PHP2Shell Patches Land After a Two-Year Security Stall

PHP shipped emergency patches on October 21 for two unauthenticated remote-code flaws nicknamed PHP2Shell. The fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The U.S. National Security Agency told operators who could not update at once to take the affected systems offline.

The bugs sit in the interpreter, not in WordPress, Drupal or any other app on top of it. Wiz, the Alphabet-owned cloud security firm that helped find them, puts PHP on 70 percent of websites. The PHP Foundation said it first saw one of the flaws in 2024 and then stalled for months on a fix.

Unauthenticated Code Execution, in the Interpreter Itself

Both defects are rated CVSS v4.0 9.2. Each can let a stranger run code as the web worker with no login. On Apache with mod_php, the project demonstrated a working exploit that fires before any application code runs.

CVE-2026-109618 is remote code execution through out-of-memory corruption. If a request hits PHP’s memory limit at the wrong instant, the engine can leave internal request data half-built and later treat that junk as valid. CVE-2026-109619 is remote code execution through stale global state. A fatal error can leave a worker pointing at memory that already belongs to a finished request, so the next request on that worker uses freed heap.

THE TWO PHP2SHELL FLAWS

The PHP project’s security advisory for both critical flaws lists every setup that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest on mod_php. Wiz also showed a Heartbleed-style read of process memory, which can expose passwords, tokens, API keys and certificates from other requests on the same worker.

A patched WordPress tree on a vulnerable PHP build is still exposed. So is a ten-line hello-world script. This is an inventory problem first.

PHP’s Security Team Called the 2024 Delay a Structural Failure

In 2024 the Foundation used German Sovereign Tech Agency money, routed through OSTIF, to hire Quarkslab for PHP’s first external core audit in years. The audit logged 27 issues, 17 of them with security implications: 3 high, 5 medium, 9 low. While a contracted core developer was fixing one of those findings, the team saw the first signs of the out-of-memory bug that is now CVE-2026-109618.

A potential exploit was theorized that year. No concrete path to remote code execution was found, and other bugs with clearer impact took priority. Several repair designs were drafted. Each one threatened compatibility, opened a denial-of-service hole, or demanded changes across third-party extensions the team did not believe it could coordinate.

The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.

The PHP Foundation, October 21, 2026

The Foundation later called the delay a structural failure in public, which is rare for a project that still runs on a mix of volunteers and a thin paid staff. Its 2024 transparency report put donations at $683,550 and pay to developers at $635,487, for a roster of 10 people on part-time or full-time contracts plus 8 volunteer board members.

The security team has since moved toward majority votes instead of full consensus. That change did not arrive in time for the 2024 OOM file.

How Frontier Models Finished the Exploit Chain

Calif, a California security firm, joined OpenAI’s Patch the Planet program and began an audit of PHP on July 30. On August 11, researcher Ryan A at Calif reported unconditional remote code execution with the same root cause the Foundation had filed in 2024. OpenAI independently reported that root cause the same day. Wiz reported both flaws on August 24, after confirming unauthenticated code execution against Drupal on August 20 and WordPress on August 21.

Wiz used its Atlas tooling with Gemini 4 Argon and GPT-5.6 Sol. Calif used GPT-5.6 Sol. Wiz wrote that the findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history, because the underlying flaws had sat for decades while the exploit chain sat at the edge of what human researchers could finish. Frontier models, the firm said, cut that barrier and turned a longstanding flaw into an exploit. Wiz traces at least one of the bugs to PHP 5.4, shipped in 2012.

From August 11 the Foundation made the OOM problem the top job for everyone on security, including weekend and overnight shifts. OpenAI sent more attack vectors on September 18. Trail of Bits has been auditing PHP as well.

The same tools are now flooding the inbox. Alexandre Daubois, who joined the Foundation in July to help triage reports, said the team has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates, or would not reproduce. A person still makes every call and every patch. The models only multiply the paper.

Berlin and Paris Took Government Sites Offline

Germany’s Federal Ministry for Digital Transformation and Government Modernisation took some sites down as a precaution. France’s Ministry of the Interior deactivated official sites for local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic also shut sites to apply the patch. Japanese Prime Minister Sanae Takaichi posted a public warning.

The NSA said PHP2Shell could let attackers take over web servers with no prior access, then steal data, cut services, or move deeper into a network. If an immediate update is not feasible, the agency said organizations should take the system offline until fully mitigated. CISA, which said it had not observed exploitation at the time it published, told operators who cannot update, or who still run PHP 8.1 or earlier, to take PHP-based systems offline until patched.

Those orders treat the interpreter as the product. Updating a CMS plugin does not close either hole.

