PHP2Shell: Two Critical PHP RCE Vulnerabilities (CVSS 9.2)

PHP has released emergency patches. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Source downloads are available on php.net. Linux distributions received patches in advance, so check your vendor for updated packages.

The advisory confirms two memory corruption vulnerabilities. CVE-2026-109618 (OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialised, and request cleanup then treats invalid data as valid. CVE-2026-109619 (stale global state): request-owned internal state can survive after its backing memory is freed, and a later request on the same worker uses it before initialisation resets it.

Highest risk: mod_php, where a demonstrated exploit allows an unauthenticated request to trigger the attack before any application code runs. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are also affected.

PHP 8.1 and older will not receive official fixes, but the PHP team has provided minimal source backports for 7.4, 8.0, and 8.1 for those building from source. The Remi repository will not have updates today.

If you run PHP anywhere in your environment, patch now. Sansec predicted mass exploitation within 15 minutes of the patch release as attackers reverse-engineer the fix.

The Wall Street Journal is now running PHP2Shell as its lead story, headlined "AI Just Found a Bug That Puts Up to 70% of the World's Websites at Risk." The article centres on the AI-discovery angle, crediting Wiz, OpenAI, and Calif for using frontier models to uncover the vulnerabilities.

The WSJ coverage marks the moment PHP2Shell crosses from the security community into mainstream awareness. Spanish Wikipedia has already published a dedicated article, and national media outlets in France, Japan, South Korea, Iran, and Latin America are now covering the story. Some commentators are pushing back on the "AI found it" framing, noting that human researchers flagged the same problem area over a decade ago.

Source: Wall Street Journal

Google's official @Google account has tweeted about Gemini 4 Argon's role in the PHP2Shell discovery, claiming the model "found more than two times more vulnerabilities than baseline models" and caught "a critical risk that previous frontier models missed." The post links to Wiz's write-up.

The marketing push is drawing mixed reactions. Some in the security community see it as a legitimate milestone for AI-assisted vulnerability research; others note the optics of a vendor promoting its model while sysadmins worldwide are still racing to patch. Either way, the PHP2Shell disclosure is now firmly part of the competitive narrative between frontier AI providers.

A dedicated advisory site at php2shell.com has been launched as a central resource for the disclosure. It includes fixed version tables, interim mitigation guidance, detection signals, and demonstration videos showing pre-auth RCE against WordPress, Drupal, and Joomla.

The scale of coordination is notable. Beyond the three research teams (Wiz, OpenAI, Calif) and the PHP security team, the site lists industry partners who prepared mitigations or guidance ahead of disclosure: Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel, Corelight, CrowdStrike, Unit 42 (Palo Alto Networks), and Cisco Talos. The Gemini team at Google DeepMind also contributed to coordination.

The site recommends several interim hardening steps for those who cannot patch immediately: set memory_limit = -1 with cgroup v2 limits, disable session.upload_progress, lower post_max_size, and set display_errors = 0. None of these are complete fixes.

Wiz's write-up includes the full responsible disclosure timeline:

• 19 Aug: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
• 20 Aug: Unauthenticated RCE confirmed against Drupal.
• 21 Aug: Unauthenticated RCE confirmed against WordPress.
• 24 Aug: Wiz reports the vulnerabilities to the PHP security team.
• 21 Sep: PHP acknowledges the reports and begins developing a coordinated fix.
• 21 Oct: Patched PHP releases become available. Public disclosure.

Notably, it took the PHP security team almost a full month (24 August to 21 September) to acknowledge the report, despite confirmed pre-auth RCE against WordPress and Drupal.

The Wiz write-up confirms that three AI systems were used throughout the research: Wiz Atlas (Wiz's internal vulnerability research tool), Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol. Wiz says frontier models enabled working exploits across multiple applications "in hours" and that one researcher completed in a week what would previously have taken a world-class team months.

Raluca Ada Popa, Head of Gemini Security at Google DeepMind, said: "Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense." Argon is credited with contributions to vulnerability discovery, exploit development, attack detection, and patch validation.

Calif's write-up takes a more measured view. Lead researcher @lcfr_hax describes using an unnamed LLM as an "audit buddy" and "agent" for source review, pattern generalisation, and tracing execution paths, but stresses: "No model is simply capable of unearthing all bugs with simple prompts. At least for now." Calif also notes that no special harness or exclusive model access was used in the initial discovery.

