PHP2Shell Explained: Critical PHP Vulnerabilities, Affected Versions, and How to Protect Your Server

A critical security issue in PHP has put web servers running vulnerable PHP versions at risk of remote code execution. The issue, known as PHP2Shell, involves two vulnerabilities in PHP’s core runtime that can allow an attacker to execute code on a server without logging in first.

The PHP security team released emergency security updates on October 21, 2026. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 severity score of 9.2 out of 10.

What makes this issue particularly serious is that it does not depend on a vulnerable Laravel controller, a WordPress plugin, or a poorly written application endpoint. The underlying problems exist in PHP itself. A website can have authentication, input validation, and well-written application code and still be exposed if its PHP runtime is vulnerable.

This article explains what happened, who discovered the vulnerabilities, how they work, which versions are affected, and what developers and server administrators should do next.

What is PHP2Shell?

PHP2Shell is the name used for two critical vulnerabilities in the PHP runtime. Both can create a path to unauthenticated remote code execution, commonly shortened to RCE.

Remote code execution means an attacker can cause a vulnerable server to run commands or code of their choosing. Depending on the permissions available to the affected PHP process, this could allow an attacker to read application files, access credentials, alter website content, install malicious scripts, or attempt to gain further control of the server.

The two vulnerability identifiers are:

• CVE-2026-109618: Associated with memory corruption involving PHP's out-of-memory handling and internal request data.
• CVE-2026-109619: Associated with stale internal state and use-after-free memory errors.

Both vulnerabilities received a CVSS v4.0 score of 9.2, placing them in the critical severity category.

The name PHP2Shell describes the potential path from a remotely submitted web request to command execution on the server. It does not refer to a vulnerability in a particular PHP framework or content management system.

Who discovered PHP2Shell?

The vulnerabilities were reported by Wiz Research, the security research team at Wiz. The research was led by a team that included Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz.

One important part of this discovery was the role of artificial intelligence in security research. According to Wiz's published account, the team used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during the research. Gemini 4 Argon made a particularly significant contribution to identifying the vulnerabilities, developing the exploit, building detection methods, and validating the fixes.

The discovery was not simply a matter of asking an AI model to inspect PHP and report a bug. The researchers had to investigate low-level memory behavior, connect multiple weaknesses, test exploitability, and work with the PHP maintainers to get the underlying issues fixed.

Wiz also credited the PHP team, Calif, and OpenAI for their contributions to discovery, coordination, and patch verification. Other technology and security companies helped prepare defensive guidance before the details became public.

This distinction matters. AI assisted the research, but the work still involved technical investigation, testing, collaboration, and responsible disclosure. The finding demonstrates how AI-assisted research can help identify complex weaknesses in widely used software.

What happened, and when?

The public timeline was unusually compressed because technical details leaked before the planned coordinated disclosure.

October 20, 2026: Details of the vulnerabilities became public ahead of the planned release. The PHP security team issued an advance notice of an upcoming critical security release.

October 21, 2026: PHP published security updates for the supported 8.2, 8.3, 8.4, and 8.5 branches. The updates addressed both vulnerabilities. Security researchers and technology companies also published technical analyses and defensive guidance.

October 22, 2026: Administrators should treat patching and verification as immediate priorities. Public reporting has described exploitation attempts, so the issue should not be treated as a theoretical weakness that can wait for the next routine maintenance window.

A key lesson from this timeline is that vulnerability management cannot depend entirely on a normal monthly or quarterly patching schedule. When a critical flaw affects a shared runtime used across many applications, the time between disclosure and exploitation can be very short.

Why did PHP2Shell happen?

To understand the issue, it helps to look at how PHP handles an incoming web request.

When a browser submits a request, PHP initializes the information needed to process it. This includes internal data structures, memory allocations, session-related information, and other request-specific state. When the request finishes, PHP cleans up the resources used by that request.

The problem involved cases where an operation failed unexpectedly, particularly during memory allocation or request initialization. PHP could be left with internal state that was only partly initialized or that still pointed to memory that had already been freed.

