PHP2Shell: Critical PHP Vulnerabilities Leaked and Exploited Before Patch Released

Two critical remote code execution vulnerabilities in the core PHP language, together nicknamed "PHP2Shell," leaked online on October 20 before official patches were ready, giving attackers a head start. Security researchers confirmed active exploitation in the wild even before the public disclosure.

What Happened

On October 20, details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked online ahead of their planned coordinated disclosure. The PHP security team had already scheduled an emergency release for October 21, and pushed it out as planned, about 26 minutes earlier than announced, releasing PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix both flaws.

Both vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, among the most severe ratings a vulnerability can receive, and allow an unauthenticated attacker to run arbitrary code on a vulnerable web server with no login required.

Key Highlights

• CVE-2026-109618: A remote code execution flaw triggered by PHP's out-of-memory error handling. When PHP runs out of memory mid-request, it can leave internal request data only partially initialized, and the subsequent cleanup process may treat that invalid data as valid.
• CVE-2026-109619: A remote code execution flaw caused by PHP retaining request-specific internal state after its backing memory has already been freed. A later request handled by the same worker process can end up using that stale, freed state before normal initialization resets it.
• Affected versions: All PHP versions from 5.4 through 8.5.11, essentially the entire modern PHP ecosystem.
• Already exploited: Amazon Threat Intelligence traced exploitation attempts back to October 17, four days before public disclosure. Cloudflare and security firm watchTowr both independently observed in-the-wild exploitation before the patch was released.

Who's Affected

PHP powers a huge share of the web, including WordPress, which runs roughly 40% of all websites, along with countless custom applications and content management systems. According to PHP's advisory, every deployment method that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

For WordPress site owners specifically, the fix sits below the application layer. Keeping WordPress, themes, and plugins updated does not protect against this vulnerability, because the flaw lives in PHP itself. The only real fix is updating the underlying PHP version, something most WordPress users rely on their hosting provider to handle rather than doing themselves.

What You Should Do Right Now

1. If you manage your own server and install PHP via your OS package manager, apply your vendor's updated packages as soon as they're available.
2. If you manage PHP manually, update immediately to one of the fixed releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
3. If you run WordPress through a hosting provider, check whether your host has already applied the fix. Several major hosts, including SiteGround, moved quickly to patch their infrastructure ahead of the public release.
4. As a partial, temporary mitigation for CVE-2026-109619, PHP confirmed that setting session.upload_progress.enabled = 0 in your PHP or server configuration blocks one attack path, though this does not fully close either vulnerability and should not replace updating PHP itself.

Why This Matters

A pre-disclosure leak combined with confirmed in-the-wild exploitation is close to a worst-case scenario for a vulnerability of this severity: defenders had less lead time than usual, while attackers effectively got an early start. Given how foundational PHP is to the modern web, from small personal blogs to large-scale enterprise applications, the practical urgency here is real rather than theoretical. If you run PHP anywhere, checking your version today is worth the five minutes it takes.

Frequently Asked Questions

What is PHP2Shell? A nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow an attacker to remotely run code on a PHP-powered server without logging in.

Is my WordPress site affected? Possibly, if the server it runs on hasn't updated PHP. Updating WordPress, themes, or plugins does not fix this, since the vulnerability is in PHP itself, not WordPress.

How do I know if I'm patched? Check your PHP version. You need 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or later, depending on which major version you run.

PHP2Shell is a reminder that foundational infrastructure, the layer most developers never think about day to day, can become the most urgent security problem overnight. If you're responsible for any PHP-based site or application, confirming your PHP version is up to date should be at the top of today's list.

Sources: Huntress, Codeable, SiteGround, Wikipedia, watchTowr, Google Cloud, Cisco. Information is accurate as of October 22, 2026 and may be updated as more details emerge.