Canonical has published patched PHP packages for all supported Ubuntu releases. Administrators running Ubuntu can update immediately with sudo apt update && sudo apt upgrade php* and then restart PHP-FPM or Apache for the fix to take effect.

This is one of the first major distribution vendors to ship updated packages. If you have been waiting on your distro rather than building from source, the wait is over for Ubuntu. Debian, RHEL, and other distributions are expected to follow shortly.

OpenAI has published a detailed blog post titled "Patch the Planet" describing its role in the PHP2Shell response. Calif identified the critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, with Wiz independently discovering and reporting both vulnerabilities. OpenAI says it led a two-month coalition with PHP maintainers, Wiz, Cloudflare, and government agencies including CISA, the White House's Super Intelligence Force, and the Office of the National Cyber Director.

OpenAI describes this as "one of the most impactful security issues in recent memory" and has committed $1 billion in subsidised Daybreak access through "Daybreak for Frontline Defenders" for organisations with limited security resources. They are also launching a Codex skill to help operators identify vulnerable PHP versions. The post warns that AI can help attackers develop exploits just as quickly, but claims frontier AI found these vulnerabilities before attackers did, opening a "Defender's Window."

Over 100 GitHub repositories related to PHP2Shell have appeared since disclosure, and the count is rising by the minute. The repos include proof-of-concept exploits (one already has over 200 stars), an ASLR bypass variant, Docker-based reproduction labs, Google dork collections for finding vulnerable servers, Sigma and ModSecurity detection rules, and recon toolkits.

On the defensive side, Corelight has published Zeek and Suricata detections and NCSC-NL has opened an operational information repository modelled on their Log4Shell response. The speed of weaponisation underlines why patching is urgent: attackers now have multiple working references to build from.

Alongside the request-side rules, Cloudflare has deployed what it calls full transaction detection: a new WAF capability that combines signals from the HTTP request and the origin response within the same transaction. If the origin returns indicators of successful exploitation, the response is blocked before it ever reaches the attacker. The PHP2Shell protections are the first managed detections to use this capability.

Cloudflare says the response-side signals raise detection confidence and reduce false positives, allowing them to block with higher precision than request inspection alone. A separate deep-dive blog post on the capability is linked from the write-up.

Because the vulnerability leaked early on HackerNews and BreachForums, Cloudflare was already watching attackers mutate payloads against the initial WAF rules before official disclosure. The team tracked match volumes against rule logic and pushed updated mitigations as new variants appeared. Seven distinct rules were deployed across both the free and paid managed rulesets, each targeting a different attack vector or bypass technique.

The write-up publishes all 14 rule IDs (seven free, seven paid) plus a response rule, so defenders can cross-reference detections in Security > Security Analytics > Events.

Cloudflare's detailed write-up confirms that WAF protections went live at 03:02 UTC on 21 October, roughly nine hours before public disclosure. Rules were deployed to all customers, including the free tier. Development of the protections began in early October after Cloudflare received advance notice.

Cloudflare reiterates that patching PHP is the only complete fix. Website code or plugin updates alone do not address the vulnerability. Their advice: keep WAF protections enabled while patching, restrict unnecessary file uploads, limit upload sizes, and confirm the Managed Ruleset is set to block mode.

Sysadmins worldwide are racing to apply the PHP patches, and download servers are under significant load. Reports from Dutch, French, German, Japanese, and Korean communities confirm organisations are patching in real time. Some administrators are noting slow downloads from php.net as demand spikes.

If you are struggling to download the source packages directly, check your Linux distribution's package repositories first, as vendors received the patches in advance. For Debian and Ubuntu, apt update && apt upgrade php* should pull the fix. Remember to restart PHP-FPM or Apache after upgrading: a package upgrade without a service restart leaves the vulnerable binary serving traffic.

The UK's National Cyber Security Centre has updated its PHP2Shell advisory to confirm that "this security issue has now been fixed" and that "all organisations are highly encouraged to update to the latest fixed version".

The updated guidance emphasises that PHP is bundled in many products beyond standalone web servers, so organisations should check appliances and third-party services as well. NCSC recommends using NCSC-NL's inventory of affected software products to identify dependencies. Discovery should not be limited to outdated PHP versions, as all versions may be affected.

For organisations that cannot patch immediately, the NCSC reiterates: consider taking the system offline. If a system cannot be updated or taken offline, check it for signs of compromise and backdoors before proceeding, and seek external support if needed.

