AnswersPublished24 sources
PHP2Shell: What the Critical PHP Flaws Mean and How to Respond
PHP2Shell comprises two unauthenticated remote code execution flaws rated CVSS 9.2. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell comprises two unauthenticated remote code execution flaws rated CVSS 9.2.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations should inventory PHP deployments and prioritize vendor patches.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is the full picture of the PHP2Shell security crisis as of October 21, 2026, including PHP’s prevalence across websites; the unauthenti. Article summary: As of October 21, 2026, PHP2Shell was an urgent patching crisis involving two unauthenticated remote-code-execution vulnerabilities, with emergency PHP updates released after premature disclosure and reports of attack at. Topic tags: general, general web, government. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake n
PHP2Shell is the name given to two critical vulnerabilities in PHP’s request-handling code: CVE-2026-109618 and CVE-2026-109619. They can let an unauthenticated attacker execute code on an affected server. PHP released emergency fixes on October 21, 2026, after details became public ahead of the planned disclosure; reports of attack attempts did not, by themselves, establish that attackers had successfully compromised systems. 4
6
15
What the PHP2Shell vulnerabilities do
Both flaws affect PHP itself, rather than a particular website application. Security advisories describe PHP 5.4 and later as affected, and say specially crafted requests can trigger the vulnerabilities in systems processing web traffic. 8
14
The two issues have different underlying causes: CVE-2026-109618 involves out-of-memory corruption, while CVE-2026-109619 involves stale global state. Both were reported with a CVSS 4.0 score of 9.2, classified as Critical. 4
15
PHP is widely used, but the sources available here do not establish a reliable percentage of all websites affected. Prevalence estimates can use different denominators, so a headline figure should not be treated as a count of vulnerable sites. What matters for an operator is whether any PHP installation serving web requests is unpatched. 3
14
Disclosure, AI-assisted discovery and patches
The vulnerabilities became public on October 20, a day before PHP released emergency fixes and ahead of the originally planned October 22 disclosure. 6
7
16
Cloudflare credited Calif, Wiz, OpenAI and Quarkslab in its account of the disclosure. Contemporary reporting described AI-assisted research by Calif and said Wiz independently discovered and reported the flaws. The available sources do not establish the precise technical contribution of each participant. 14
20
The October 21 fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 15
16 Administrators should identify the PHP versions running in production and apply the appropriate fixed release or a verified vendor-provided backport. A hosting provider may backport a security fix without changing the displayed base version, so check the provider’s advisory if the version string appears older.
1
What was known about exploitation
On October 21, security reporting described attack attempts against the flaws. Cloudflare said it observed attack traffic, while SecurityWeek reported that several cybersecurity companies had seen attempts before the PHP patches were released. 14
15
The evidence did not point to a single settled conclusion about successful exploitation. A later summary of October 21 reporting said CISA and the Canadian Centre for Cyber Security had not observed or identified exploitation at that time, while security companies were reporting attempts. These are different claims: an attempted request is not proof of a successful intrusion, and the absence of an agency observation does not prove that no compromise occurred. 25
Patching, inventory and temporary defenses
The NSA advised organizations to prioritize vendor patches and inventory hardware and software services that rely on vulnerable PHP versions. 17 CISA was also reported to be urging immediate patching.
20 If an affected service cannot be patched promptly, reporting described advice to take it offline temporarily rather than leave it exposed.
7
21
Cloudflare said its free and paid WAF customers had default protection against PHP2Shell beginning at 03:02 UTC on October 21. 14 That protection can add a layer of defense, but it is not a replacement for updating vulnerable PHP; a filtering rule should not be treated as proof that an underlying server is secure.
14
17
The incident also prompted checks beyond ordinary PHP hosting. Help Net Security reported that Palo Alto Networks said all versions of PAN-OS and Panorama were affected and that fixes were not yet available at the time of its report. 33 Product exposure and mitigations are vendor-specific, so organizations using appliances or managed platforms should follow the relevant vendor advisory rather than assume that a PHP package update addresses those products.
The practical takeaway
Treat PHP2Shell as an urgent patching issue: inventory PHP services, apply the fixed release or a confirmed vendor backport, and use temporary isolation or filtering only as an interim measure. The October 21 reporting supports concern about attack attempts, but it does not justify treating every attempt as a confirmed breach. 1
15
17
25
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell: What the Critical PHP Flaws Mean and How to Respond"?
PHP2Shell comprises two unauthenticated remote code execution flaws rated CVSS 9.2.
What are the key points to validate first?
PHP2Shell comprises two unauthenticated remote code execution flaws rated CVSS 9.2. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations should inventory PHP deployments and prioritize vendor patches.
Sources
bleepingcomputer.comPHP ships emergency patches for critical PHP2Shell flaws
vulncheck.comPHP2Shell Vulnerabilities: CVE-2026-109618 and ...
securityweek.comPHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
access.redhat.comRHSB-2026-013 Request handling memory corruption - php (CVE ...