Under normal conditions, PHP's request lifecycle should initialize, use, and clean up its internal state safely. The vulnerabilities created situations in which that assumption no longer held.

An attacker could send carefully constructed HTTP requests to reach these error-handling paths. Under the vulnerable conditions, PHP's cleanup or later request processing could handle invalid or stale internal data as if it were still valid. Researchers demonstrated that these memory-safety problems could be developed into remote code execution.

There are two separate vulnerabilities, and their technical details differ.

CVE-2026-109618: Out-of-memory corruption

The first vulnerability involves an out-of-memory condition during request processing.

Imagine that PHP is preparing internal request data and a memory allocation fails. The operation does not complete normally, leaving some internal data structures only partially initialized. If subsequent cleanup treats those structures as valid, the process can enter an unsafe state.

The researchers connected this class of failure to PHP's session upload-progress and unserialization handling. Under the right conditions, the resulting memory corruption could be developed into remote code execution without authentication.

The important point is that the problem was not simply that a server ran out of memory. Applications can encounter memory exhaustion without becoming vulnerable to remote code execution. The security issue arose because of how PHP handled its internal state after the failure.

CVE-2026-109619: Stale internal state

The second vulnerability involves state that remains available after the memory it refers to has been released.

This is related to a programming error known as a use-after-free. In simple terms, software allocates a region of memory, uses it, releases it, and then later attempts to use a pointer or reference to that same region as though the original data were still there.

Once memory has been freed, it may be reused for something else. Treating it as the original object can lead to corruption, unexpected behavior, information exposure, or code execution.

In this case, a PHP worker could retain stale request-related state after an error. A later request handled by the same worker could encounter that state before normal initialization reset it. Researchers also documented related weaknesses involving fatal-error backtraces and OPcache's shared state.

Both vulnerabilities are rooted in PHP's internal handling of memory and request state. They are not ordinary application-level validation errors.

Why is PHP2Shell different from a typical website vulnerability?

Most application security issues are tied to a particular endpoint, plugin, library, or feature. For example, a SQL injection vulnerability may exist in one controller because it builds a database query unsafely.

PHP2Shell is different because the affected component is the language runtime itself.

PHP is used by WordPress, Drupal, Joomla, Magento, Laravel applications, and countless custom websites. If the PHP runtime serving a website is vulnerable, changing the framework or rewriting a controller does not remove the underlying flaw.

Security researchers demonstrated exploitation against WordPress, Drupal, and Joomla. Those applications were demonstration targets, not the only affected products.

A minimal PHP application can also be exposed if it runs on a vulnerable runtime and serves requests through an affected configuration. The absence of a complicated application does not, by itself, protect the server.

This is why checking only application dependencies is insufficient. A developer can have an up-to-date composer.lock file and still run an outdated PHP binary or PHP-FPM service.

Which PHP versions are affected?

PHP's official security release identifies the following fixed versions:

Treat earlier releases in the affected branches as vulnerable unless your operating-system vendor or PHP distributor explicitly confirms that the relevant fixes have been backported.

The research also identified affected versions going back to older PHP 5.x releases. Legacy PHP installations deserve particular attention because they may no longer receive normal upstream security updates.

There is an important distinction between a version number and a security fix. Some Linux distributions backport security patches without changing the upstream version number in the way users expect. If you use distribution packages, check the package changelog or vendor advisory for both CVE identifiers rather than relying on a version string alone.

PHP 8.2 also reaches the end of its upstream security support on December 31, 2026. Administrators currently using PHP 8.2 should apply the security fix immediately and plan a move to a newer supported branch.

Is PHP-FPM affected? What about Nginx and Apache?

Yes. PHP's security guidance covers PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The web server itself is not necessarily the component containing the flaw. Nginx and Apache commonly pass PHP requests to a PHP runtime that executes the application. If that runtime is vulnerable, the website can be exposed even when the web server package is fully patched.

For example, a typical Nginx and PHP-FPM deployment works like this:

1. A visitor sends an HTTP request to Nginx.
2. Nginx forwards a PHP request to PHP-FPM.
3. PHP-FPM processes the request using the installed PHP runtime.
4. The application returns a response through PHP-FPM and Nginx.