Wiz has published a Runtime Response Policy for its cloud security platform that automatically terminates processes identified as exploiting PHP2Shell. Customers using Wiz Runtime can enable the policy to detect and kill exploitation attempts in real time, providing an additional layer of defence while patching is rolled out across environments.

This is one of the first vendor-specific active response measures released post-patch, alongside Cloudflare's WAF rules deployed earlier today.

The GitHub security advisories and researcher write-ups from Calif and Wiz reveal four distinct bugs under two CVEs, all rooted in the same pattern: PHP uses longjmp() to exit a request after an out-of-memory error, but internal state can be left partially initialised or pointing to freed memory.

The trigger: an attacker sends a crafted multipart request that exhausts PHP's heap without exceeding post_max_size. The trick uses empty filename="" fields (which bypass max_file_uploads but still allocate six $_FILES entries each) combined with deeply nested field names to multiply memory allocations.

CVE-2026-109618 covers two bugs. First, a use-after-free in the upload-progress unserializer: session decoding stores bookkeeping in a global that survives after the request heap is freed, and a later request treats attacker-reclaimed memory as live state. Second, a Heartbleed-style memory disclosure: a dangling PS(id) pointer causes the worker to leak live process memory into a PHPSESSID cookie, potentially exposing passwords, tokens, and API keys from other requests.

CVE-2026-109619 also covers two bugs. A fatal-error backtrace use-after-free (the confirmed mod_php RCE path on PHP 8.5), and an OPcache type confusion where a failed allocation during script persistence leaves shared memory out of sync across workers.

Why mod_php is worst hit: Apache runs request shutdown even when startup fails, so the corrupted state is consumed immediately. PHP-FPM exits the child on startup failure, blocking that path, but a separate post-startup route via the unserializer still allows exploitation. The fix replaces the longjmp() OOM handler with a graceful soft OOM at the next VM safe point.

PHP2Shell was independently discovered by three research teams: Wiz, Calif, and OpenAI. Wiz CTO Ami Luttwak has called it the "most severe vulnerability found using AI ever". Wiz used Gemini 4 Argon and GPT-5.6 Sol for discovery, exploit development, and patch validation, claiming a single researcher completed in a week what would previously have taken a team months.

The confirmed RCE demonstrations cover WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony, and WHMCS, all under default configurations. Calif reported the first bug to PHP on 11 August and the second on 21 August, giving the PHP team two months to prepare the fix.

A dedicated advisory site is now live at php2shell.com.

In an unusual move, the PHP security team has provided minimal source-level backports for PHP 7.4, 8.0, and 8.1, which are all end-of-life and no longer receive official updates. These are intended for organisations building from source or without access to an LTS vendor.

Linux distributions and LTS vendors (such as CloudLinux) received the patches in advance and may already have updated packages available. Check your vendor's advisory channels. The volunteer-maintained Remi repository will not have updates today, so if you rely on it, the PHP team recommends switching to distribution packages or building from source.

If you are still running PHP 7.4, 8.0, or 8.1 in production, apply these backports immediately, but plan a migration to a supported version as a priority.

Some of Japan's largest consumer platforms are proactively going offline ahead of patching. Niconico (Japan's equivalent of YouTube), pixiv (the world's largest art community), and multiple major gaming titles including Pokemon Sleep, Granblue Fantasy, and Uma Musume Pretty Derby have all announced emergency maintenance windows.

E-commerce and media platforms including Bandai Channel, Animate Online Shop, Melonbooks, BASE, and BOOK WALKER are also shutting down services. Japan's Prime Minister Takaichi Sanae has publicly urged organisations to take action, and the IPA (Information-technology Promotion Agency) has issued a formal pre-alert.

PHP powers roughly 75% of all websites where the server-side language is known, including WordPress, Drupal, Joomla, Magento, and Laravel. The vulnerabilities sit in the PHP interpreter itself, not in any single application, which means every PHP-based site is potentially in scope.

The comparison to Log4Shell (2021) is being drawn because of the combination of factors: the vulnerability is in a foundational component of the web, it allows unauthenticated remote code execution, it affects a huge number of systems, and a significant proportion of those systems are unmaintained or running end-of-life versions that will never receive an official patch.

GMO Flatt Security, who earlier today suggested disabling session.upload_progress via php.ini as a temporary mitigation, have now confirmed that this is not a complete fix. This aligns with statements from PHP core developers that no configuration change can fully mitigate these vulnerabilities.

