By Hamza Faisal

PHP has released emergency patches for two critical vulnerabilities that let attackers run their own code on a web server without logging in — a combination researchers are calling PHP2Shell. The fixes landed Wednesday, October 21, and security agencies are telling every organization with a PHP website to patch immediately.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a 9.2 critical rating under CVSS v4.0. They affect nearly every PHP version going back to PHP 5.4. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the PHP project says updating is the only way to be fully protected.

A flaw in the engine, not the app

What makes PHP2Shell especially dangerous is where it lives: in the PHP runtime itself, not in any plugin, theme, or application. That means a website can be exposed even when its own code is perfectly secure. An unauthenticated request can trigger the attack — on servers using Apache's mod_php, the exploit fires before any application code even runs.

Both flaws involve memory handling after an error. The first is triggered when an out-of-memory condition interrupts PHP before request data is fully initialized; the second lets internal state from one web request bleed into a later request handled by the same worker. The vulnerable code dates back to PHP 5.4.0, released in 2012. A PHP core developer actually spotted the out-of-memory error behind one of the bugs during an audit in 2024, but the team could not reach consensus on a fix and the work was never completed.

Found by researchers, leaked before the patch

The vulnerabilities were independently found by two teams. Calif researcher Ryan Austin discovered multiple remote-code paths in August as part of OpenAI's "Patch the Planet" initiative — OpenAI says the flaws were identified with the help of its GPT-5.6 Sol model. Wiz Research, the cloud-security company now owned by Google, found the same bugs on its own using AI tooling and reported them separately.

A coordinated disclosure had been building since August, with the patch originally scheduled for Thursday, October 22. But details leaked on Hacker News two days early, on October 20, forcing the emergency release a day ahead of plan. Security firm watchTowr says it has already reproduced one of the two flaws.

Patch now — the race is on

The blast radius is enormous: roughly 70 percent of websites run PHP-powered applications, including WordPress, Drupal, Joomla, WooCommerce, and Adobe Commerce. The U.S. Cybersecurity and Infrastructure Security Agency advised all organizations running PHP websites to apply the patches right away, calling it a patch-now moment.

There are already signs the attackers have a head start. Cloudflare said its protections went live about nine hours before public disclosure and that it was already observing attack traffic, with attackers mutating payloads to get around defenses. No victims of exploitation before the patch have been reported so far, but the window between disclosure and mass exploitation is closing fast.

If you run a PHP website, the most important action is to move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you are on shared hosting, ask your host to do it — today.

By Hamza Faisal