PHP2Shell: Understanding the Critical Remote Code Execution Vulnerabilities

1. Introduction

PHP is one of the most widely used server-side scripting languages in web development. It powers websites, content management systems, APIs and several enterprise applications.

But what happens when a vulnerability exists not in the application built using PHP, but in PHP itself?

In October 2026, two critical security vulnerabilities in the PHP runtime were publicly disclosed. Collectively known as PHP2Shell, these vulnerabilities introduced a serious security risk by potentially allowing unauthenticated remote attackers to execute arbitrary code on vulnerable systems.

The vulnerabilities are:

• CVE-2026–109618
• CVE-2026–109619

Both vulnerabilities received a CVSS score of 9.2, indicating critical security implications.

What makes PHP2Shell particularly concerning is that exploitation does not necessarily require an attacker to authenticate to the application. The vulnerabilities affect the underlying PHP runtime, meaning even applications with secure application-level code may remain exposed if they run vulnerable PHP versions.

This article explores the technical background, vulnerability mechanisms, potential impact and defensive measures associated with PHP2Shell.

2. What Is PHP2Shell?

PHP2Shell is the collective name given to two critical vulnerabilities discovered in the core PHP runtime.

These vulnerabilities involve memory-management weaknesses during PHP request processing.

At a high level, they involve two different problems:

1. Improper handling of memory when an out-of-memory condition occurs.
2. Incorrect handling of internal global state that can continue referencing memory after it has been freed.

Both conditions can potentially result in memory corruption and remote code execution.

Unlike traditional application-level vulnerabilities, PHP2Shell affects the underlying runtime responsible for processing PHP requests.

Consequently, the security of an individual PHP application does not automatically protect it from these runtime-level vulnerabilities.

3. Understanding the Two CVEs

3.1 CVE-2026–109618 — Out-of-Memory Corruption

The first vulnerability involves improper handling of out-of-memory (OOM) conditions.

PHP uses memory-management mechanisms to allocate and release memory while processing incoming requests.

During certain error-handling scenarios, PHP uses longjmp() to exit the current execution context when an out-of-memory condition occurs.

The problem arises when the interrupted execution leaves internal state partially initialized.

During subsequent request-cleanup operations, PHP may interact with this incomplete state.

This can result in memory corruption.

Security implications:

• Potential remote code execution.
• Memory corruption during request processing.
• Possible process instability and crashes.
• Potential compromise of the PHP worker process.

The important point is that an error-handling mechanism intended to recover from memory exhaustion can become part of the attack surface when internal state is not handled correctly.

3.2 CVE-2026–109619 — Stale Global State and Use-After-Free

The second vulnerability involves a memory-safety issue known as Use-After-Free (UAF).

To understand this vulnerability, we first need to understand how memory allocation works.

When a program allocates memory, it reserves space to store information.

Once that memory is no longer required, the program releases it so that it can be reused.

A Use-After-Free condition occurs when a program continues accessing memory through a reference after the allocated memory has already been released.

In PHP's case, certain internal global variables can temporarily reference request-specific memory.

Under particular circumstances, these references may not be properly reset.

As a result, subsequent requests handled by the same worker may encounter stale references to previously freed memory.

This creates an opportunity for memory corruption and potentially remote code execution.

Security implications:

• Unauthorized memory access.
• Potential disclosure of sensitive process memory.
• Memory corruption.
• Potential remote code execution.

This vulnerability demonstrates why correctly managing memory references is essential in software that processes multiple requests.

4. Why Is PHP2Shell Particularly Dangerous?

One of the most concerning aspects of PHP2Shell is its potential for unauthenticated exploitation.

An attacker may not need a valid application account to target a vulnerable PHP runtime.

Additionally, the vulnerabilities exist within PHP's core request-processing mechanisms rather than a particular application's business logic.

This means that simply securing login pages, database queries or application endpoints may not eliminate the underlying risk.

The risk also extends beyond traditional websites.

PHP may be embedded in:

• Web applications.
• Content management systems.
• Network appliances.
• Administrative interfaces.
• Third-party software products.
• Container images and managed application environments.

