PHP2Shell is a pair of critical vulnerabilities in the PHP engine itself — CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 — that allow unauthenticated attackers to run code on affected web servers and, in one case, read sensitive process memory. On October 21, 2026, the PHP project released emergency patches for its supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Nearly every PHP release dating back to 5.4 is affected by at least one of the flaws, which means the fix you need depends entirely on which branch your server runs.
Understanding PHP2Shell: A Critical Web Infrastructure Threat
What makes PHP2Shell unusual is where the flaw lives. This is not a bug in a plugin, a theme or a specific application — it is a defect in PHP itself, the interpreter that executes code for a huge share of the world's websites. The Abstract Security Threat Research Organization, in a flash report published the day the patches shipped, described both flaws as allowing unauthenticated remote code execution as the web worker account, with one also permitting unauthenticated disclosure of PHP worker process memory.
Sansec's forensics team, which published its analysis the same day, reported that researchers had confirmed unauthenticated RCE against Magento 2.4.9 and ten other PHP applications, and warned that writeups and an exploit tool were already public. Their guidance was blunt: update PHP on every server, and if patching within the hour is not possible, apply temporary mitigations. Armis added that early exploitation was reported — including by Cloudflare — before and immediately after the patch release, with mass scanning and attacks expected.
Why Core Language Flaws Matter: PHP's Foundational Role
To understand the blast radius, it helps to picture the stack. When a browser requests a page from a site built on WordPress, Joomla, Drupal or Wikipedia's MediaWiki, the web server hands the request to PHP, which executes the application's code and returns the result. PHP sits beneath every one of those applications. Wiz Research, which attributed the discovery to AI-assisted analysis, notes that PHP powers roughly 70% of all websites in the world.
That layering is why a core-engine flaw is more severe than a typical application-level bug. If a WordPress plugin is vulnerable, only sites running that plugin are exposed — and a diligent administrator can remove or update it. But a flaw in PHP itself, as Wiz put it, is "independent of the application running on top of it." A site can have perfectly maintained, secure application code and still be fully exposed, because the interpreter underneath it is the thing being attacked. The vulnerability cascades across the entire ecosystem at once.
