PHP2Shell: When Two Critical CVEs Put PHP Servers at Risk

Breaking down the two vulnerabilities behind PHP2Shell, how they enabled unauthenticated remote code execution, their real-world implications, and how they were fixed.

It is interesting how everyone was shocked by the recent PHP breach. Many software developers have moved towards modern technology stacks, and PHP is sometimes overlooked or considered outdated.

But guess what? This vulnerability proved otherwise. It affected major organizations and reminded us that PHP is still a relevant programming language, powering a significant portion of the web.

Let's break down the two CVEs behind PHP2Shell, understand how the vulnerabilities worked, how they were exploited, and how they were eventually fixed.

Understanding PHP2Shell

PHP is one of the most widely used server-side programming languages. It powers a significant portion of the web, including platforms such as WordPress, Drupal and Joomla.

According to Wiz Research, PHP powers approximately 70% of websites.

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities:

Both vulnerabilities received a CVSS v4.0 score of 9.2.

What makes this particularly concerning is that the vulnerabilities existed within PHP's core engine, rather than being restricted to a particular PHP framework or application.

How did the vulnerabilites work?

Apparently there were 2 CVEs that were discovered that made up the php2shell.

First, we need to understand this 2 concepts:

• Out-of-memory (OOM): This happens when a program cannot allocate the memory it needs to continue executing an operation.
• Use-after-free: This is a memory-management vulnerability where a program attempts to access memory that has already been released.

CVE-2026–109618: Out-of-memory corruption

PHP uses an internal mechanism called longjmp() to interrupt execution when certain fatal errors, including out-of-memory conditions, occur.

The problem was that this interruption could happen while PHP was still initializing internal request data.

When PHP subsequently performed request cleanup, some routines could access memory that was not properly initialized.

An attacker could manipulate this condition to corrupt memory and eventually achieve remote code execution.

CVE-2026–109619: Stale global state

This vulnerability involved PHP retaining references to memory belonging to a previous request.

Even after that memory had been freed, certain internal global variables could still point to it.

When another request was processed, PHP could interact with this stale memory before the relevant state was properly initialized.

This created a use-after-free condition that researchers demonstrated could be developed into remote code execution.

The important distinction is that these were two different vulnerability mechanisms, although both involved PHP's memory-management and request-handling processes.

What was the potential impact?

The researchers demonstrated unauthenticated remote code execution against:

• WordPress
• Drupal
• Joomla

However, these were demonstration targets, not the only affected applications.

Other PHP-powered platforms could also be affected depending on their PHP runtime and deployment configuration.

Successful exploitation could allow an attacker to:

• Execute arbitrary commands on a vulnerable server.
• Access sensitive information stored in process memory.
• Steal credentials, authentication tokens and API keys.
• Establish persistence and potentially move further into an organization's infrastructure.

There have also been reports of exploitation against internet-facing firewall infrastructure.

For example, a report published by SecurityWeek on October 28 described attackers chaining PHP2Shell with a Linux privilege-escalation vulnerability to compromise firewall infrastructure associated with a US government-affiliated organization

How was it discovered?

This is another particularly interesting part of the story.

Wiz research discovered the vulnerabilities with assistance from AI models during security research.

The first vulnerability was discovered on August 19, 2026. Researchers subsequently demonstrated remote code execution against WordPress and Drupal before reporting their findings to the PHP security team on August 24.

The PHP team worked on developing a coordinated fix.

On October 20, information about the upcoming vulnerabilities began circulating publicly before the planned disclosure.

PHP subsequently moved its security release forward to October 21.

This is an interesting example of how AI-assisted security research can help uncover vulnerabilities that have remained hidden in widely used software for years.

How was it fixed?

On October 21, the PHP development team released security updates.

The patched versions were:

PHP administrators were advised to upgrade their installations.

Importantly, simply updating application code or installing a Web Application Firewall (WAF) is not a complete fix. The vulnerability exists in the PHP runtime itself.

Organizations should also:

• Identify all PHP installations, including those running in containers.
• Check the PHP version used by web servers and PHP-FPM workers.
• Upgrade to a patched, supported release.
• Restart affected services and workers.
• Investigate logs for suspicious requests and possible exploitation.
• Review unsupported PHP versions and plan migrations.

PHP's security advisory explicitly states that there are no complete mitigations that replace updating. PHP

Official technical reference: PHP Security Advisory — October 21, 2026