The Vulnerability That Lets Attackers Walk Into Your Server Without Knocking

No password. No login. No warning. Just a request to your server and an attacker is running their code on it.

That is what PHP2Shell makes possible. Here is everything you need to know.

What is PHP2Shell ?

PHP2Shell is the nickname for two critical vulnerabilities discovered in PHP, the programming language that powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and millions of custom web applications all run on PHP.

Both vulnerabilities, CVE-2026–109618 and CVE-2026–109619, carry a CVSS v4.0 score of 9.2. That puts them in the critical tier, one step below the maximum possible score of 10.

PHP released emergency patches on October 21, 2026. By then exploitation had already been happening for four days.

CVE-2026–109618: The Messy Kitchen

Imagine PHP is a chef working in a kitchen. When the kitchen runs out of ingredients in the middle of cooking, the chef panics and abandons the counter mid-recipe. The counter is left in a messy, incomplete state.

An attacker figured out how to trigger that panic deliberately. They can force PHP to run out of memory at exactly the right moment, leaving request memory in an uninitialized state. Then they manipulate what is sitting in that messy memory region to run their own code.

In technical terms: PHP uses a mechanism called longjmp() to handle fatal errors including out-of-memory conditions. When an OOM error fires before PHP finishes setting up a request, longjmp() jumps out of the normal flow and leaves memory partially uninitialized. An attacker who can trigger OOM conditions reliably can exploit that window to achieve remote code execution.

CVSS v4.0 : 9.2 Critical.

CVE-2026–109619: The Forgotten Notes

Same kitchen. The chef finishes one order and walks away. But they leave their notes on the counter instead of cleaning up. The next customer comes in, reads those notes, and changes what gets cooked for everyone else.

In PHP this happens because internal request state can survive after the memory behind it has been freed. In environments like PHP-FPM where the same worker process handles multiple requests, a later request can read or branch on that stale memory before PHP resets it. An attacker who controls what goes into that freed memory region can use this to run arbitrary code.

This is a use-after-free vulnerability. It is one of the most dangerous classes of memory bugs because the timing window is predictable and the impact is complete.

CVSS v4.0 : 9.2 Critical.

What an Attacker Can Do Once Inside ?

Both vulnerabilities give an attacker remote code execution. That means they can run any command on your server as if they were sitting at the keyboard.

What that looks like in practice:

Steal everything. Every database record, every customer email, every password hash, every file on the server.

Deploy ransomware. Encrypt your files and hold your website and data hostage.

Take your site down. Delete files, corrupt the database, or simply stop the server.

Use your server to attack others. Your web server becomes part of a botnet attacking other companies. You become the attacker without knowing it.

Who Is Affected ?

Every PHP installation serving web requests is potentially vulnerable. That includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Affected versions: PHP 5.4 through 8.5.11. That covers essentially every PHP version running in production today.

There is one important exception. PHP 8.1 and earlier versions have reached end of life. The PHP project will not release patches for them. If you are running PHP 8.1 or older, updating to a patched version is the only fix available to you.

The Timeline That Should Concern Everyone

October 17, 2026: Exploitation attempts detected. Nobody had gone public yet.

October 20, 2026: Details leaked ahead of the planned disclosure. PHP issued an advance warning.

October 21, 2026: Emergency patches released.

October 21, 2026: Cisco, Palo Alto Networks Unit 42, Rapid7, Qualys, and Tenable all published advisories within hours.

Palo Alto Networks Cortex Xpanse identified over 22.6 million potentially exposed instances. A viable public exploit was expected within days of disclosure.

Attackers had a four-day head start before defenders even knew what to look for.

What to Do Right Now

If you run PHP, check your version immediately.

Run this command on your server:

php -v

php -v

If you are on a supported version, update to one of the patched releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If you install PHP through your operating system's package manager, watch for vendor updates from your Linux distribution and apply them as soon as they arrive.

If you are running PHP 8.1 or older, patching is not an option. You need to upgrade to a supported version. The longer you wait, the higher the risk.

For SOC Analysts and Defenders

Even if you cannot patch immediately, there are steps you can take today.

For CVE-2026–109618, set per-worker cgroup memory limits on your PHP-FPM pools to reduce an attacker's ability to trigger OOM conditions reliably.

For CVE-2026–109619, setting session.upload_progress.enabled = Off in your PHP configuration reduces one of the known exploitation paths. Setting pm.max_requests = 1 in your FPM pool forces worker recycling after every request which clears stale memory, but it comes with a significant performance cost and should be treated as a temporary measure only.

Detection guidance: look for unusual spikes in PHP memory error logs, unexpected child processes being spawned from your web server processes, and outbound network connections from PHP worker processes. If your WAF vendor has released PHP2Shell signatures, enable them now.

From a vulnerability management perspective, treat this as a Patch Now priority. CVSS 9.2, confirmed pre-disclosure exploitation, and 22.6 million exposed instances puts it at the top of the queue above almost everything else you are tracking this month.

The SOC Analyst Perspective

PHP2Shell is a reminder of two things that come up constantly in security work.

First, the timeline between discovery and exploitation is shrinking. Attackers had working exploits before defenders had patches. By the time most organizations finish their patch cycle, the attackers have already been inside for days.

Second, end-of-life software is not a theoretical risk. Millions of servers running PHP 8.1 and older have no patch available and no option except a full version upgrade. Every month they stay on an unsupported version is another month of exposure to every future vulnerability as well.

Patching is not glamorous work. But it is the single most effective thing an organization can do to reduce its attack surface. PHP2Shell is proof of that.

Patch versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35

CVEs: CVE-2026–109618, CVE-2026–109619

CVSS: 9.2 Critical (both)

Sources: https://cert.europa.eu/publications/security-advisories/2026-018 ; https://www.php.net/index.php#2026-10-21-5