In this arrangement, updating Nginx alone does not fix a vulnerable PHP-FPM runtime. The relevant PHP packages must be updated, and the running PHP workers must be restarted or replaced so they use the patched code.

The PHP team identified Apache configurations using mod_php as the highest-risk setup because a demonstrated attack can reach the vulnerable code before application code runs. Other internet-facing PHP configurations still require prompt patching.

What could an attacker do if a server is compromised?

Successful remote code execution can give an attacker the ability to run commands with the privileges of the affected PHP process. The exact impact depends on the server's permissions, filesystem access, network access, and cloud configuration.

Potential consequences include:

• Reading application configuration files, including Laravel's .env file, if the PHP process can access them.
• Stealing database credentials, API tokens, mail credentials, or other secrets available to the application.
• Modifying website files or placing a malicious PHP script in a writable web directory.
• Attempting to download and execute additional malware.
• Accessing data that the application account is permitted to read.
• Attempting privilege escalation or persistence through scheduled tasks, SSH keys, or service configuration.
• Accessing cloud credentials or instance metadata when the environment permits it.

PHP2Shell research also documented the possibility of disclosing sensitive data from PHP worker memory without first achieving full remote code execution. Depending on what the process has handled, that memory may contain information such as tokens, passwords, or API keys.

These are possible consequences, not proof that every vulnerable server has been compromised. A vulnerable version establishes exposure; evidence of an intrusion requires investigation.

How to check and patch a PHP server

The safest response is to update PHP through the package manager or vendor channel responsible for maintaining the installation, then verify the runtime that actually serves the website.

1. Check the installed PHP version

On Ubuntu or Debian, run:

php -v
      

This shows the command-line PHP version. It is a useful first check, but it may not match the PHP-FPM service or Apache module used by the website.

For PHP-FPM, check the service and its version:

php-fpm8.2 -v
sudo systemctl status php8.2-fpm --no-pager
      

Adjust the service and binary names if the server uses a different PHP branch.

2. Check for available security updates

On Ubuntu and Debian systems:

sudo apt update
apt-cache policy php8.2-cli php8.2-fpm
      

Review the candidate versions and confirm that your configured package repository provides the relevant security fix. The example uses PHP 8.2; substitute your installed branch as needed.

If your PHP packages come from a third-party repository, verify that repository's security release before assuming the update is available.

3. Install the patched packages

Use the package manager or the official update process for your environment. For a package-managed Ubuntu installation, update the PHP packages installed on the server to the fixed versions supplied by the configured repository.

Before confirming an APT transaction, read the proposed changes. Stop if it unexpectedly removes required packages or proposes unrelated major changes that you have not reviewed.

For Docker deployments, rebuild the image from a patched base image and redeploy the affected containers. Updating PHP on the host does not patch PHP packaged inside a container.

4. Restart the PHP runtime

After the package update, restart the appropriate PHP service. For PHP 8.2-FPM:

sudo systemctl restart php8.2-fpm
sudo systemctl status php8.2-fpm --no-pager
php -v
php-fpm8.2 -v
sudo nginx -t
      

Restart Apache or other relevant services where applicable. In a containerized environment, replace the running containers with newly built images.

5. Verify the website

Check that the application still responds:

curl -sS -o /dev/null \
  -w "HTTP %{http_code}\n" \
  https://your-domain.example
      

Replace the example hostname with your real domain. An HTTP status of 200 is common for a homepage, but a redirect or an authentication response may be normal for some applications. The important thing is to confirm that the expected website behavior remains intact.

Finally, confirm that the running web-facing PHP process is using the patched runtime. Do not rely on the CLI version alone.

Are there temporary workarounds?

There are configuration measures that can reduce exposure to specific attack paths, but the PHP security team has stated that there are no complete mitigations. Updating is the only safe, complete remediation.

Disabling PHP's session upload-progress feature is one measure discussed in public technical guidance. Other settings can reduce exposure to particular memory-error paths. However, these measures do not cover every variant, and their effectiveness depends on the PHP version and configuration.

