PHP2Shell · CVSS 9.2
On 21 October 2026 the PHP project patched two memory-corruption bugs in the PHP runtime itself — CVE-2026-109618 and CVE-2026-109619. Unauthenticated attackers can execute code, and read other visitors' passwords and API keys out of process memory. It was being exploited four days before anyone announced it.
Patched releases: 8.2 → 8.2.35 · 8.3 → 8.3.36 · 8.4 → 8.4.27 · 8.5 → 8.5.12. Published 21 October 2026.
PHP2Shell is the public name for two memory-safety vulnerabilities in the core PHP engine, tracked as CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both were found by Wiz Research with Calif.io and OpenAI, and both were fixed by the PHP project on 21 October 2026.
The defect is in PHP itself, not in the application on top of it. When a request exhausts PHP’s memory limit, the allocator jumps out of a C function that has not finished building its data structures. Request shutdown then walks that half-built state — and a later request on the same worker can reuse it. That is enough for an unauthenticated attacker to execute code, or to read passwords, session tokens and API keys belonging to other requests.
Because the flaw sits in the runtime, patching WordPress, Drupal, Joomla or any framework does nothing. Every PHP version released in the last decade carries at least one of these vulnerabilities, and PHP 8.1 and older will never receive a fix.
| Branch | Fixed in | Status | Note |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | Upgrade required | Current stable branch |
| PHP 8.4 | 8.4.27 | Upgrade required | |
| PHP 8.3 | 8.3.36 | Upgrade required | |
| PHP 8.2 | 8.2.35 | Upgrade required | |
| PHP 8.1 and older | None | End of life | No fix will be released |
This is a header and markup check, not a penetration test. No exploit is attempted, no payload is sent, and no port is scanned. If your server hides its PHP version — which is good practice — the check will say so rather than guess.
PHP2Shell is the name given to two memory-corruption vulnerabilities in the PHP runtime itself, tracked as CVE-2026-109618 and CVE-2026-109619. They allow an unauthenticated attacker to execute code on a vulnerable server, or to read other visitors’ data out of PHP process memory. The flaw is in PHP, not in the application running on top of it.
PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12. Branches 8.1 and older are end of life and will never receive a fix, even though the underlying defect is older still.
Yes. The researchers demonstrated pre-authentication remote code execution against stock WordPress, Drupal and Joomla containers, but the vulnerability is in PHP itself. Updating WordPress, Drupal, Joomla or any plugin does not fix it — the PHP runtime must be upgraded.
Yes. Amazon Threat Intelligence observed an exploitation attempt on 17 October 2026, four days before the 21 October disclosure, originating from an anonymisation network. Broad exploitation followed within hours of the embargo lifting.
No. There is no complete configuration-only fix. Cloudflare WAF rules and limiting multipart request sizes reduce exposure, and enforcing memory_limit with no RLIMIT_AS removes one trigger path, but the only complete remediation is upgrading PHP to the fixed release for your branch.
Cloudflare deployed managed WAF rules on 21 October 2026, enabled by default on both free and paid plans. They are defence in depth, not a fix: the PHP runtime behind them still needs patching.
The quickest external check is the X-Powered-By and Server response headers, or a PHPSESSID cookie. The authoritative check is from inside the server: run php -v, or ask your hosting provider which PHP patch level your plan is on.
No. The published score is 9.2 under CVSS 4.0. A 10.0 figure circulated in leaked material before disclosure and is not correct.
An informational advisory published on 23 October 2026 covering PHP’s session upload progress feature. It affects fully patched releases including 8.5.12 and is scheduled for the next regular PHP release, so a patched site is not automatically finished.
An undetermined result is not a clean bill of health. Every stack has a version of this bug class — the runtime decides which one you get. We’ll look at your build manifests, base images and dependency lockfiles and tell you what actually needs patching.
Book a 20-minute review