The PHP project released patched versions on October 21, 2026, for two critical flaws in the PHP engine itself that let an attacker run code on a web server with a single, unauthenticated HTTP request. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and both rated 9.2 on the CVSS v4.0 scale, have been nicknamed php2shell. Every PHP version released in the last decade is affected by at least one of them, going back to PHP 5.4.
The fixes arrived under pressure. Kaspersky reports that details leaked publicly before the planned embargo lifted. Sophos's Counter Threat Unit notes that a user on X claims to have a working proof-of-concept, and Unit 42 says it has seen proof-of-concept code and that at least one European government took its website offline as a precaution. We first covered the pre-announcement in PHP readies fix for two critical flaws, rated 9.2.
A bug in PHP, not in your CMS
The flaws were found by Wiz Research's Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, who describe them in the original report. Because the vulnerable code sits in PHP rather than in any application, The team demonstrated unauthenticated remote code execution against the latest container images of WordPress, Drupal and Joomla, and separately showed it could read chunks of PHP process memory holding passwords, tokens and API keys from other requests.
Palo Alto Networks' Cortex Xpanse counts more than 22.6 million exposed instances potentially vulnerable, according to Unit 42.
Wiz traces all of the bugs to how PHP handles fatal errors, particularly out-of-memory errors, during a request. An error at the wrong moment can leave corrupted internal state behind, and a later request handled by the same worker reuses that stale state. Wiz groups four exploitable bugs under the two CVEs:
- CVE-2026-109618: a use-after-free in the session upload-progress unserializer, plus a remote process-memory disclosure that leaks heap contents into a PHPSESSID response cookie, even when the application never starts a session.
- CVE-2026-109619: a use-after-free involving the backtrace PHP keeps from the last fatal error, and an OPcache type confusion that corrupts shared state across workers.
Wiz reported the issues to PHP on August 24 and says it used frontier AI models throughout the work, which in its account turned decade-old flaws that were impractical to exploit into working chains within hours.
Has anyone used it yet?
Cisco Talos said it had not seen exploitation in the wild as of 14:00 UTC on October 21, and Sophos likewise reported no active exploitation at the time it published. With exploit code circulating, that window may not stay open long.
Update PHP, and isolate what you cannot patch
Updating PHP on the server is the only complete fix, and it is separate from updating WordPress, Drupal or any other application. Sources disagree on older branches: Talos says there is no patch for PHP 8.1 or older and estimates roughly half of PHP systems will not receive one, while Kaspersky reports backported fixes for 7.4, 8.0 and 8.1. Check the PHP project's own release notes for your branch. CERT-FR recommends isolating unsupported versions and migrating to a maintained release, and the UK NCSC advises taking systems offline where immediate remediation is not feasible.
Interim measures, none of which is complete protection:
- Set
session.upload_progress.enabled = Offin php.ini or viaphp_admin_flagin the PHP-FPM pool, then restart every worker. Talos warns thatini_set()and FPM.user.iniare not enough. CERT-FR notes this covers only one of the two flaws. - Block HTTP requests with a multipart Content-Type at a web application firewall where possible, or at least monitor them closely (CERT-FR).
- Talos, citing PHP's guidance, suggests
memory_limit=-1enforced throughphp_admin_value, a lowpost_max_size, and on PHP 8.5fatal_error_backtraces=0.
For detection, Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker churn. Talos has published Snort SIDs 67359 and 67360, and Elastic Security Labs notes that post-exploitation tends to converge on a web server process spawning a shell.
Heartbleed and Log4Shell were the comparisons Wiz reached for, and the parallel that matters most for defenders is the long tail. The patched release is out today. The servers nobody remembers running PHP on are where this one will be decided.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.