AnswersPublished22 sources
PHP2Shell Explained: The 9.2 PHP Flaws, Patch Versions and Exploitation Evidence
PHP2Shell refers to two PHP vulnerabilities rated 9.2 that could let an unauthenticated attacker execute code on an affected server. The CVE identifiers surfaced ahead of the planned disclosure, and PHP released patches early.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell refers to two PHP vulnerabilities rated 9.2 that could let an unauthenticated attacker execute code on an affected server.
- The CVE identifiers surfaced ahead of the planned disclosure, and PHP released patches early.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What does the October 22, 2026 report reveal about the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, including their 9.2 se. Article summary: The October 22 coverage describes PHP2Shell as an urgent patching crisis: CVE-2026-109618 and CVE-2026-109619 were rated 9.2 and could allow remote attackers to execute code without authentication, prompting emergency up. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
PHP2Shell is the name used for two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 on CVSS v4.0 and could allow an unauthenticated attacker to execute code remotely on an affected server. PHP released fixes on October 21, 2026, after details surfaced ahead of the planned disclosure. Reports of attack attempts emerged quickly, but an attempt is not proof of a successful breach. 1
3
14
What the two PHP2Shell flaws do
The issues are in PHP’s request-handling and memory-management behavior, rather than in a particular website framework. CVE-2026-109618 concerns an out-of-memory handling vulnerability; CVE-2026-109619 involves stale internal state. The reported risk is remote code execution without authentication. 1
14
That makes the PHP runtime version important even when an application’s own code has no known flaw. PHP’s operational guidance lists installations serving web requests among those that need attention. 55
Fixed PHP versions and release timing
PHP published corrected releases on October 21, 2026. The listed fixed versions are:
Systems running earlier versions in those branches should be updated to the corresponding fixed release. The coverage also warned that details had appeared publicly before the anticipated disclosure, prompting an accelerated release. 3
13
33
How the identifiers leaked—and what is known about discovery
A Hacker News post on October 20 referred to the two vulnerabilities by their CVE identifiers and said details were due to be disclosed on October 22. The post was removed, but screenshots circulated; security researchers subsequently reported that the information was real and under embargo. 3
Reporting credited Calif with identifying a flaw with help from an OpenAI model. Wiz also independently discovered and reported the vulnerabilities, according to coverage of the coordinated response. The available reporting does not establish a roughly 20-year history for the bugs, or provide enough detail to assign each CVE to a particular discovery team. 27
33
Shutdowns and official guidance
Some organizations took services offline as a precaution while addressing the risk. Coverage named services associated with Japan’s Finance Ministry, BambooHR, the Port of Rotterdam and Wikimedia. Those outages are not, on their own, evidence that the organizations were breached. 19
CISA urged organizations running PHP-based websites to apply the patches immediately. 33 The supplied reporting does not establish a complete count of precautionary shutdowns or confirm every claim about affected hospitals, schools and government services.
What exploitation reports show—and what they don’t
The reports describe activity both before and after the public disclosure:
- Amazon said its MadPot honeypot detected an exploit attempt on October 17, before the October 21 patch release. A honeypot observation is evidence of an attempt against that sensor, not confirmation of a successful compromise elsewhere.
50
58
- Cloudflare reported thousands of attempts during the ten hours before public announcement and millions afterward. Those figures describe observed attempts across its network, not a count of successfully compromised servers.
36
- CISA said it had not observed exploitation at the time of its alert. That statement reflects its observation at that point; it does not negate attempts reported by security vendors using other telemetry.
- Sophos corrected an earlier report of successful exploitation in customer environments, saying its telemetry showed scanning and a small number of failed attempts, with no evidence of a successful compromise in its environments as of that update.
7
Taken together, the reports support treating PHP2Shell as urgent: attempts were being observed, and the potential impact was severe. They do not establish that every reported attempt succeeded or provide a definitive overall count of compromised systems.
What the evidence does not establish
The supplied reporting does not provide a reliable count of vulnerable internet-exposed servers, verify that the flaws had existed for roughly 20 years, or establish that attackers used AI to develop exploits for PHP2Shell. AI assistance was reported in the discovery process, but that is distinct from evidence about how attackers found or weaponized the vulnerabilities. 27
33
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell Explained: The 9.2 PHP Flaws, Patch Versions and Exploitation Evidence"?
PHP2Shell refers to two PHP vulnerabilities rated 9.2 that could let an unauthenticated attacker execute code on an affected server.
What are the key points to validate first?
PHP2Shell refers to two PHP vulnerabilities rated 9.2 that could let an unauthenticated attacker execute code on an affected server. The CVE identifiers surfaced ahead of the planned disclosure, and PHP released patches early.