The short answer
PHP2Shell is a pair of critical remote code execution flaws in the PHP interpreter, and the only real fix is upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4.0, they sit below any framework, so Laravel, Symfony, WordPress and custom PHP applications are all in scope. Configuration stopgaps exist, but the PHP project says none of them is complete.
The urgency comes from the timeline. Exploit details and videos leaked on 20 October, the PHP security team pulled its release forward by a day, and vendors began reporting probing within hours. Teams that still run end-of-life PHP 8.1 or 7.x have no official package to install at all, which turns a patch job into an upgrade project.
What are the PHP2Shell flaws?
Both bugs are memory-safety errors in how PHP sets up and tears down a web request. In CVE-2026-109618, out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and the cleanup code later treats that half-built data as valid. In CVE-2026-109619, state that belongs to one request can outlive the memory behind it, so the next request handled by the same worker process may read the stale state before normal initialization resets it. The second issue is reachable through the session upload-progress feature, which is enabled by default.
What makes the pair unusual is where they live. Most PHP incidents are about a plugin, a framework route or an application bug, which you can patch or switch off at the application layer. PHP2Shell is in the runtime, so your code, your framework and your input validation never get a say. On the PHP project's own assessment, risk is highest for Apache with mod_php, where a demonstrated exploit fires from an unauthenticated request before any application code runs.
The flaws were found by AI-assisted research. Security firm Calif identified the first issue in August using OpenAI's GPT-5.6 Sol model during an OpenAI-funded audit, Wiz Research found related issues using its own tooling and Google's Gemini, and OpenAI's Codex Security team took part in coordinated disclosure with the PHP security team. The embargo was meant to lift on 22 October; leaked screenshots and video of an exploit tool called PHP2Shell forced the release a day early.
Which PHP servers are exposed?
The short version is every PHP installation that answers web requests. The PHP project names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. That covers the shared host behind a marketing site, the container running a Laravel API, the WooCommerce store and the internal Drupal intranet alike. Command-line PHP used only for cron jobs or build scripts is not the target; the attack needs a web request to reach the worker.
Version support is the second filter. Only the four maintained branches got fixed builds. PHP 8.1 and older are end-of-life and receive no official releases; the project published only minimal source backports for 7.4, 8.0 and 8.1, which you would have to compile and package yourself. CyberScoop, citing scan data, estimated roughly 1.3 to 1.9 million internet-exposed vulnerable hosts, with about 758,000 of the exposed servers running unsupported versions from 5.4 to 8.1. For those teams the honest fix is a runtime upgrade, not a patch.
The third filter is your hosting model. Managed platforms and well-run container pipelines can roll a new base image across a fleet in hours. Hand-built VMs, vendor appliances that bundle PHP, and old shared-hosting accounts are where unpatched runtimes tend to linger, often unnoticed until something breaks.
Is PHP2Shell being exploited yet?
As of CISA's alert on 21 October, the agency said it had not observed exploitation but urged organizations to inventory PHP systems, patch internet-facing ones first, take systems offline if they cannot be updated, and watch for PHP worker processes spawning shells or downloading tools. Since then, BleepingComputer reported early attack attempts observed by Cloudflare, and watchTowr said it had reproduced one of the flaws. Huntress said it had not confirmed successful in-the-wild compromises on customer systems.
Read that as the start of a familiar curve rather than reassurance. The bugs are hard to exploit by hand, but the leak put a working tool's behavior in public view a day before the fix, and AI-assisted research has made complex memory-corruption chains cheaper to reproduce. The window between disclosure and reliable mass exploitation for flaws of this severity is typically measured in hours to days.
What it means for US & EU software teams
First, this is a runtime patch, so it belongs to whoever owns your base images and servers, not just the application team. Update the PHP package or container image, restart every worker so no process keeps the old binary in memory, and confirm the running version on each host. If your PHP comes from a Linux distribution, check that its security repository has shipped the backported fix rather than assuming the upstream version number applies.
Second, interim controls buy time but not safety. The PHP project's stopgaps include setting session.upload_progress.enabled=0 and restarting workers, setting fatal_error_backtraces=0 on PHP 8.5, keeping post_max_size low and enforcing container memory limits. A WAF rule helps against known payloads. All of these are listed by the project as incomplete, so treat them as hours of cover while the upgrade rolls out. A focused security audit is the fastest way to find the PHP hosts nobody remembers owning.
Third, compliance clocks may already be ticking. For EU teams, a compromise of a PHP application holding personal data starts GDPR's 72-hour breach-notification window, and suppliers of products with digital elements now face the Cyber Resilience Act's vulnerability-reporting duties. For US teams in payments or healthcare, PCI DSS and HIPAA expect documented, timely patching of critical flaws. Running an end-of-life runtime with a known critical RCE is hard to defend to any auditor.
The longer lesson is about runtime lifecycle. Teams that track PHP support dates and upgrade on a schedule will treat PHP2Shell as one more deploy. Teams on PHP 7.4 or 8.1 face the costliest version of this news: an emergency, a framework upgrade and a regression-testing effort all at once.
What to do this week
- Inventory every PHP runtime. List servers, containers, shared-hosting accounts and appliances that serve PHP over HTTP, with exact versions.
- Upgrade supported branches now. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, rebuild base images and restart all workers.
- Verify the running version. Check each host after rollout; a stale FPM pool or cached image can keep the old binary alive.
- Apply stopgaps where you cannot patch today. Disable session upload progress, set PHP 8.5 fatal-error backtraces off, tighten upload and memory limits, and put WAF rules in front.
- Hunt for signs of compromise. Look for PHP workers spawning shells, unexpected outbound downloads and new files in web roots since 20 October.
- Schedule the end-of-life upgrade. If you run 8.1 or older, scope the move to a supported branch now rather than compiling unofficial backports indefinitely.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. The first is a memory corruption triggered when out-of-memory handling interrupts a request that is only partly initialized; the second lets request state survive after its memory is freed, so a later request on the same worker can use it. Either can lead to remote code execution without authentication.
Which PHP versions are fixed?
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. PHP 8.1 and older branches no longer receive official releases; the project published only minimal source backports for 7.4, 8.0 and 8.1, which you would have to build yourself. Anything below the four fixed versions should be treated as vulnerable.
Which servers are at risk?
According to the PHP project, all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. That means frameworks such as Laravel, Symfony, WordPress or Drupal cannot protect you on their own: the flaw sits below them.
Is PHP2Shell being exploited?
CISA said on 21 October 2026 that it had not observed exploitation at the time of its alert. Security vendors have since reported reconnaissance and exploitation attempts, and watchTowr reproduced one of the flaws, but responders such as Huntress said they had not confirmed successful in-the-wild compromises. Details and exploit videos leaked a day before disclosure, so the safe assumption is that working exploits will spread quickly.
Can I mitigate PHP2Shell without upgrading?
Only partially. The PHP project lists stopgaps such as setting session.upload_progress.enabled=0 and restarting every worker, setting fatal_error_backtraces=0 on PHP 8.5, keeping post_max_size low and relying on container memory limits, and CISA recommends a web application firewall as an interim control. The PHP project states plainly that there are no complete mitigations and that updating is the only safe choice.
Sources
PHP project — security releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 October 2026)
CISA — Critical Vulnerabilities in PHP Require Immediate Patching
BleepingComputer — PHP ships emergency patches for critical PHP2Shell flaws
CyberScoop — PHP releases emergency fixes for 2 critical vulnerabilities