PHP2Shell: Two Critical PHP Flaws Patched, Attacks Already Seen

The PHP project released emergency fixes on Wednesday, 21 October, for two critical flaws, nicknamed PHP2Shell, that could let an attacker take control of a web server with a single request and without logging in. The bugs, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 by PHP, and security firms reported exploitation attempts even before the patches were out. PHP runs a large share of the world’s websites, including sites built on WordPress, Drupal and Laravel.

Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to Help Net Security, every PHP installation that serves web pages is affected, whether it runs as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed, and setups using mod_php face the greatest danger. PHP 8.1 and older no longer receive official updates, although the PHP security team has published minimal source fixes for 7.4, 8.0 and 8.1, and some Linux distributions offer their own patches.

Researchers at Wiz, cited by Help Net Security, said the first bug lets out-of-memory handling interrupt PHP while request data is only half set up, and the second leaves request data alive after its memory is freed, so a later request on the same worker can use it. A working exploit can fire before any website code runs, which means a security plugin inside WordPress cannot block it.

Details Leaked Before the Patch Was Ready

SecurityWeek reported that technical details were posted online before PHP’s planned disclosure, and the project set its release for 14:00 UTC (7:30 pm IST) on Wednesday. Amazon’s MadPot honeypot recorded an exploitation attempt on 17 October, four days before the flaws were made public. WatchTowr said it had reproduced one of the bugs. “We can confirm that these vulnerabilities are indeed real,” its chief executive said.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging immediate patching, and the UK’s National Cyber Security Centre told organisations to consider taking offline any system they cannot fix straight away.

Shared Hosting Customers Depend on Their Host

Most small Indian businesses, bloggers and news sites run on shared hosting, where only the hosting company can upgrade PHP. Site owners can check their PHP version in the hosting control panel, or in WordPress under Tools, Site Health, Info, Server, and ask the host for the date of the upgrade if it shows an older release. Cloudflare said it has deployed firewall rules against the known attack methods for all customers, including those on its free plan.

Wiz said the flaws had existed for decades and that frontier AI models had lowered the effort needed to build an exploit. The same day, GitLab and Node.js also shipped urgent fixes; see GitLab’s 10.0-rated flaw and the Node.js security release. Earlier, IPB reported on CERT-In’s advisory on AI agents.

Source: CISA alert on critical PHP vulnerabilities. Also based on reporting by Help Net Security and SecurityWeek.

Image: SecurityWeek.