AnswersPublished33 sources
PHP2Shell Explained: The PHP RCE Vulnerabilities and How to Respond
PHP2Shell is a pair of critical PHP memory safety flaws that can enable unauthenticated remote code execution under suitable conditions. For PHP based services, update the running web runtime or apply a vendor provided fix, then verify the service is using it.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell is a pair of critical PHP memory safety flaws that can enable unauthenticated remote code execution under suitable conditions.
- For PHP based services, update the running web runtime or apply a vendor provided fix, then verify the service is using it.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What are the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, how do they enable unauthenticated remote code execution in PHP—. Article summary: PHP2Shell is the name given to two critical PHP memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can permit unauthenticated remote code execution under suitable conditions; researchers rated them . Topic tags: general, general web, government, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with
PHP2Shell is the name used for two critical vulnerabilities in PHP’s runtime: CVE-2026-109618 and CVE-2026-109619. Under suitable conditions, they can let an unauthenticated attacker execute code on a server. PHP released fixes on October 21, 2026, for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.5
36 The urgent task for operators is to update the PHP runtime that serves requests—or apply the relevant product vendor’s fix—and verify the update took effect.
What the two vulnerabilities do
Both flaws involve memory safety in PHP itself, rather than a specific website’s application code. Research describes paths involving stale or freed memory that can be triggered during PHP runtime operations.6
9
- CVE-2026-109618 involves a use-after-free associated with PHP’s upload-progress handling. Wiz reports that it can expose memory from a PHP worker and, under demonstrated conditions, contribute to memory corruption and code execution.
6
- CVE-2026-109619 involves memory handling during fatal-error backtraces and OPcache. PHP’s advisory describes stale internal state that may be used by a later request handled by the same worker.
36
The vulnerabilities are rated 9.2 on the CVSS scale in cited reporting.2
37 Wiz has described PHP as technology used by roughly 70% of the internet, but that is an estimate of PHP’s reach—not evidence that 70% of websites are vulnerable in the same way or have been compromised.
6
Which PHP versions are affected, and what fixes are available?
Reporting identifies the vulnerable range as PHP 5.4 through 8.5.11.56 PHP’s published fixes are versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
36 If a system runs an older or unsupported version, check with its PHP distributor or product vendor for a supported update or backported fix rather than assuming that a standard PHP upgrade is available.
17
54
Updating the PHP package alone may not be enough if a website or appliance uses a separate, embedded runtime. Confirm which PHP installation serves web requests, and follow the vendor’s instructions for any product that bundles PHP.5
54
Discovery involved AI tools—but the timeline is not entirely consistent
The research is credited to Calif, OpenAI and Wiz, and accounts of the discovery describe AI-model assistance.4
16 Reporting differs on when the research began: USA Today describes an initial discovery by Calif in July and an independent Wiz discovery in August, while The Register places the researchers’ work between August and September.
4
47 Other reporting also mentions Google models, but the available material does not establish each model’s exact contribution or how much of the work was autonomous.
50
The distinction matters: the evidence supports AI-assisted research, not a claim that an AI system independently found, verified and fixed both vulnerabilities. Human researchers and maintainers were part of the reported discovery and response.4
16
What the PAN-OS connection means
Palo Alto Networks published an advisory addressing the impact of both PHP vulnerabilities across its products, with PAN-OS among the product families listed.34
35 That does not, by itself, establish that every PAN-OS installation is exposed to the same attack path as a PHP web server. Product configurations and vendor fixes matter.
Administrators should check Palo Alto Networks’ current advisory for the status of their specific product and software version, and follow its update instructions. Avoid relying on third-party hotfix schedules as confirmation that a fix is available: one circulating tracker explicitly labels its vendor status information AI-generated and says to verify it.21
Exploitation reports: attempts are not confirmed compromises
Threat-intelligence reporting has described an exploit attempt recorded on October 17, before the public technical disclosure and PHP fixes on October 21.53 Cloudflare’s reported traffic later rose from thousands of attempts to millions, according to Nextgov.
22 These figures describe attempted activity; they are not counts of successful server takeovers.
Reports about successful exploitation have differed. The BBC said on October 22 that there were no reported successful exploits at that time.18 Palo Alto Networks’ Unit 42 later said it could not confirm that activity it had initially associated with PHP2Shell was caused by these specific CVEs, and retracted its earlier update.
30 On the evidence available here, attempted exploitation is reported, but confirmed successful breaches attributable to PHP2Shell remain unclear.
Governments and businesses reportedly took some online services offline while preparing or applying fixes.26
51 Such precautionary shutdowns are not evidence that those organizations were breached.
Practical steps for organizations and website owners
- Find every PHP runtime. Check websites, application servers, containers, hosting environments and appliances. Ask hosting or managed-service providers to confirm the runtime and applicable fix.
- Apply a verified update. Use a fixed PHP release or a vendor-provided package that includes the corrections. For appliances and other bundled software, follow the product vendor’s instructions.
17
54
- Verify the live service. Confirm that the web-facing runtime—not just a separate command-line installation—has been updated. Check that required workers or services are running the corrected version.
- Reduce exposure if you cannot patch promptly. NSA guidance says to prioritize vendor patches and take a system offline if an immediate update is not feasible.
25
- Treat investigation and patching as separate jobs. Updating closes the vulnerability but does not establish whether an earlier intrusion occurred. Review relevant logs and system activity if there is reason to suspect compromise.
If you own a website but do not manage its server, contact the hosting provider or administrator and ask whether the PHP runtime has been updated. Do not install fixes from unsolicited messages; use the provider’s official instructions.
The key distinctions are simple: a system can be vulnerable, an attacker can attempt exploitation, and a system can be compromised—these are different claims. Patch the affected runtime, confirm the fix for products such as PAN-OS with the vendor, and assess any suspected intrusion separately.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell Explained: The PHP RCE Vulnerabilities and How to Respond"?
PHP2Shell is a pair of critical PHP memory safety flaws that can enable unauthenticated remote code execution under suitable conditions.
What are the key points to validate first?
PHP2Shell is a pair of critical PHP memory safety flaws that can enable unauthenticated remote code execution under suitable conditions. For PHP based services, update the running web runtime or apply a vendor provided fix, then verify the service is using it.