AnswersPublished23 sources
PHP2Shell: What the Two Critical PHP Vulnerabilities Mean
PHP2Shell combines two critical PHP vulnerabilities, both rated 9.2 under CVSS v4.0, that can enable unauthenticated remote code execution. The flaws involve out of memory handling and stale internal state.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell combines two critical PHP vulnerabilities, both rated 9.2 under CVSS v4.0, that can enable unauthenticated remote code execution.
- The flaws involve out of memory handling and stale internal state. They were reported to affect PHP 5.4 and later, so systems running older or unsupported branches need vendor specific patch guidance.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What are the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, why are both rated 9.2 out of 10, how do they enable unauthentic. Article summary: PHP2Shell is the collective name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, reported to permit unauthenticated remote code execution; emergency fixes were released on October 21, 2026. [3][5] The av. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
PHP2Shell is the name used for two critical vulnerabilities in PHP’s core runtime: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2, Critical, under CVSS v4.0 and can allow an unauthenticated attacker to execute code on a vulnerable server. The PHP project released emergency fixes on October 21, 2026. 
The immediate priority for operators is to update PHP. Reports of exploit attempts—including an Amazon honeypot observation before public disclosure—are a reason to act quickly, but they are not proof that an attacker compromised a production system. 36
What the two PHP2Shell vulnerabilities do
The vulnerabilities have different reported mechanisms:
- CVE-2026-109618 involves out-of-memory handling. PHP’s handling of an out-of-memory condition can interrupt processing while internal request data is only partly initialized. During cleanup, PHP may then treat invalid data as valid.
58
- CVE-2026-109619 involves stale internal state. Reporting describes request-related state remaining after the memory backing it has been freed, creating a use-after-free problem.
9
The flaws concern PHP’s handling of specially crafted HTTP requests, including multipart form data, the format commonly used for file uploads. 1
Why the rating is 9.2—and what it does not tell you
Both vulnerabilities are reported as 9.2 out of 10, Critical, under CVSS v4.0. The unauthenticated remote-code-execution outcome is a key reason they pose a serious risk: an attacker does not need to log in to attempt to run code on an affected server.
The available source material does not include the complete CVSS vectors, so it does not support a precise breakdown of how each scoring input produces 9.2. The rating describes severity; it does not establish how likely a particular server is to be attacked or whether an observed attempt succeeded.
Which PHP versions are affected, and which fixes to install
Reports describe the vulnerable range as beginning with PHP 5.4. 55 The emergency fixed releases listed for the PHP 8.x branches are:
| PHP branch | Fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
These versions were released on October 21, 2026. Upgrade to the fixed release for your branch or a later release in that branch.
The listed fixes cover branches 8.2 through 8.5. If a system runs an older or unsupported branch, check the PHP distributor or operating-system vendor for applicable fixes and upgrade guidance; do not assume one of the listed versions directly applies.
Disclosure and exploitation: attempts are not confirmed breaches
The vulnerabilities became public on October 20, ahead of a planned October 22 disclosure. PHP released the emergency fixes on October 21. 8
42 The sources support the premature disclosure and earlier release, but do not establish that a mistakenly published Calif demonstration video was the trigger.
Amazon Threat Intelligence reported finding an attempted PHP2Shell exploit in its MadPot honeypot telemetry dated October 17—four days before public disclosure. Amazon also reported identifying proof-of-concept exploits around the time of the October 21 release. Honeypot telemetry shows activity directed at a decoy system, not a confirmed compromise of a real organization.
Cloudflare reported deploying protections around disclosure, and contemporaneous reports describe attack traffic or attempts observed by security vendors. 55
35 Reports about the scale and success of exploitation were not consistent: some vendors claimed active or widespread exploitation, while other contemporaneous reporting noted that government agencies had not confirmed successful attacks.
33
36
The evidence supports taking exploitation attempts seriously, but it does not justify treating every reported attempt as a successful intrusion or concluding that attacks were widespread. Keep those categories distinct when assessing exposure and incident reports.
What to do while patching
Install the fixed PHP release as the primary remediation. AWS says upgrading is the only complete fix. If patching cannot happen immediately, temporary exposure-reduction measures may include blocking multipart file uploads; these measures are not a substitute for updating.
Canada’s Cyber Centre issued a critical alert describing the vulnerabilities and the risk of unauthenticated code execution. 2 The available sources also report an NSA recommendation to take systems offline if they cannot be updated immediately.
27 Follow applicable vendor and government advisories for your deployment, especially if PHP is bundled in a product or managed by a hosting provider.
The practical takeaway is straightforward: identify where PHP is running, apply the correct fix, and investigate alerts with care. PHP2Shell’s severity warrants urgency—but an attempt, a working exploit and a confirmed production compromise are different things.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell: What the Two Critical PHP Vulnerabilities Mean"?
PHP2Shell combines two critical PHP vulnerabilities, both rated 9.2 under CVSS v4.0, that can enable unauthenticated remote code execution.
What are the key points to validate first?
PHP2Shell combines two critical PHP vulnerabilities, both rated 9.2 under CVSS v4.0, that can enable unauthenticated remote code execution. The flaws involve out of memory handling and stale internal state. They were reported to affect PHP 5.4 and later, so systems running older or unsupported branches need vendor specific patch guidance.