← All incidents

PHP2Shell: two critical PHP core flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated code execution; Wiz says frontier AI models made the exploit practical

Vulnerability · PHP (core engine) · CRITICAL

Summary

The PHP project released emergency security updates on Oct 21, 2026 for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, which researchers have named PHP2Shell. Both are rated CVSS 4.0 9.2 (Critical) by PHP and can let an unauthenticated attacker run code on a web server. Both come from how PHP cleans up after a request fails partway through, for example when it runs out of memory, which can leave freed or half-initialized memory behind for the next request to use. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers mod_php the highest risk. Wiz Research, which disclosed the flaws with Calif and OpenAI, says every PHP version back to 5.4 is affected by at least one of them, and it demonstrated pre-authentication code execution against WordPress, Drupal and Joomla as well as reading passwords, tokens and API keys out of PHP's memory. Wiz says frontier AI models were central to the work: in its words, "Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours." The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and get no official release, though PHP's security team published minimal source backports for 7.4, 8.0 and 8.1. CERT-EU says proofs of concept have begun to circulate, and Cloudflare says it saw attack traffic against its customers before the official release.

Severity

Timeline

1. Aug 19, 2026
   Wiz Research finds the first of the PHP flaws using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, per Wiz's disclosure timeline.
2. Aug 20–21, 2026
   Wiz confirms unauthenticated code execution against Drupal, then WordPress.
3. Aug 24, 2026
   Wiz reports the flaws to the PHP security team.
4. Sep 21, 2026
   PHP acknowledges the reports and starts work on a coordinated fix, per Wiz.
5. Oct 20, 2026
   PHP gives advance notice of a critical security release for two vulnerabilities rated CVSS 4.0 9.2, scheduled for Oct 21 at 14:00 UTC.
6. Oct 21, 2026, 3:02 UTC
   Cloudflare says its managed WAF rules protecting free and paid WAF customers against PHP2Shell are live. It says the details leaked before the official release and it observed attack traffic against its customers.
7. Oct 21, 2026, 13:30 UTC
   PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with the fixes, per CERT-EU. PHP publishes advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, and Wiz publishes its write-up.
8. Oct 21, 2026
   CERT-EU issues advisory 2026-018, noting that proofs of concept have begun to circulate. NVD lists both CVEs as undergoing analysis.

How it happened

PHP stops a request that goes over its memory limit by jumping straight out of whatever it was doing. PHP's advisories say that in some places this can happen while internal request data is only partly set up, or after a request has stored pointers to its own memory in global state that outlives the request. CVE-2026-109618 (RCE via OOM corruption) covers the first case: cleanup code then treats invalid memory as valid. PHP says several tricks in multipart form parsing can push a request over the memory limit while it still looks within PHP's size limits, and that with mod_php this all happens before any application code runs. CVE-2026-109619 (RCE via stale global state) covers the second: a later request handled by the same worker can use the leftover pointer before normal setup resets it. PHP names two confirmed paths, the PHP 8.5 fatal error backtrace feature and session upload progress, which is on by default and works even if the application never starts a session. Wiz says it chained these bugs, plus a memory disclosure that leaks heap contents in a PHPSESSID cookie, into one exploit script that ran code without logging in on the then-latest WordPress, Drupal and Joomla container images, and stresses that even a simple Hello World app on an affected version can be vulnerable. On the AI role, Wiz writes: "We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch." Wiz also says the flaws had been present for more than a decade and that "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit." Credit where due: PHP gave a day's advance notice, shipped fixes for all supported branches plus source backports for three end-of-life branches, and published detailed temporary mitigations, and Wiz worked with Cloudflare, AWS, Google Cloud, Microsoft and others on protections before disclosure.

How to check your app

• Find out which PHP version your app actually runs. On the server, run php -v, and check the web server's PHP too (a phpinfo() page you delete afterwards, or your host's control panel), since the command-line PHP can differ from the one serving requests. If you're on a managed host or platform, check its status page or ask whether it has rolled out the fixed builds.
• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or to your Linux distribution's patched package, then restart every PHP worker (PHP-FPM, Apache and so on) so the new build is the one running. In Docker, rebuild from an updated php base image and redeploy.
• PHP 8.1 and older are end-of-life and get no official release. PHP's security team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors provide backported fixes, but the lasting fix is moving to a supported branch. Note that PHP says 8.2 stops getting security fixes after Dec 31, 2026.
• If you can't update today, apply PHP's temporary mitigations in php.ini or your FPM pool or server configuration, not with ini_set() or .user.ini: set session.upload_progress.enabled=0, set fatal_error_backtraces=0 on PHP 8.5, and enforce memory_limit=-1 together with a low post_max_size, then restart every worker. PHP says these reduce exposure but don't make an installation safe. CERT-EU suggests taking internet-facing PHP apps off the public internet until they're patched if updating isn't possible.
• Wiz suggests looking for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained worker churn. Wiz says process memory can hold passwords, tokens and API keys, so if a server was exposed and you see those signs, rotate the secrets it held.

Related on VibeIncidents

• PaperCut servers mass-exploited by AI agents on a Codex harness with a DeepSeek model, GreyNoise says

Sources

• Wiz Research: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (Oct 21, 2026). Primary source
• PHP: Security advisory: Critical remote code execution vulnerabilities, update now (Oct 21, 2026)
• PHP advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
• PHP advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
• CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP (Oct 21, 2026)
• NVD: CVE-2026-109618
• NVD: CVE-2026-109619
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability (Oct 21, 2026)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (Oct 21, 2026)

Corrections and updates

None. Re-checked against every source on Oct 21, 2026.