Organisations therefore need to identify PHP installations even when PHP is not immediately visible in their primary application architecture.

5. Potential Impact

Successful exploitation could have serious consequences depending on the affected environment and the privileges available to the PHP worker.

Remote Code Execution (RCE)

An attacker may execute arbitrary code within the security context of the vulnerable PHP process.

This could potentially provide an entry point for further system compromise.

Sensitive Information Disclosure

PHP process memory may contain sensitive information, including:

• Authentication tokens.
• API credentials.
• Session-related information.
• Application secrets.
• Other request-related data.

Memory disclosure can therefore create additional security risks.

Server Compromise

If remote code execution is achieved, attackers may attempt to:

• Deploy malicious scripts.
• Establish persistence.
• Access application files.
• Extract sensitive information.
• Explore internal network resources.

The actual impact depends on the server configuration, process privileges and surrounding security controls.

Service Disruption

Memory corruption can also cause PHP workers or related services to crash.

Repeated exploitation attempts may affect application availability and service reliability.

6. A Conceptual Attack Scenario

Consider a web server running an outdated PHP runtime.

The server processes incoming HTTP requests through its PHP execution environment.

An attacker identifies that the server is running a vulnerable PHP version.

At a high level, a potential attack scenario looks like this:

Step 1 — Target Identification

The attacker identifies an internet-facing application that uses a vulnerable PHP runtime.

Step 2 — Crafted Request

The attacker sends specially constructed HTTP requests intended to trigger vulnerable memory-handling behaviour.

Step 3 — Memory Corruption

The vulnerable PHP runtime encounters the problematic memory-management condition.

Step 4 — Exploitation

Under suitable conditions, the memory corruption can be leveraged to achieve remote code execution.

Step 5 — Post-Exploitation

An attacker who successfully obtains code execution may attempt further activities depending on the privileges and environment.

This is a conceptual representation of the attack chain, not a reproduction of either CVE's exploitation procedure.

7. Affected PHP Versions

The PHP security releases published on 21 October 2026 addressed these vulnerabilities.

The first fixed releases for the supported branches are:

PHP BranchFirst Fixed VersionPHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

Versions earlier than the corresponding fixed release are affected.

PHP 8.1 and older branches are also affected, but they are no longer supported by the PHP project. Organisations using these versions should check for vendor-provided security backports or migrate to a supported release.

It is important to remember that updating a CMS or web application does not necessarily update the PHP runtime underneath it.

8. Detection and Defensive Measures

PHP2Shell highlights the importance of securing the runtime environment in addition to application-level security.

Organisations should consider the following measures.

1. Identify PHP installations

Inventory all systems running PHP, including web servers, containers, appliances and third-party products.

2. Apply security updates

Upgrade to the appropriate fixed PHP release or apply vendor-provided security backports.

3. Monitor suspicious activity

Review PHP and web server logs for unusual requests, memory errors, worker crashes and unexpected process activity.

4. Inspect server processes

Investigate unexpected child processes launched by PHP or web server workers.

5. Review persistence mechanisms

Look for unfamiliar PHP files, scheduled tasks, accounts or other unexpected modifications.

6. Follow official security advisories

Monitor PHP security announcements and relevant vendor updates.

Temporary configuration changes may reduce exposure to particular attack paths, but they should not be considered a replacement for applying the security patches.

9. Conclusion

PHP2Shell demonstrates that vulnerabilities in the underlying software runtime can introduce significant risks even when individual applications follow secure development practices.

The two vulnerabilities, CVE-2026–109618 and CVE-2026–109619, highlight the security implications of improper memory handling, particularly during error recovery and request processing.

For security professionals and developers, this incident reinforces an important lesson:

Application security does not end with application code. The runtime, dependencies and underlying infrastructure are equally important parts of the security boundary.

Understanding how these vulnerabilities work is an important step towards identifying, analysing and preventing similar security issues.

In the next part of this research, I will explore PHP2Shell through a controlled laboratory environment, investigate the vulnerable request-processing behaviour and document a practical proof-of-concept demonstration.

This article is intended for educational and defensive security research.