If you applied this setting based on earlier guidance, do not treat it as a substitute for patching. The only effective remediation remains upgrading PHP once the patched versions are released.

Tenable has published a detailed FAQ on PHP2Shell, noting it has not been able to verify that any of the circulating proof-of-concept code works against either CVE. The page confirms the expected patched versions as 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Tenable also lists plugin IDs for identifying PHP installations across your estate and recommends patching as soon as fixes are available, noting that configuration workarounds are not effective.

With one hour to go before the 15:00 BST (14:00 UTC) release, here is where things stand:

• Active exploitation confirmed. Patchstack reports multiple hosting partners have seen exploitation attempts since 07:34 UTC this morning. Cloudflare corroborated this independently.
• No workaround works. The PHP project has confirmed that INI configuration changes, including disabling session.upload_progress, do not mitigate the vulnerabilities. Patching is the only fix.
• Global impact. Dutch government services, Finnish state IT, German hospitals, Japanese platforms, and multiple universities have taken systems offline preemptively.
• Mass exploitation expected rapidly. Sansec estimates mass exploitation could begin within 15 minutes of the patch release as attackers reverse-engineer the fix.

If you have not already done so, confirm your patching process, line up the people and approvals for an emergency restart, and have your hosting provider on standby.

Separately, the Node.js project is also shipping security updates today. While unrelated to PHP2Shell, it means infrastructure teams are dealing with two major patch events at the same time. If your environment runs both PHP and Node.js, plan accordingly and prioritise based on your exposure.

cPanel is preparing to push PHP updates across its supported versions, from ea-php74 through ea-php85, once the patched releases are available. For older PHP versions not covered by cPanel's EasyApache, the CloudLinux Hardened PHP project is expected to provide backported fixes.

This is relevant to a large number of organisations on shared and managed hosting. If your provider runs cPanel, updates should be available shortly after the 15:00 BST release. We would recommend contacting your hosting provider now to confirm their patching timeline.

The PHP security team is expected to release patched versions at 15:00 BST (14:00 UTC). If you run PHP anywhere in your environment, use this window to prepare:

• Identify every PHP installation across your estate: production servers, staging environments, containers, and any appliances that bundle PHP
• Confirm your update process and who has the access and approvals to restart services at short notice
• If you use managed or shared hosting, contact your provider now and ask when they plan to apply the fix
• For high-risk internet-facing applications where you cannot patch quickly, consider taking them offline or behind a VPN until the update is applied
• Ensure logging is enabled and retained so you can investigate any activity that occurred before patching

The patched versions are expected to be PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older will not receive fixes through the official release.

Multiple governments and public institutions are proactively taking web services offline ahead of the 15:00 BST patch. Finland's state IT centre Valtori is shutting down public-facing central government services as a precaution, with the National Land Survey of Finland already down.

In the Netherlands, the Dutch parliament (Tweede Kamer), the national cyber security centre (NCSC-NL), and the Dutch Data Protection Authority have all gone offline. NotuBiz, which provides council information systems for over 100 local governments, is also down.

Several universities including the University of Vienna and the University of Freiburg have switched off websites, webmail, and learning platforms. Valtori has confirmed these shutdowns are precautionary, not in response to a breach.

The UK's National Cyber Security Centre has updated its guidance for PHP2Shell. The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Full advisory: NCSC: Critical security issue affecting PHP

Because the vulnerabilities are in PHP itself, every CMS built on it is affected, including WordPress, Joomla, Drupal, and Magento. Fixes will only ship for PHP 8.2 and above.

According to mysites.guru, around 18% of WordPress sites and nearly 24% of Joomla sites are still running PHP 8.1 or older. These installations will not receive an official patch and will need to upgrade PHP or find alternative mitigations.

Joe Ferguson, the PHP 8.6 release manager, has stated that changing INI settings will not protect against the PHP2Shell vulnerabilities. The comment was made in response to suggestions to disable session.upload_progress as a workaround.

This reinforces earlier guidance that patching is the only effective remediation. Configuration changes alone do not address the root cause.

Underground forums BreachForums and Dread have reportedly taken their own sites offline as a precaution against the PHP2Shell vulnerabilities. Both platforms run on PHP. The move highlights the severity of the situation, when even underground operators are choosing downtime over exposure.

