PHP2Shell: two flaws in the PHP engine allow unauthenticated remote code execution

What happened

Two vulnerabilities, nicknamed PHP2Shell, sit in the PHP engine itself: not in an extension, a plugin or a website's code, but in the part that handles every web request. Attacks started before the flaws were public, details leaked on 20 October 2026, and the PHP project shipped emergency fixes the next day, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Both flaws let an unauthenticated attacker corrupt memory with a crafted HTTP request and, in the right conditions, run code on the server. They affect the common ways PHP runs behind a web server: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

How the flaws work

For performance, a PHP worker process is not restarted between requests. Between two requests, the engine has to reset its internal state. Both bugs live in that reset.

CVE-2026-109618, corruption on out-of-memory. A request, typically a multipart file upload, goes over memory_limit. PHP aborts the request at once, while some internal structures are only half initialized. The end-of-request cleanup then treats them as valid and frees memory that was never initialized, memory that can hold bytes the attacker placed there.

CVE-2026-109619, stale global state. After a fatal error (here around the session upload progress feature), a piece of request state survives although its memory has already been freed. The next request served by the same worker uses it before the reset clears it: a use-after-free with a different trigger.

Why it is serious

No account is needed. On mod_php, one forged request triggers the condition before any application code runs, so a well-written website is exposed just as much as a vulnerable one. By reusing memory it controls, the attacker can steer the engine toward code execution. Remote code execution has been demonstrated on mod_php, and PHP-FPM is considered exposed.

VulnCheck reports a reliable exploit that defeats ASLR on x86-64 with display_errors=off (tested on PHP 8.4.26), reserved to its customers. Most public proofs of concept on GitHub do not work, but CERT-FR says it is aware of working ones for specific deployments.

Threat status (as of 23 October 2026)

• Exploited before disclosure: AWS reports that attacks using these flaws began before they were made public, so servers may have been hit before any fix existed.
• Mass exploitation attempts since the fix: Cloudflare reports attempts by the millions, with payloads adapted to slip past web application firewalls.
• Not yet in the CISA KEV catalog as of 23 October. Treat exposed servers patched late as potentially compromised and check them (see detection below).
• Appliances: F5 BIG-IP 17.x and 21.x and Citrix NetScaler are reported affected without a fix (community reports, not yet official advisories). PAN-OS and Panorama have no fix yet. Cisco is reviewing 18 products and 13 cloud services; Fortinet lists most of its products as not affected.
• End-of-life PHP: versions 5, 7, 8.0 and 8.1 are affected and get no official fix.
• A third flaw, CVE-2026-115560, was reported on 23 October; it needs an unusual configuration.

What to do

1. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35: the only complete fix. Then restart every PHP-FPM or Apache worker, otherwise the old code keeps running.
2. If you cannot patch right away, reduce the exposure:
   • CVE-2026-109618: set a fixed memory_limit that scripts cannot override, keep post_max_size low and limit request sizes at the web server or proxy.
   • CVE-2026-109619: set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, in the configuration files (not through ini_set()).
3. Filter at the edge: block or watch Content-Type: multipart requests on applications that do not need uploads (CERT-FR recommendation). This is a stopgap, not a fix. Azure WAF and Cloudflare have published rules.
4. Detect exploitation: alert when php-fpm or apache2 starts a child process such as a shell, curl or wget: on a web server, that is a strong sign of successful code execution.
5. Check appliances (F5, NetScaler, Palo Alto Networks, Cisco) against their vendors' advisories as they are updated.