PHP runs about three quarters of the web, so a bug in it rarely stays small for long. On October 21 the PHP team shipped emergency patches for two critical flaws now known as PHP2Shell, and each PHP2Shell vulnerability hands a remote attacker code execution on a server without any login. Details leaked days early. By the time most admins read the advisory, attackers were already knocking on their doors.
The two flaws carry the IDs CVE-2026-109618 and CVE-2026-109619, and PHP rates both at 9.2 under CVSS v4.0, though several outside teams argued the real impact sits closer to a perfect 10. They affect PHP 5, 7 and 8. That range covers nearly every version still serving live traffic anywhere on the internet.
How the PHP2Shell vulnerability works
Both flaws trace back to the same root problem in how PHP cleans up after itself. When a request dies early, PHP can leave its memory in a corrupted state, and an attacker who understands the pattern can steer that mess into something far more useful. CVE-2026-109618 abuses out-of-memory handling to run code as the web worker account. CVE-2026-109619 takes a different route through stale global state, leaking memory on the way, and arrives at the same destination.
The second PHP2Shell vulnerability worries defenders most, because it rides on PHP’s session upload progress feature, which ships enabled by default and runs before a single line of site code. So an attacker needs no account, no form and no broken config. The request itself does the work.
Risk from the PHP2Shell vulnerability also shifts with how a server runs PHP. Apache with mod_php sits right at the top of the danger list, since PHP confirmed a working exploit that fires before any application logic loads. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed all fall in scope too. Nobody has published a full FPM exploit yet, but that gap tends to close fast.
A leaked embargo forced an early release
The embargo around the PHP2Shell vulnerability collapsed before the fixes were even ready to ship. A since-deleted Hacker News post named both CVE numbers days ahead of schedule, and teams at watchTowr confirmed the bugs were genuine. CEO Benjamin Harris said his crew had already reproduced one. PHP moved its release forward to 14:00 UTC on October 21.
Cloudflare moved fast on the defensive side, pushing emergency firewall rules to every customer, free plans included. CTO Dane Knecht said the company was already watching early attacks land. Those rules buy time. PHP core developer Gina Peter Banyard put it plainly: only the patch closes the hole.
Attacks started before the patch landed
Attacks against the PHP2Shell vulnerability did not politely wait for a fix. Amazon Threat Intelligence logged an attack attempt against its honeypot network on October 17, four days before any of this went public. Several vendors then reported live hits within hours of the release, most of them aimed at the session upload progress path. The UK’s National Cyber Security Centre told firms to patch now or pull affected systems offline.
The raw exposure numbers explain why the PHP2Shell vulnerability caused such a scramble. More than five million PHP hosts sit on the public internet, and roughly 3.8 million keep a port open. WordPress, Joomla and Drupal all run on PHP. So a single unpatched host can turn a trusted site into a malware delivery point for everyone who visits it.
Which PHP versions fix the PHP2Shell vulnerability
Patched builds landed for every supported branch on October 21. Anyone running PHP 8.x should move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older branches get no further updates, so PHP 7 and earlier need a full upgrade rather than a patch. The team did publish minimal source backports for 7.4, 8.0 and 8.1.
Managed hosting customers should ask their provider before assuming someone further up the stack handled it. Several Linux distros pushed backported packages within hours. A quick php -v on the box settles the question faster than any status page.
What it means if you just browse the web
Most readers here do not run a PHP server, but they visit dozens of sites that do. A server breached through the PHP2Shell vulnerability can serve malware, fake login pages or silent redirects, and nothing in the address bar changes to warn you. Keep your browser current. Treat odd download prompts as hostile, and let a password manager handle logins so a fake page gets nothing.
A VPN patches nobody’s server, and it will not stop a hijacked site from pushing a bad payload. It does narrow what an attacker learns about you along the way, because it masks your real IP address and encrypts traffic across networks you do not control. Several providers also bundle DNS filtering or threat blocking, which breaks part of the redirect chain. That layer costs little and earns its keep in weeks like this one.
Final Thoughts
The PHP2Shell vulnerability pair carries every ugly trait of a web-scale incident: a remote attack path that needs no login, a language sitting behind most of the web, and a leak that handed attackers a head start. That combination does not come around often. The patches work, and they have been live since Wednesday.
Still, the window between a patch release and mass scanning closed in hours this week, which leaves no room for a scheduled maintenance slot. Any server left unpatched today belongs in the incident queue. Check your version, upgrade tonight, and assume someone has already tried the door.
