PHP has rolled out patches for Two serious vulnerabilities Named PHP2Shell that can provide attackers with unconfirmed remote code execution (RCE).
The problem is tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-2026-109619 (stale global state) and has a CVSS score of 9.2. For both, RCE is confirmed in Apache with mod_php.
“Both problems are in the parts of PHP that almost every application is exposed to: memory management and error handling. Their centrality in PHP is what makes both vulnerabilities serious, and also difficult to fix,” said the PHP Foundation.
Textiles Both are included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 have been released.
Before a fix arrived, however, proof-of-concept (PoC) exploits targeting two security flaws began to circulate.
Pre-attack space management company WatchTowr said it saw the first exploit attempt in the wild hit its sensors around the same time the patch landed, but did not observe any successful attempts.
“While no one has been successful so far, we don’t expect it to last long,” said WatchTowr CEO Jake Knott.
Other companies reported seeing exploit attempts, including before the spots landed.
“We are now seeing php2shell being exploited in the wild. Most of the attacks we have observed are exploiting PHP’s progress upload path, and we expect more exploit paths to appear before and after the fix ships,” Hadrian report A few hours before the solution was released.
Patchstack And Cloudflare Also noticed the exploitation attempt before that. Vega saw Try to exploit In the wild that leveraged PoC public.
According to PHP maintainers, all PHP installations that handle web requests are vulnerable to exploits, “including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed”.
Where patching is not possible, users can take measures that “reduce exposure to specific attack paths but do not make the installation secure,” the PHP Foundation said.
Two PHP2Shell flaws affect almost all PHP versions back to version 5.4. They can also be exploited to read sensitive process memory, which may contain credentials, API codes, and other secrets.
“This is a minefield for hackers. They can hijack real websites to take advantage of the website’s reputation to do things like phish people, serve malicious software from trusted channels; the opportunities are endless,” said Malwarebytes’ global head of fraud and AI research Shahak Shalev.
Frontier AI releases PHP2Shell
Wiz, along with OpenAI And Californiadiscovered the vulnerabilities in August and kept them until patches were developed and distributed across the ecosystem.
“These findings rank as one of the most serious vulnerabilities discovered in PHP, and arguably in the history of the software. The underlying flaws have been around for decades, but demonstrating their exploitation requires an exceptionally complex chain, at the edge of what human researchers can perform,” Wiz noted.
Calif explained that the initial OOM flaw in PHP was discovered in 2020, and then rediscovered during a PHP audit in 2024. Because the exploit was not proven, however, it was not updated. Courtesy of the frontier AI model, OOM’s vulnerability can be better analyzed and eventually become RCE.
The OOM issue with RCE was independently reported by Calif and OpenAI on August 11. More attacks reported by OpenAI and Wiz later.
“Reports from Calif, OpenAI, and Wiz have made the full impact of the OOM issue clear, and as of August 11th, fixing it has become a top priority for the PHP Foundation’s security team,” PHP Foundation Record.
According to Wiz, which published a Technical details about PHP2ShellCVE-2026-109618 and CVE-2026-109619 group four memory security issues in PHP, but do not cover all variants. Both tracked and untracked variants exist, Internet Security Tools said.
Because the security flaws are in PHP itself, they affect 70% of all websites in the world, independent of their CMS.
“PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even if the application code itself is safe,” said Wiz.
According to the PHP Foundation, AI has helped fix more PHP vulnerabilities than ever before, with 15 new CVEs published since July 1.
Quick leak, early warning
The PHP2Shell flaw was planned for a public release on October 22, but the information was leaked online on October 20, and the foundation decided to push the patch a day earlier.
It also publishes warnings before announcing that critical bugs require immediate attention. Several Internet security companies have published similar warnings, noting that exploitation of the flaw can begin immediately.
A video showing the PoC in action was mistakenly published ahead of the release schedule. It revealed some more details about the two vulnerabilities and “contributed to the acceleration of the development of various PoCs”.
Mitigation recommendations that the PHP Foundation provides to critical infrastructure organizations may also be leaked. Six hours before the release of the patch, Chainguard released a build image containing the fix it received in advance.
“Any attacker can now study the solution in binary form while other PHP users are waiting for the release. This ignores weeks of work by many parties on the coordinated release,” said the PHP Foundation.
As part of a coordinated effort, Cloudflare Deploy protection against PHP2Shell vulnerability nine hours before public release.
“Emergency PHP security updates show how quickly organizations can be forced to respond when critical vulnerabilities become public. Before issuing a patch, teams should already know where PHP is running, who can authorize quick changes, and how they’ll verify the updates work. They also need to check that attackers have access to those systems before they can fix them,” said SimSpace co-founder and CTO Lee Rossey.
Related: Memory account for Chrome’s new security fix 353
Related: High-severity flaw exploited in three days as Ransomware dominates Q3: Rapid7
Related: Chinese AI models write more hackable code when told it’s for US contractors
Related: AOMEI Backupper is compromised in short-term supply chain advertising
