PHP2Shell: Two Critical PHP Flaws Platform Teams Must Patch Now

Every PHP version from 5.4 through 8.5.11 is exposed to two critical flaws, nicknamed PHP2Shell, that can let an unauthenticated attacker run code on a server. Patches shipped on October 21, a day earlier than planned after the disclosure leaked, and proof-of-concept exploits were already circulating. For platform teams, the job is to find every PHP runtime they own, including the container images nobody has rebuilt in months, and get them onto a patched release.

What Happened

The PHP Foundation’s release post lists the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws sit in memory management and error handling, code nearly every request touches.

• CVE-2026-109618: if a request hits PHP’s memory_limit at the wrong moment, partially initialized data can later be treated as valid. On Apache with mod_php, an unauthenticated request can trigger it before any application code runs, and full remote code execution was shown with default settings. RCE was also confirmed on PHP-FPM through application code paths.
• CVE-2026-109619: a fatal error can leave internal state pointing at memory from a previous request, which a later request on the same worker may use. The reporter demonstrated RCE against a real application on Apache with mod_php.

The official severity is 9.2, not the 10.0 that circulated with the leak. PHP is not releasing fixes for 8.1 or earlier, which are end of life.

How It Was Found

AI tools were part of the discovery. The PHP Foundation says an OOM problem with the same root cause was first spotted in 2024, but the team couldn’t agree on a fix with acceptable trade-offs. Through OpenAI’s Patch the Planet program, security firm Calif reported an unconditional RCE on August 11, and OpenAI independently reported the same root cause that day. Wiz Research says it found the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported on August 24.

The disclosure then went wrong. CVE IDs leaked on October 20, Calif mistakenly published a proof-of-concept video, and Chainguard published patched images more than six hours before the coordinated release. Stack Archive has covered how AI shrinks the window between a patch and a working exploit, and that is the risk here.

What This Means for Platform Teams

Google Cloud’s guidance is a useful map even for teams on other clouds, because it separates what patches itself from what doesn’t:

As a stopgap, Google recommends Cloud Armor managed rules, at minimum the File Upload and RFI categories, plus a rule blocking oversized request bodies, since these flaws can use large payloads to force out-of-memory conditions. It advises testing in preview mode first, because WordPress and Drupal sites vary widely in how they handle requests.

Source: The PHP Foundation

Content created with AI assistance and reviewed for accuracy.