PHP2Shell: From the attacker’s perspective

What it is

Orca Security's write-up of attacking PHP through CVE-2026-109618 and CVE-2026-109619, and of how fast the public fix turned into working exploits. PHP runs roughly seven in ten websites, including WordPress, Drupal and Magento. Orca says the two bugs together allow unauthenticated code execution and exposure of secrets.

How it works

CVE-2026-109618 leaves PHP's internal state corrupted when the memory limit is reached, so execution can be hijacked during cleanup. CVE-2026-109619 is a double free that exploit chains use to leak memory and defeat ASLR. The fixes make allocation failures safe.

Orca's AI-assisted work started from the published patch. The AI first found a normal web request that exhausts PHP's allowed memory on a default-configured server, before the site's own code runs. The patched version handles the same request normally. Orca's first model refused to produce a full-chain RCE with a memory-leak primitive. Switching to a less restricted agent produced command execution on a standard PHP server within hours, then on an ordinary WordPress site. The exploit worked on 8.4.26 and failed on 8.4.27.

Preconditions / Affected

Unpatched PHP exposed to web requests. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and later. Orca says older PHP branches have no fix at all. Each PHP version needs its own exploit adjustments.

What to do

• Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Orca verified that the fix stops its attack.
• Inventory where PHP runs. Orca calls this the harder half, and points to old marketing sites, acquired brands, forgotten test machines and supplier systems.
• Take servers that cannot be updated off the public internet.
• Treat exposed, unpatched servers as possibly already reached, and check them. Orca says attempts were seen before the fix existed.

Caveats

• The patch touched 300 files and added 127 regression tests that trigger the bugs. Orca says these give attackers a map of the flaw. This is why the window between fix and exploit is short.
• Orca's claims that working attacks appeared within a day, and that some existed before disclosure, are its own assessment. The page gives no dates or samples for them.
• Orca says the public GitHub tools it ran worked unchanged, but also that most AI-written exploits on GitHub are junk. It offers no count of working ones.
• The page does not publish Orca's own exploit or the exact memory-exhaustion request.