Critical PHP2Shell Patches Released Amid Exploitation Attempts

The PHP Foundation has released security patches for two critical vulnerabilities, identified as PHP2Shell, which could potentially allow attackers to execute unauthenticated remote code. These vulnerabilities have been assigned the CVE identifiers CVE-2026-109618 (related to out-of-memory corruption) and CVE-2026-109619 (pertaining to stale global state) and carry a CVSS score of 9.2, denoting their severity.

Details of the Vulnerabilities

Both vulnerabilities are located within PHP’s core components that manage fundamental processes: memory management and error handling. According to the PHP Foundation, these issues exist in areas of the code that nearly all PHP requests interact with, which significantly increases their risk level. The impact is heightened by the inherent difficulty in correcting these issues due to their foundational nature within PHP itself.

The patches addressing these vulnerabilities have been incorporated into the following PHP versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Additionally, minimal source backports were made available for older versions including PHP 7.4, 8.0, and 8.1.

Exploitation Attempts Detected

Shortly after the patches were released, there were early indications of exploitation attempts targeting the PHP2Shell vulnerabilities. Preemptive attack surface management firm WatchTowr reported that it registered the first exploitation attempts via its sensors around the same time the patches were made available. However, none have succeeded so far, as confirmed by WatchTowr's head of threat intelligence, Jake Knott, who cautioned that the situation could quickly change.

Prior to the patch release, there were already signs of exploitation attempts made against these vulnerabilities, with multiple cybersecurity firms observing various approaches. Notably, Hadrian disclosed that PHP2Shell was being exploited at scale, primarily utilizing PHP’s session upload-progress path. Other firms, including Patchstack and Cloudflare, also noted attempts before the official patches were communicated to the public.

The Risks Associated with PHP2Shell

Both vulnerabilities pose a dual threat; they not only allow for remote code execution but could also enable attackers to read sensitive process memory. This memory may contain crucial information, such as credentials, API keys, and other confidential data.

This level of access presents a significant risk, often termed a 'goldmine' by cybersecurity experts. For instance, Shahak Shalev from Malwarebytes pointed out that exploiting these vulnerabilities could allow hackers to hijack legitimate websites, which could then be utilized for various malicious activities, including phishing and distributing harmful software—all while leveraging the compromised site's established trust among users.

Historical Context and Discovery

The vulnerabilities were initially discovered by a team from Wiz, along with collaborations from OpenAI and Calif, in August 2026. These vulnerabilities were unexpected given that similar issues had been identified much earlier; the root OOM flaw was initially discovered back in 2020. Notably, although it was reidentified during a PHP audit in 2024, it had not yet been patched due to the absence of demonstrated exploitability.

The subsequent discovery of the flaws' exploitability—transforming an out-of-memory issue into a remote code execution vulnerability—highlighted the challenges faced by researchers in uncovering such complex attack vectors. The PHP Foundation acknowledged that “these findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” Furthermore, the vulnerabilities have been present for several years, indicating a substantial oversight in the PHP structure, as indicated by Wiz in their extensive technical analysis of PHP2Shell.

Immediate Responses and Precautions

The planned disclosures attempting to broadcast the vulnerabilities were unfortunately marred by early leaks, which included a video detailing a proof-of-concept exploitation method. This premature distribution of information accelerated the development of various attack methods and posed risks to PHP users who had yet to apply the patches.

In an illustrative case, Chainguard released patched images six hours before the coordinated public disclosure, inadvertently allowing attackers to study the patch prior to the general public. As noted by the PHP Foundation, this incident undermined weeks of preparation aimed at a responsible disclosure of the vulnerabilities.

Adding to the urgency, Cloudflare implemented protective measures against the PHP2Shell vulnerabilities approximately nine hours before the official patch release. In light of these events, cybersecurity professionals emphasize the importance of having proactive measures and recovery strategies in place for critical infrastructure systems, enabling rapid response to unforeseen vulnerabilities.

Potential Impact on the Web

Given that PHP powers about 70% of all websites worldwide, these vulnerabilities have the potential to impact a vast number of platforms. Notably, PHP is the software behind major content management systems such as WordPress, Drupal, and MediaWiki, including Wikipedia—a severe risk when one considers that many applications might remain safe in their own code while being vulnerable through the underlying PHP engine.

According to cybersecurity experts, the release of 15 additional CVEs related to PHP vulnerabilities since July 2026 underlines the increasing scrutiny that PHP systems are currently facing, particularly due to the advent of AI-driven vulnerability discovery methods.

Key Takeaways

• The PHP2Shell vulnerabilities have a CVSS score of 9.2, indicating critical severity.
• Exploitation attempts began shortly after the vulnerabilities were disclosed, although none have been confirmed successful to date.
• PHP2Shell affects nearly all PHP versions since 5.4, posing a risk to about 70% of websites globally.
• Proactive measures deployed by firms like Cloudflare underline the need for quick responses to software vulnerabilities.
• The vulnerabilities may expose sensitive data such as credentials and API keys, making them a "goldmine" for attackers.

Conclusion

The release of these critical patches for PHP underscores the ongoing vulnerabilities inherent in foundational web technologies. The PHP2Shell vulnerabilities, despite their long-standing nature, exemplify how quickly early awareness of exposure can lead to proactive mitigation efforts in the cybersecurity landscape. Organizations utilizing PHP should not only enforce immediate patching protocols but also cultivate a comprehensive understanding of their infrastructure to better prepare for and respond to similar vulnerabilities in the future.