Do not treat a single php.ini setting, a WAF rule, a CDN, or a firewall as a replacement for the security update. Some of the vulnerable processing happens before normal application code runs, so application-level authentication and validation cannot reliably block the underlying issue.

If an update is temporarily impossible, consult the official PHP advisory and your hosting or distribution vendor for version-specific temporary controls. Apply the patch as soon as it is available.

What should you check if your server was exposed?

Patching prevents exploitation through the fixed vulnerability, but it does not automatically remove malicious code or reverse a compromise that happened earlier.

If a server was running a vulnerable version while exposed to the internet, review its logs and process activity, especially around the period when exploit details became public.

Look for unusual multipart HTTP requests, memory exhaustion errors, unexpected HTTP 500 responses, unexplained PHP worker restarts, and abnormal child processes launched by PHP-FPM or the web server. Investigate unexpected PHP files, unfamiliar scheduled tasks, new SSH keys, unexplained changes to application files, and unusual outbound connections.

No single log entry proves an attack. Conversely, a lack of obvious errors does not prove that the server is clean. Successful exploitation may not produce a straightforward crash or a clearly identifiable application exception.

If you find credible evidence of compromise, preserve relevant logs and snapshots, isolate the affected host where practical, investigate the intrusion, and rotate credentials and tokens that may have been exposed. Rebuilding from a known-good source may be more reliable than attempting to remove unknown changes manually.

What PHP2Shell means for Laravel developers

Laravel developers should treat PHP as a production dependency, just like the database server, operating system, and web server.

Updating Composer packages is not enough when the vulnerability exists in the PHP runtime. A Laravel application can use current framework releases and still be exposed by an outdated PHP-FPM service.

For production Laravel deployments, make PHP version verification part of the release and maintenance process. Check the runtime used by PHP-FPM, keep the operating system and package repositories maintained, and avoid granting the web process more filesystem or system privileges than it needs.

Keep .env and other secret-bearing files outside public access, restrict write permissions on application code, and maintain reliable backups. These controls do not fix PHP2Shell, but they can reduce the consequences of a successful compromise.

Teams should also review their deployment process for overlooked runtimes: staging servers, queue workers, scheduled jobs, containers, CI/CD images, and older applications that still use a separate PHP installation.

Lessons for website owners and server administrators

PHP2Shell is a reminder that application security is only one part of a secure deployment.

A carefully written application still depends on the safety of the runtime executing it. A server may have a valid TLS certificate, a secure login system, a restrictive firewall, and a properly configured database while remaining vulnerable through an unpatched language runtime.

There are three practical lessons.

First, maintain an inventory of every PHP installation, not just the one developers use locally. Old projects and forgotten services are easy to miss.

Second, patch critical runtime vulnerabilities promptly. When a vulnerability permits unauthenticated remote code execution, waiting for the next routine maintenance cycle can leave a public-facing service exposed for too long.

Third, verify the running service after an update. A package can be installed successfully while an old process or container continues running the previous build.

Final thoughts

PHP2Shell is serious because it affects a foundational component of the web rather than one particular application. The vulnerabilities show how subtle memory-management errors can survive for years and how complex research, including AI-assisted analysis, can help turn those weaknesses into reproducible findings.

The PHP team has released fixes, and administrators should prioritize applying them. For systems running older unsupported PHP branches, the response requires extra care: upgrade to a supported release or confirm that a trusted vendor has supplied an appropriate backported fix.

For developers, the lesson is straightforward. Secure application code matters, but it cannot compensate for a vulnerable runtime. Keep PHP current, verify the version actually serving requests, and investigate potentially exposed servers rather than assuming that patching alone proves they were never compromised.

Official and technical references

• PHP official security release and downloads
• Wiz Research: PHP2Shell technical analysis and discovery
• Elastic Security Labs: PHP2Shell detection and remediation
• Aikido Security: Affected PHP versions and patching guidance

This article is for security awareness and defensive maintenance. Version guidance reflects information available on October 22, 2026. Check the official PHP advisory and your distribution's security notices for subsequent updates.