PHP2Shell: Two Critical PHP Flaws Let Attackers Hijack Web Servers Without a Password — and Exploits Are Already Out
On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow unauthenticated remote code execution. Every PHP version from 5.4 through 8.5.11 is affected, and Amazon saw exploitation attempts as early as October 17.
What Happened
Wiz Research found the flaws, dubbed PHP2Shell, in the PHP engine itself, independent of the application running on top of it. According to Wiz, they can let attackers take control of servers or read process memory that may hold passwords, authentication tokens, API keys and certificates. PHP powers WordPress, Joomla, Drupal and MediaWiki.
- CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may treat the invalid data as valid.
- CVE-2026-109619: request-owned internal state can survive after its memory is freed, and a later request on the same worker may use it.
Affected and Fixed Versions
| Branch | Fixed version | Source |
|---|---|---|
| PHP 8.5 | 8.5.12 | php.net |
| PHP 8.4 | 8.4.27 | php.net |
| PHP 8.3 | 8.3.36 | php.net |
| PHP 8.2 | 8.2.35 | php.net |
| PHP 8.1 and older | No official release (minimal source backports for 7.4, 8.0 and 8.1 only) | php.net |
Who Is at Risk
Per php.net, all PHP installations serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest with mod_php, where a demonstrated exploit fires before any application code runs. That includes WordPress sites and any web host that hasn't updated PHP.
Is It Being Exploited?
Amazon Threat Intelligence logged an attempt against its MadPot honeypots on October 17, four days before disclosure, and says PHP2Shell "is now being broadly exploited in the wild." Sophos corrected an earlier report on October 22: what it had called successful exploitation in customer environments was a small number of failed attempts. How many attacks have succeeded is not yet clear.
What to Do Now
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Per php.net and Amazon, upgrading is the only complete fix.
- On shared or managed WordPress hosting, ask your host whether PHP is patched. Linux distributions received the patches in advance.
- On PHP 8.1 or older, move to a supported version or ask your vendor for a backported fix.
- If you can't update right away, php.net lists steps that reduce exposure but don't make you safe: set
session.upload_progress.enabled=0and restart workers, lowerpost_max_size, and on PHP 8.5 setfatal_error_backtraces=0. - Check logs back to October 17, as Amazon advises: multipart uploads, PHP_SESSION_UPLOAD_PROGRESS, unusual PHPSESSID cookies, PHP worker crashes, and unexpected files or processes.
Timeline
| Date | Event | Source |
|---|---|---|
| Oct 17, 2026 | First exploitation attempt seen in Amazon's honeypots | AWS Security Blog |
| Oct 20, 2026 | PHP pre-announces a critical security release for the next day, 14:00 UTC | php.net |
| Oct 21, 2026 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released; CVEs published | php.net, Google Cloud |
| Oct 21, 2026 | Wiz publishes PHP2Shell research; proof-of-concept exploits appear within hours | Wiz, AWS |
| Oct 22, 2026 | Sophos corrects: only failed attempts seen in customer environments | Sophos |
FAQ: Frequently Asked Questions
What is PHP2Shell?
It's Wiz Research's name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.
Which PHP versions are affected?
All versions from PHP 5.4 through 8.5.11, according to Google Cloud and Wiz.
Which version should I update to?
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released by php.net on October 21, 2026.
Does PHP2Shell affect WordPress?
It can: the flaw is in PHP itself, not the application, and WordPress runs on PHP. The fix is for the server to run a patched PHP version.
Is it being exploited?
Amazon says it is broadly exploited and saw attempts from October 17. Sophos has confirmed only failed attempts.
Is there a workaround without updating?
Not a complete one. php.net lists measures that reduce exposure, but only updating fixes the problem.
See what America is searching today →
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now — php.net, 2026-10-21
- PHP2Shell: AI uncovers critical RCE vulnerabilities — wiz.io, 2026-10-21
- Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure — aws.amazon.com, 2026-10-21
- Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 — cloud.google.com, 2026-10-21
- Proof-of-concept exploit released for PHP vulnerabilities — sophos.com, 2026-10-22
- PHP vulnerabilities: Who's exposed — apnews.com