PHP2Shell Explained: Two Critical PHP Flaws Under Active Attack and How to Fix Them

Picture the simplest web page you can build in PHP. A “Hello World” with no login, no database, and no plugins. If it runs on a vulnerable version of PHP, attackers can exploit it. That is how The Hacker News summed up the PHP2Shell flaws: they sit in the PHP engine itself, not in any application on top of it.

Here is why that stings. For years, the web security playbook has been simple: keep WordPress updated, keep plugins updated, keep your developers honest. PHP2Shell sidesteps all of it. You can do everything right at the application layer and still have an exposed server because the weak spot is the underlying runtime.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2. PHP shipped fixes on October 21, 2026. On October 26, CISA added both to its Known Exploited Vulnerabilities catalog, which means attackers are using them in the real world, not just in research labs. Some organizations didn’t wait to see how bad it would get. Reports said Dutch government sites and the HR platform BambooHR took services offline as a precaution.

This guide covers what PHP2Shell is, who is exposed, how to patch, and what to do if you cannot patch today. We included only what PHP, CISA, and the security teams that tested these flaws have confirmed.

What Is PHP2Shell?

PHP2Shell is the name researchers at Wiz gave to a pair of vulnerabilities in the PHP runtime. The name points at the worst-case outcome: a path from a web request to a shell on your server.

The two flaws are different bugs with a similar flavor. Both involve PHP’s handling of a request that goes wrong partway through.

Think of a kitchen where an order is abandoned halfway through prep, and the next cook grabs the half-finished ingredients without checking them. Usually nothing happens. With the right planted ingredients, an attacker decides what gets cooked.

A second danger gets less attention. According to the researchers, an attacker can read memory from the PHP worker process without first gaining code execution. That memory can hold passwords, authentication tokens, API keys, and certificates from other requests. The researchers demonstrated this against applications they did not control, as The Hacker News reported.

Why PHP2Shell Is Different From a Typical Web Vulnerability

Most web attacks target something you installed, like a plugin or a forgotten admin panel. PHP2Shell targets the layer those things run on.

• It lives in the runtime, not your code. The flaws affect nearly every PHP version back to PHP 5.4, and the underlying code has been in PHP for more than a decade. A secure application on a vulnerable runtime is still exposed.
• It reaches every way PHP serves the web. PHP’s advisory says every installation that serves web requests is at risk, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
• Apache mod_php is the highest risk. PHP singled it out because an attacker can trigger it before any application code runs. PHP-FPM behaves differently because it shuts down a worker when a request fails early in setup. That makes it harder to attack, but PHP’s own analysis found paths on FPM too: for one flaw, FPM is susceptible, but no complete exploit has been shown, and for the other, code execution was shown on both mod_php and FPM, though the FPM route depends on an operation inside the running application.
• It hides in places you do not manage directly. According to NCSC-NL’s operational guidance, PHP is also embedded in appliances, network devices, and management interfaces. If a vendor controls that PHP, you wait on the vendor.

How We Got Here: A Timeline

The PHP Foundation called the stalled fix a structural failure of its own decision process and resources, and said it has since added staff and tooling. It is a candid admission, and a reminder that the software the web runs on is maintained by small teams.

The AI Angle: Why This Moved So Fast

The researchers say AI models helped turn these long-standing flaws into working exploits, letting one researcher do in about a week what would otherwise have taken a team months. Wiz’s team reportedly used models including Gemini 4 Argon and GPT-5.6 Sol alongside its own tooling. Calif also noted that models do not reliably start from obscure, twenty-year-old primitives on their own, so human knowledge of the target still mattered.

For defenders, the takeaway is the shrinking gap. When a flaw is found, weaponized and leaked within days, a monthly patch cycle is too slow for critical runtime bugs.

Is PHP2Shell Actually Being Exploited?

Yes, though the picture is more nuanced than the headlines.

• Attempts started on day one. Cloudflare saw attack traffic against its customers and watched attackers change payloads to get around its firewall rules. It called those rules a stopgap and urged administrators to patch.
• CISA confirmed exploitation. It has not disclosed which organizations were compromised, so the listing confirms active exploitation but not how many production systems were breached.
• Honeypots caught real activity. A researcher recorded attackers running code on unpatched PHP servers, then trying to reach external servers using PHP, curl, and wget, according to The Register. The honeypots used a favorable single-worker setup, so the results do not necessarily show how reliable the exploit is against production servers.
• Public exploit code exists, with limits. Rapid7 found each public proof of concept worked only against a specific mix of operating system, PHP version, and web server, and none appeared broadly reliable. It warned that a more portable technique could emerge at any time.

