What is PHP2Shell? Two critical RCE bugs in PHP

What the PHP project says is at risk

php.net’s 21 October advisory says every PHP installation that serves web requests is in scope, naming PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project considers the risk highest for mod_php, where it says a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Application-level hardening does not help on that path.

The same advisory says only an update is a complete solution. Interim settings reduce exposure to specific paths and do not make an installation safe. CISA’s wording matches that operational conclusion: patch immediately, and take PHP-based systems offline if you cannot update, including PHP 8.1 and earlier.

How the two bugs differ

Both sit in code nearly every request touches. The PHP Foundation describes CVE-2026-109618 as out-of-memory handling that can leave partially initialized internal data, which PHP later treats as valid. It describes CVE-2026-109619 as a fatal error at the wrong moment leaving internal state pointed at memory from an earlier request, so a later request on the same worker uses freed memory. Wiz and Cloudflare also describe memory disclosure — process memory that can hold secrets from other requests — alongside remote code execution and denial of service. This page does not repeat exploit construction.

• CVE-2026-109618OOM corruption. CVSS v4.0 9.2. GHSA-w8hw-w9fx-j79w.
• CVE-2026-109619Stale global state. CVSS v4.0 9.2. GHSA-6wmf-4rv5-p3rp.

Which versions

The ranges in circulation are not identical, and flattening them would invent a precision the vendors have not published. The PHP security team’s oss-security note for CVE-2026-109618 lists PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. Those are the branches that got release packages. The project also said 8.1 and older are out of upstream support, and that it published minimal source backports for 7.4, 8.0, and 8.1.

Wiz says every PHP version released in roughly the last decade, back to 5.4, is affected by at least one of the issues. Google Cloud says 5.4 through 8.5.11. Cloudflare says PHP 5.4 or later. watchTowr’s FAQ, first published 20 October before the vendor advisory, says PHP 5, 7, and 8. Expel says the backports are evidence that 7.4, 8.0, and 8.1 are affected, and that PHP has not said whether 7.3 and older are affected. Expel’s practical advice is to assume any end-of-life PHP serving web traffic is at risk. The version table keeps these statements side by side.

Exploitation: attempts, not a confirmed breach count

• AWS says a MadPot honeypot recorded an exploitation attempt on 17 October 2026, four days before disclosure, from an IP associated with a commercial anonymization network. AWS says further attempts and proof-of-concept exploits appeared on 21 October, some hours before the embargo lift, and that it is unclear whether any would have succeeded on real systems. After the patch, AWS describes broad exploitation attempts.
• Cloudflare says it observed attack traffic after details leaked ahead of the official release, and that attackers mutated payloads while trying to get past WAF rules. Cloudflare does not, in the post we reviewed, publish a count of successful compromises.
• watchTowr says it is observing active exploitation attempts of both CVEs. SecurityWeek reports that watchTowr had seen attempts around the time patches landed and had not observed successful attempts.
• CISA’s 21 October alert says CISA had not observed exploitation as of publication, and still urges immediate patching.
• Expel, writing with a status time of 21 October 2026 at 20:00 UTC, says it had not confirmed exploitation in any customer environment, that Cloudflare had reported early attacks without saying whether any succeeded, and that neither CVE was in the CISA KEV catalog. watchTowr’s FAQ, updated 22 October, still marks CISA KEV as not listed. Tanium likewise says a 21 October 14:04 UTC KEV update listed neither CVE. This site did not re-download the catalog on 22 October.

Public proof-of-concept code is reported by AWS, the Canadian Cyber Centre (as open-source reporting that a PoC is available), and Expel. Expel adds that circulating code is unverified and that some of it may be malicious. We do not link to or reproduce it.

Scale, carefully

Wiz’s headline figure is that PHP powers a large majority of websites; Cloudflare’s post says almost 70 percent. That is a share of sites, not a count of exploitable servers. The internet-facing host estimate repeated in The Record is about 5.1 million IP addresses in a VirusTotal analysis, with the caveats on the home page. ThreatCluster, describing that VirusTotal scan, says roughly four in five fingerprinted PHP servers do not volunteer a version string.

PHP is also embedded in appliances and hosting panels. The UK NCSC points at an NCSC-NL inventory of products with a PHP dependency as a starting list, not a complete census. Google Cloud says its own platform is not vulnerable as a platform, while customers who run PHP on App Engine, Cloud Run, GKE, or Marketplace images may be, and it describes which of those it was patching automatically.

Discovery, as the participants describe it

Wiz Research says the flaws had been present for more than a decade and that frontier models made an exploit chain practical. Google Cloud credits Wiz and says Gemini 4 Argon contributed to discovery, exploit development, detection, and patch validation. The Record reports that the PHP Foundation said an AI review first sparked alarm in August 2026, while signs had surfaced in 2024. Those are attribution claims from the organizations involved. They do not change the remediation: upgrade.