does not repair the entrance.

Similarly, securing an application's login system does not automatically fix a vulnerability in the software processing requests before login.

The attacker's first question is not always "Can I break the login?" Sometimes it is "Can I bypass the application layer entirely?"

2. What makes PHP2Shell interesting?

PHP2Shell involves two different memory safety problems.

To understand them, you do not need to be an expert in C, C++, or PHP internals. You only need to understand how programs manage memory.

Think of memory as a workspace.

When software processes a request, it needs temporary space to store information. Once that information is no longer needed, the software must clean up the workspace correctly.

Problems occur when the software loses track of what it has stored, fails to initialize something properly, or continues using memory that is no longer valid.

That is where these vulnerabilities become interesting to security researchers.

3. CVE-2026–109618: What if the program runs out of memory?

Imagine a program maintaining a list.

Before adding a new item, it needs enough space to store it. Now imagine the program updates its internal record to say that the item exists, but the memory allocation fails.

The record and the actual data no longer agree.

Later, the program tries to clean up the list. It trusts its internal record and attempts to process an item that was never properly created.

That is the basic idea behind the memory handling problem reported for CVE-2026–109618.

How would an attacker think about this?

An attacker looking at this class of bug would ask:

1. Can an external request influence the program's memory usage?
2. Can that request cause an allocation to fail at a sensitive point?
3. Does the program leave behind inconsistent state after the failure?
4. Does later cleanup trust that inconsistent state?
5. Can the resulting memory corruption be turned into something more serious?

Notice that the questions build on one another.

Making a program run out of memory is not automatically remote code execution. The security problem arises when the failure leaves the program in an unsafe state, and that state can be exploited.

According to Datadog Security Labs, researchers reproduced a path in which a specially constructed HTTP POST request reached the vulnerable PHP processing logic before application code executed.

That finding is important because it shows why an ordinary application login check might not stop this attack path.

Read the technical analysis from Datadog Security Labs.

4. CVE-2026–109619: What if the program remembers something it should have forgotten?

Now imagine a web server that handles thousands of requests.

To improve performance, it may reuse a worker process rather than starting a new process for every visitor.

A worker handles one request, cleans up its temporary data, and then handles another request.

That sounds efficient. But it creates an important responsibility.

The worker must not carry invalid references from an earlier request into later processing.

Consider a simple analogy.

You borrow a library book, return it, and then someone else checks it out. If you still have an old record claiming that the book belongs to you, that record no longer reflects reality.

Software can make a similar mistake with memory.

A use-after-free happens when a program continues accessing memory after that memory has been released or is no longer valid for its original purpose.

CVE-2026–109619 concerns a PHP state management problem that can leave stale references in certain request processing situations.

What would the attacker investigate?

A researcher would look at questions such as:

1. Does the affected worker retain state between requests?
2. Can an error interrupt the normal cleanup process?
3. Can a later request encounter stale state?
4. Can that invalid access be influenced in a security-relevant way?

The last question matters most.

A use-after-free is a vulnerability class, not a guarantee of code execution. The exact conditions required to exploit it depend on the affected implementation.

This is why a responsible technical article should distinguish the existence of a memory safety problem from the details of a working exploit.

5. From a memory bug to remote code execution

So how can a memory problem become remote code execution?

Here is the high-level picture.

Stage 1: Reach the vulnerable runtime.

The attacker identifies a PHP service that exposes a vulnerable request processing path.

Stage 2: Trigger the vulnerable condition.

The request causes the runtime to encounter the relevant memory handling or state management problem.

Stage 3: Influence the resulting failure.

In a successful exploit, the attacker must do more than trigger an error. They must influence how the program handles the corrupted or invalid state.

Stage 4: Reach a security-critical operation.

If the memory corruption can be controlled sufficiently, the attacker may be able to redirect execution or cause an unintended function to be called.

Stage 5: Execute commands on the server.

If all the necessary conditions are satisfied, remote code execution may be possible.

This is the difference between discovering a crash and discovering a serious exploit.

A crash proves that something went wrong. Remote code execution means the attacker has found a way to turn that failure into control over program behavior.

The exact exploit mechanics differ between vulnerabilities. The sequence above is a conceptual model of memory corruption exploitation, not a claim that every stage applies identically to both PHP2Shell CVEs.

6. What could an attacker do after successful exploitation?

Remote code execution is dangerous because it can give an attacker the ability to run commands with the permissions of the compromised process.

Depending on the server's configuration, this could potentially allow the attacker to:

Read accessible data. Application configuration files, database credentials, API keys, and other secrets may be exposed if the PHP process can access them.

Modify application files. An attacker may attempt to change files or install persistent access mechanisms if filesystem permissions allow it.

Investigate the surrounding environment. The compromised process may be able to reach internal services or other resources, depending on network controls.

Attempt further compromise. If the server has excessive permissions or access to other systems, the initial foothold could become a starting point for additional attacks.

None of these outcomes is automatic. The actual impact depends on the privileges of the PHP process, operating system protections, network restrictions, and the attacker's ability to exploit the vulnerability successfully.

But this is why unauthenticated remote code execution is treated as a serious security issue.

7. Can a firewall or login page stop the attack?

This is where defenders need to be careful.

A firewall or web application firewall can sometimes block suspicious requests. However, a rule that protects a particular application route may not help when the vulnerable code runs before the application handles the request.

Datadog's research specifically reports that application-level authentication cannot prevent the demonstrated PHP2Shell attack path.

There is another common mistake: assuming that disabling one PHP feature completely resolves the problem.

The PHP security announcement says that there are no complete mitigations and that updating is the only safe choice.

For defenders, the priority should therefore be straightforward.

1. Identify the actual PHP runtimes serving requests.
2. Check the relevant vendor security advisories.
3. Apply the appropriate fixed releases or vendor-supplied security updates.
4. Restart or replace affected workers and redeploy updated containers.
5. Investigate suspicious activity if the systems were exposed while vulnerable.

The fixed upstream releases include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older unsupported branches require special attention because they may not receive upstream patches.

Use the official PHP security announcement to verify the correct remediation for your environment.

8. What should a penetration tester learn from this?

For penetration testers, PHP2Shell is a reminder that web security doesn't begin or end with application endpoints.

A thorough assessment should also consider the underlying technology stack.

That includes runtime versions, exposed services, configuration, software lifecycle, and whether security updates have been applied.

It is also important to distinguish between three different findings:

A vulnerable version: The installed software may be affected by a published vulnerability.

A reachable vulnerability: The vulnerable code path can be reached in the target's actual configuration.

A demonstrated exploit: Testing has established that the vulnerability can produce the claimed security impact under the tested conditions.

These are not interchangeable.

A good report explains the evidence for each conclusion and avoids claiming remote code execution merely because a version number looks vulnerable.

Test only systems you own or have explicit authorization to assess.

Final thoughts

From an attacker's perspective, PHP2Shell highlights a simple principle.

Sometimes the weakness is not in the website's business logic. It is in the runtime that processes requests before the application gets involved.

CVE-2026–109618 highlights the danger of inconsistent state after memory allocation fails. CVE-2026–109619 highlights the danger of stale state during request processing.

Both demonstrate why error handling, memory management, and request lifecycle management are important parts of software security.

For defenders, the practical lesson is to verify exposure and apply the official security updates.

For researchers, the lesson is to understand the full path from a programming mistake to a security impact, and to support every technical claim with evidence.

A bug is a starting point. Understanding how it can affect a real system is what turns it into meaningful security research.