Are You Affected? A Quick Self-Check

• Find every PHP runtime serving web requests. That includes bare-metal servers, VMs, containers, and base images, plus anything a hosting provider runs for you.
• Check the version, but read it carefully. The vulnerable range is anything below 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on those branches, and everything older. On Linux, a distribution package can carry the fix under an old-looking version number, so check the package changelog for the CVE rather than trusting the version string alone. Debian’s security FAQ explains this approach.
• Identify how PHP is served. Apache mod_php is the highest-risk setup. FPM, FrankenPHP, LiteSpeed and php-cgi are all in scope.
• Look beyond your own servers. Hosting control panels, bundled PHP binaries, appliances, and vendor products can all embed PHP. Ask each vendor for a patch status in writing.

If you run IT for a government or education organization, the October 29 federal deadline is a useful benchmark even when you are not a federal agency, since many teams use KEV listings as a prioritization signal.

How to Fix PHP2Shell

Step 1:Update PHP

Only updating is a complete fix. Install the release that matches your branch:

PHP 8.1 and older no longer receive project updates, but the PHP security team published source backports for 7.4, 8.0, and 8.1 for people who build from source or are waiting on a vendor. Also note that PHP 8.2 reaches end of life on December 31, 2026, so patching it buys about two months.

If your business runs an older application pinned to an unsupported PHP version, that is the moment to consider legacy application modernization instead of another round of patching and hoping.

Step 2: Restart Everything

A process still running old code stays vulnerable. Restart Apache, PHP-FPM and any long-running PHP workers after you update.

Step 3: If You Cannot Patch Yet, Reduce Exposure

PHP is clear that these measures reduce exposure to specific attack paths and do not make a server safe. Treat them as a bridge. Per PHP’s guidance:

; For CVE-2026-109618 (enforce at server or pool level so apps cannot override)
memory_limit = -1
post_max_size = 8M        ; PHP suggests 32M if the app needs file uploads

; For CVE-2026-109619
session.upload_progress.enabled = 0

; PHP 8.5 only, also for CVE-2026-109619
fatal_error_backtraces = 0

Some notes on using these safely:

• Restart workers after changing session upload progress, and enforce request-size limits at the web server or proxy, not just in PHP.
• Do not substitute operating-system limits such as RLIMIT_AS or RLIMIT_DATA for the memory setting. PHP warns that they can trigger the same vulnerable path.
• Know the trade-offs. Red Hat warns that memory_limit = -1 removes PHP’s own memory ceiling, and that disabling upload progress stops native progress reporting in apps that use it.
• Do not over-trust the upload setting. It blocks the confirmed session paths but not other variants, and does nothing for CVE-2026-109618.

Step 4: Revisit Your Memory Settings After Updating

The fix adds a new hard memory limit. When a process hits it, the process ends and shutdown handlers do not run. After you patch, check memory_limit and post_max_size against what your application needs, and if you set memory_limit to -1 as a stopgap, put a real value back.

How to Check Whether You Were Hit

If a server was exposed before you patched, look for these signs:

• Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses
• Oddly large PHPSESSID cookies in responses
• Unexplained restarts of PHP workers
• Unexpected child processes spawned by PHP workers, such as sh, bash, curl or wget

Because the flaws can expose worker memory, it is also reasonable to rotate passwords, API keys, tokens, and certificates on any server you believe was exposed. That is our recommendation, not an official requirement.

If you find evidence of compromise, isolate the host, preserve logs, and restore from a known-good state. A tested backup and recovery plan makes that easier, and security orchestration and automation can shorten containment.

One More Item on the Watchlist

PHP has also warned about a separate, configuration-dependent remote code execution risk tracked as CVE-2026-115560. It involves session upload progress and requires a narrow set of conditions, and PHP has said a full advisory will come with its next regular release. Red Hat’s bulletin notes that disabling session upload progress fully protects against it, so if you do not use that feature, turning it off is a cheap way to shrink your exposure.

The Bigger Lesson: Your Runtime Is Part of Your Attack Surface

Most organizations track applications carefully and runtimes loosely. A few habits make the next flaw less painful:

• Keep an inventory that includes runtimes. You cannot patch what you did not know you had. Include language runtimes, base images, and vendor appliances.
• Set a faster lane for critical runtime flaws. A KEV listing should trigger a different timeline than a routine update.
• Layer your defenses. Firewall rules bought time here, but even Cloudflare called its rules a stopgap. Our guides to firewalls and zero-trust data security cover protection that doesn’t hinge on one control.
• Keep the wider picture in view. Our overview of top cybersecurity threats for businesses puts PHP2Shell in context.

How BuzzClan Can Help

Patching a runtime across servers, containers, hosting panels, and vendor appliances is exactly the kind of work that gets stuck between teams.

BuzzClan is a Frisco, Texas-based technology firm holding SOC 2 Type II, ISO 9001:2015, and CMMI Level 3 certifications. Our cybersecurity services team helps organizations identify exposures and close gaps, and our managed IT services team takes patching and monitoring off your plate. If you are in North Texas, we also offer cybersecurity services in Dallas and managed IT services in Dallas.

Frequently Asked Questions