Posts on dark web forums show users requesting working exploits, noting that the proof of concept code circulating online does not work reliably across all PHP versions. This suggests that while PoC code exists, a universal weaponised exploit has not yet been achieved ahead of the official patch.

Proof of concept repositories targeting CVE-2026-109618 and CVE-2026-109619 are appearing on GitHub and other sources. Multiple repos now claim to demonstrate exploitation, with at least two publishing Python-based exploit scripts.

Be aware that some of these repositories may be malicious. It is common for threat actors to publish fake exploit code that installs backdoors or stealers on the machine of anyone who runs it. We would advise against cloning or executing unverified PoC code.

Once the official patches land at 15:00 BST, the remediation window is expected to be extremely short. The patch diff will be reverse engineered rapidly, and working proof of concept exploits are expected to begin dropping within minutes of release.

Organisations should have their upgrade plan ready to execute the moment patches are available. Know which servers run PHP, have SSH access prepared, and coordinate with hosting providers now. Waiting until tomorrow significantly increases the risk of compromise.

If you cannot patch within hours of release, consider taking affected internet-facing services offline until you can. The gap between patch release and mass exploitation is measured in minutes, not days.

Cloudflare has confirmed it is seeing early attacks targeting the PHP2Shell vulnerabilities and is actively updating its WAF mitigations as new exploit vectors emerge.

This confirms that exploitation is underway before patches have landed. Organisations behind Cloudflare should verify their WAF rules are up to date. Those not behind Cloudflare should consider taking affected services offline until patches are available at 15:00 BST.

The PHP Foundation has warned that the volunteer-maintained Remi repository (rpms.remirepo.net) will not have updates today. Organisations relying on Remi for PHP packages should switch to distribution packages or build from source now, so they can apply the patches immediately when they drop.

If you are unsure how your PHP installation is managed, run php -v and check your package manager to confirm the source.

Exploitation attempts targeting both CVE-2026-109618 and CVE-2026-109619 have been observed in the wild. Requests are using multipart/form-data payloads with boundary values referencing the CVE identifiers.

If you have not patched, do so now. If patching is not possible, isolate internet-facing PHP applications from public networks immediately. Check your WAF and web server logs for requests matching these patterns.

Cloudflare has released emergency WAF rules to help protect against potential exploitation. Two separate updates were published:

• Managed Ruleset: four new rules added to detect anomalous request patterns (two blocking, two logging)
• Free Ruleset: two new rules added to block anomalous request patterns

These rules are not a fix. They provide an additional layer of protection while you prepare to patch. If you are behind Cloudflare, check your WAF dashboard to confirm the new rules are active.

Emerging reports suggest current mitigations may not be fully effective. A PHP core developer has advised temporarily taking affected public-facing services offline as a precaution, rather than relying solely on existing mitigations.

The situation remains ongoing, with official security patches expected at 15:00 BST today. Organisations that cannot take services offline should ensure WAF rules are active, monitor logs closely, and be prepared to patch the moment updates are available.

The UK National Cyber Security Centre (NCSC) has published an alert encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate patching is not feasible, the NCSC advises organisations to consider taking the system offline until it can be fully mitigated.

Two critical remote code execution vulnerabilities in PHP have been assigned CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Researchers have nicknamed the pair PHP2Shell.

Full technical details remain under embargo. watchTowr has confirmed the flaws are real and allow remote code execution but has not published specifics. The leaked claim that every PHP version since PHP 5 is affected is unconfirmed. PHP fixes will only be issued for the four supported branches (8.2 through 8.5). Anything older, including 8.1, 8.0, 7.x, and 5.x, is end of life and will receive no vendor patch.

The PHP Foundation published advance notice of an upcoming security release addressing two critical vulnerabilities in PHP, both rated CVSS v4.0 9.2. The release is scheduled for Wednesday 21 October at 14:00 UTC (15:00 BST).

Security researchers at watchTowr confirmed on X that the leaked information about two PHP RCE flaws was real, that both vulnerabilities were under embargo, and that everyone had been expected to wait until Thursday 22 October for coordinated disclosure. watchTowr said it could not share further details.

A post on Hacker News claimed two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward, would be disclosed on Thursday 22 October. The post included two CVE identifiers (CVE-2026-109618 and CVE-2026-109619) but no technical details. The poster acknowledged having "no evidence beyond 'source: trust me, bro'". The CVSS 10.0 figure is from this leak; PHP's own rating is 9.2 on the v4.0 scale.