PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

What it is

PHP2Shell is the name for two core PHP flaws, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), both rated CVSS 9.2. They sit in memory management and error handling, which nearly every request touches. Wiz says the two CVEs group four memory-safety issues and do not cover all variants. Tracked and likely untracked variants exist.

How it works

The OOM weakness was first found in 2020 and seen again in a 2024 audit, but was left unpatched because exploitation was unproven. Calif and OpenAI independently reported an OOM-to-RCE chain to PHP on 11 August 2026, and OpenAI and Wiz later reported further attack vectors. The flaws can also be used to read process memory, which may hold credentials and API keys. Hadrian says most attacks it sees abuse PHP's session upload-progress path, and expects other paths to appear.

Preconditions / Affected

• Nearly all PHP releases back to 5.4 are affected.
• Any PHP installation that handles web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
• RCE was confirmed on Apache with mod_php. The page does not say whether other SAPIs were exploited.
• No authentication is needed.

What to do

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Minimal source backports exist for 7.4, 8.0 and 8.1.
• The page does not mention fixes for 5.4 to 7.3.
• Treat workarounds as partial. The PHP Foundation says they reduce exposure to specific attack paths but do not make an installation safe.
• Check for prior compromise, not just patch status. Exploitation attempts were seen before the fixes shipped, and secrets in process memory may have been exposed. SimSpace's Lee Rossey advises knowing where PHP runs, who can authorize urgent changes, and how to confirm the update worked.
• Cloudflare deployed protections nine hours before disclosure.

Caveats

Disclosure was planned for 22 October 2026. Information leaked on 20 October, so patches shipped a day early. A PoC video was published early, and Chainguard released fixed images six hours before the coordinated release. The PHP Foundation says this let attackers study the fix in binary form.

Exploitation attempts were reported by Hadrian (at scale), Patchstack, Cloudflare and Vega (using a public PoC). WatchTowr saw attempts at patch time but no successful ones. Its head of threat intelligence, Jake Knott, does not expect that to last. The page gives no indicators of compromise or detection queries. Wiz has published a technical deep-dive that the page does not detail.