Urgent Alert: Critical PHP 'PHP2Shell' Vulnerabilities Demand Immediate Patching Across 70% of the Web

On October 21, 2026, the PHP project released emergency security updates to address two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws, collectively referred to as 'PHP2Shell,' affect the core PHP engine itself, making them particularly dangerous as they can be exploited before any application-level code even runs. Both vulnerabilities have been assigned a critical CVSS v4.0 score of 9.2, indicating a high potential for severe impact.

CVE-2026-109618: RCE via Out-of-Memory (OOM) Corruption. This vulnerability stems from how PHP handles out-of-memory conditions. Specifically, when PHP is interrupted during internal request data initialization due to an OOM event, it can leave partially initialized data behind. The subsequent request cleanup process then incorrectly treats this invalid data as valid, leading to memory corruption. An attacker capable of forcing a PHP worker to its memory limit with a specially crafted malicious request can trigger this interrupt and achieve remote code execution.

CVE-2026-109619: RCE via Stale Global State. The second flaw involves PHP's internal state management. Request-owned internal state can persist even after its backing memory has been freed. A subsequent request handled by the same worker might then utilize this stale state before the normal initialization process can reset it. This use-after-free vulnerability also paves the way for unauthenticated remote code execution.

Both vulnerabilities are dangerous because they are 'pre-authentication' and 'pre-application code' flaws. This means an attacker doesn't need to be logged into a website or interact with specific application logic; the malicious request is processed directly by the vulnerable PHP engine, allowing for potential server takeover.

The implications of PHP2Shell are staggering. PHP powers an estimated 70% of the world's websites and web applications, including popular content management systems like WordPress, Drupal, and Joomla. This widespread adoption means a vast portion of the internet was, and potentially still is, vulnerable.

Upon disclosure, governments and organizations worldwide initiated emergency patching efforts. Countries including the UK, Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Belgium, and Japan reported taking various government services, banks, and airlines offline as a precautionary measure. The FBI's cyber division issued a warning, recommending that operators take websites offline if immediate patching wasn't feasible.

The PHP security team released fixed versions on October 21, 2026, urging immediate updates. The patched versions are: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It is crucial to note that older, unsupported PHP branches, specifically PHP 8.1 and earlier (including PHP 5.x, 7.x), will NOT receive official patches. Organizations running these end-of-life versions face a significant dilemma: they must either upgrade to a supported, patched version or implement robust compensating controls and prepare for potential exploitation.

The urgency was amplified by reports of in-the-wild exploitation attempts even before the official patches were widely available. Amazon's threat intelligence unit identified exploitation attempts as early as October 17, four days prior to public disclosure, and Cloudflare observed millions of exploitation attempts within hours of the public announcement.

Perhaps one of the most compelling aspects of the PHP2Shell saga is the significant role played by Artificial Intelligence in its discovery. Security researchers at Wiz, in collaboration with OpenAI and cybersecurity firm Calif, utilized a mix of AI models to identify and help remediate these vulnerabilities. Notably, Google's Gemini 4 Argon model made an invaluable contribution to finding the vulnerability, developing exploits, detecting attacks, and validating the patches.

The use of frontier AI models like GPT-5.6 Sol and Gemini 4 Argon allowed researchers to achieve in a week what might have previously taken a world-class team months of work. This highlights a burgeoning trend where AI is becoming an increasingly powerful tool in the hands of security researchers, capable of rapidly sifting through vast amounts of code to identify subtle, long-standing flaws that human eyes might miss. Some of these PHP flaws had existed undetected for over a decade.

This development ushers in a new era for vulnerability research, where AI can accelerate the discovery of critical bugs. However, it also presents a double-edged sword: as security researchers leverage AI for defense, malicious actors are likely to adopt similar techniques for offensive purposes. The rapid discovery and subsequent leak of PHP2Shell details before patches were fully deployed serve as a stark reminder of the accelerating pace of cyber threats and the critical need for swift, coordinated responses from the open-source community and security vendors alike.

Given the severity and widespread nature of the PHP2Shell vulnerabilities, immediate action is paramount. Developers and system administrators should prioritize the following steps:

• Update PHP Immediately: Apply the latest security updates to your PHP installations. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. There are no complete mitigations other than updating.
• Address End-of-Life PHP Versions: If you are running PHP 8.1 or older, these versions will not receive official patches. You must urgently plan to upgrade to a supported PHP version (8.2 or newer) or acquire backported packages from your distribution or LTS vendor if available. Without this, your systems remain highly vulnerable.
• Rebuild Container Images: For applications deployed via container images (e.g., in Cloud Run, App Engine Flexible, or custom runtimes), ensure you rebuild your images with the patched PHP versions and redeploy them.
• Monitor for Exploitation: Actively monitor your PHP applications and server logs for any signs of suspicious activity that could indicate exploitation attempts. Look for unexpected process exits, unusual memory usage, or unauthorized file access.
• Review and Apply WAF Rules: While not a complete mitigation, Web Application Firewalls (WAFs) can provide an additional layer of defense. Cloudflare, for instance, developed mitigations for PHP2Shell in the hours before public announcements. Consult your WAF provider for updated rulesets.
• Stay Informed: Keep a close eye on official PHP security advisories and trusted cybersecurity news sources for any further updates or emerging threats related to these vulnerabilities.

The rapid response required for PHP2Shell highlights the ongoing challenges in maintaining secure software in an interconnected world, especially with the increasing involvement of AI in both offense and defense.