PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet

The cybersecurity community is facing a serious warning with PHP2Shell, the collective name for two critical memory-safety vulnerabilities in PHP's core engine.

According to published security research, these vulnerabilities could enable unauthenticated Remote Code Execution (RCE) on vulnerable systems, potentially allowing attackers to execute commands with the privileges of the affected web server.

And the potential reach? Reports suggest that up to 70% of websites could be affected.

But what makes these vulnerabilities so dangerous? Let's break it down. 👇

🔍 Understanding PHP2Shell

PHP2Shell refers to two critical vulnerabilities:

🔴 1. CVE-2026–109618 — Out-of-Memory (OOM) Corruption

A specially crafted multipart POST request can trigger memory exhaustion during request parsing. Under vulnerable conditions, memory corruption during cleanup may create an opportunity for remote code execution.

🔴 2. CVE-2026–109619 — Use-After-Free (UAF)

This vulnerability involves stale global state and freed memory. Under specific conditions, a worker process may retain references to memory that has already been released, potentially allowing an attacker to influence execution.

Both vulnerabilities carry a reported CVSS v4.0 score of 9.2/10.

These are not ordinary application-level bugs. They involve PHP's underlying runtime, making them especially important for security and infrastructure teams to investigate.

🌐 Why Should We Care About the 70% Figure?

PHP powers a substantial portion of the web, including content management systems, e-commerce platforms, APIs, and custom web applications.

A vulnerability in the PHP runtime can potentially affect applications even when their developers haven't introduced a specific vulnerable code pattern.

However, the 70% figure should not be interpreted as meaning that 70% of all websites are confirmed vulnerable. Actual exposure depends on the PHP version, deployment configuration, and whether the affected runtime is present.

This is a reminder that application security goes beyond reviewing application code. The underlying runtime and infrastructure matter just as much.

⚠️ What Could an Attacker Do?

Successful exploitation could potentially allow an attacker to:

• Execute arbitrary code with the web server's privileges.
• Access sensitive application data and configuration files.
• Steal credentials or secrets accessible to the compromised process.
• Establish persistence or use a compromised server as a stepping stone.
• Attempt further privilege escalation, depending on the environment.

The actual impact depends on the system's configuration, permissions, and security controls.

🛡️ What Should Security Teams Do?

If you're responsible for PHP-based applications or infrastructure, prioritize the following actions:

✅ 1. Identify exposed systems: Inventory PHP versions across production servers, containers, staging environments, and legacy applications.

✅ 2. Apply official security updates: Upgrade to the appropriate patched PHP release for your branch. Confirm the exact fixed versions through official PHP security announcements.

✅ 3. Review threat telemetry: Examine web server, reverse proxy, WAF, and application logs for suspicious multipart POST requests, unusual error patterns, and unexpected worker restarts.

✅ 4. Investigate potential compromise: Look for unexplained processes, modified files, suspicious outbound connections, and unexpected changes to application accounts.

✅ 5. Reduce attack surface: Run PHP workers with least privilege, isolate workloads, restrict unnecessary outbound traffic, and avoid exposing unnecessary services.

✅ 6. Validate remediation: Confirm that production workloads are actually running patched binaries. Updating a package does not guarantee that every container or long-running worker has been restarted.

Important: If patching is delayed, temporary mitigations may reduce exposure, but they should not be treated as a replacement for applying the official fixes.

🧠 The Bigger Lesson for Security Researchers

PHP2Shell highlights an important reality: vulnerabilities in widely deployed software components can have consequences far beyond a single application.

For penetration testers, vulnerability researchers, and AppSec engineers, it reinforces the importance of understanding:

🔹 Memory-safety issues 🔹 Runtime internals 🔹 Remote Code Execution attack surfaces 🔹 Vulnerability management and asset discovery 🔹 Detection engineering and incident response

As AI-assisted security research evolves, defenders must also improve their ability to validate findings, prioritize risk, and deploy fixes quickly.