Thousands of Attacks Became Millions After the Announcement

The coordinated release was set for October 22 at 14:00 UTC. On October 20 at about 15:00 UTC the two CVE identifiers began circulating, with a wrong release time and a wrong score of 10.0. No technical details leaked in that first wave. PHP pulled its pre-announcement forward to 19:30 UTC and moved the release one day earlier, to October 21 at 14:00 UTC, so distributors still packaging the fix would have a path for users.

HOW THE DISCLOSURE BROKE

1. July 30, 2026: Calif starts its Patch the Planet audit of PHP.
2. August 11, 2026: Calif and OpenAI report remote code execution on the 2024 OOM root cause.
3. August 24, 2026: Wiz reports both flaws after confirming code execution on Drupal and WordPress.
4. October 20, 2026, about 15:00 UTC: CVE identifiers leak; PHP pre-announces at 19:30 UTC and brings the release forward one day.
5. October 21, 2026, 07:41 UTC: Chainguard publishes built images with the fix more than six hours before the coordinated release.
6. October 21, 2026, 14:00 UTC: PHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Around 20:00 UTC on October 20, Calif mistakenly posted a video of its proof of concept against several targets. Copies spread after the takedown. The Foundation said that video sped up other proofs of concept on October 21. It also said mitigation notes shared with a few critical-infrastructure operators may have leaked. At the moment of public disclosure, the security team said it had not identified any functional exploits in the copies it inspected.

Chainguard’s early images, the Foundation wrote, let anyone study the fix in binary form while every other PHP user was still waiting. Cloudflare CTO Dane Knecht said the company’s WAF rules went live at 03:02 UTC, hours before the public release, and that attackers were already mutating payloads against those rules because of the leak. Plugin updates, he said, will not fix a flaw in the runtime.

Cloudflare CEO Matthew Prince posted attempt counts from the company’s network on October 22.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

— Matthew Prince 🌥 (@eastdakota) October 22, 2026

Those figures are exploit attempts, not confirmed breaches. CISA’s “not observed” note and PHP’s “no functional exploit at release” line can sit beside them without a fight: scanners lit up, and a confirmed mass compromise has not been posted by those agencies.

Who Still Needs a Patch on Unsupported PHP?

Palo Alto Networks said it had identified more than 22.6 million exposed instances that looked vulnerable. Ubuntu published patched packages across its supported lines, including ESM builds that go back to php5 on Trusty. That spread is the point: the interpreter is old, and so are a lot of the installs.

FIXED BUILDS AND WHAT IS LEFT BEHIND

PHP 8.1 and older no longer get updates from the project. The security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source or lack a vendor. The volunteer remirepo.net tree, the advisory said, would not have packages on release day.

Partial stopgaps exist and do not make a box safe. For CVE-2026-109618, PHP says to set memory_limit=-1 in a way apps cannot override, keep post_max_size low, and put size limits on the proxy. For CVE-2026-109619, turn session.upload_progress.enabled off and restart every worker; on 8.5, also set fatal_error_backtraces=0. Only the update closes the hole.

Shared hosts, forgotten VPS boxes, and appliances that vendor-lock an old PHP build are the slow cohort. A restart is required after the package lands, because old workers keep running the vulnerable code until they die.

Sponsoring the Next Fix Is Now the Foundation’s Pitch

The Foundation’s post is a patch note and a fundraising letter. Tools now find bugs faster than ever, it said, for defenders and attackers alike, and the number of reports will keep growing. What the tools cannot do is pick the right fix for a long-standing engine design, weigh the compatibility cost, and review the patch. That work still needs engineers who know the whole codebase, and the Foundation says there are too few of them.

WHO THE FOUNDATION ASKED TO PAY

• Product companies: Firms that build on PHP, asked to sponsor at a level that matches how much they rely on it.
• Hosts and clouds: Providers and distributions that ship PHP to millions of users.
• Governments: Public bodies whose services run on PHP, with the Sovereign Tech Agency’s 2024 audit cited as the model for sustained public money.

May 2026 brought an Ecosystem Security Team. Volker Dusch works as AI Security Engineer in Residence. Daniel Scherzer joined in September on hardening. Alpha-Omega scanned PHP with Anthropic’s Claude Mythos; the team later added OpenAI’s Daybreak Red to check reports and exploits. That is a professional shop in miniature, still attached to a language that Wiz says sits under 70 percent of the web.

The 2024 stall is the bill coming due. The team saw the OOM bug, could not agree on a repair, and left a theorized exploit on the table until Calif, OpenAI and Wiz showed remote code execution. Governments then turned sites off. The Foundation is now asking the same class of organizations that just spent two days in an emergency to put money under the people who have to make the next hard call before a model does.