PHP2Shell: two critical PHP flaws put much of the web on a patch-now clock

The skim

• PHP shipped emergency fixes on October 21 for two critical flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let an unauthenticated attacker run code on a web server.
• The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release, and CISA says systems that can't be patched should be taken offline.
• The bugs were found with help from AI tools by Calif, OpenAI and Wiz. Cloudflare says it is already seeing early attacks.

What happened

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday to fix two related vulnerabilities, both rated 9.2 out of 10 on the CVSS v4 scale. In its security advisory, PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request "before any application code runs."

Both bugs come down to PHP leaving memory in a bad state when a request ends abnormally. One (CVE-2026-109618) is triggered by running out of memory at exactly the wrong moment. The other (CVE-2026-109619) lets leftover state from one request point to freed memory that a later request then uses. PHP's advisory is blunt: "There are no complete mitigations, updating is the only safe choice."

The US Cybersecurity and Infrastructure Security Agency urged immediate patching. It said organizations that can't update right away, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." The UK's NCSC gave similar advice.

How AI found it

According to the PHP Foundation, a researcher at security firm Calif reported a remote code execution bug on August 11 as part of OpenAI's Patch the Planet program. OpenAI independently reported the same root cause that day, and Wiz sent further attack vectors. The Foundation says it had spotted early signs of the memory problem back in 2024 but work on a fix stalled and restarted for months. "The delay was a structural failure," it wrote.

Wiz says it found its bugs using its own AI agent along with Google and OpenAI models. It also explains why decade-old bugs matter now: exploits used to need painstaking manual tuning for each server, but "With AI this is no longer a barrier," Wiz wrote.

The rollout got messy. The CVE numbers leaked on October 20, so PHP moved the release up a day, and a demo video one research firm published by mistake kept circulating after it was deleted. CISA said it had not seen exploitation when it published, but Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging," and watchTowr reports exploitation attempts, according to Tenable.

Why it matters

PHP runs a huge share of the web. W3Techs puts it at about 69% of websites whose server language is known, and it powers WordPress, Drupal, Joomla and Magento. WordPress itself isn't the bug, so updating plugins won't fix it. The PHP engine underneath has to be updated, which on most sites means your host does it.

If you run your own servers, install your distribution's patched PHP package now and restart every PHP worker. If you're on shared or managed hosting, check that your host has rolled out the fix. Cloudflare has free firewall rules for the known attack paths, but even it calls them a stopgap.

Sources: PHP.net advisory, PHP Foundation, CISA, Wiz, Tenable, BleepingComputer, TechCrunch.