PHP2Shell: 8 Key Questions Answered

PHP2Shell could enable remote code execution on millions of servers, compromising systems, networks, and sensitive data belonging to organizations worldwide

On October 20, it was revealed that PHP, the programming language used by 70% of websites worldwide, contained two vulnerabilities that could enable remote code execution (RCE). These critical vulnerabilities are collectively known as PHP2Shell.

The PHP Foundation announced that it was already working on security updates to patch both vulnerabilities, which would be released the following day, October 21.

During the period before the security updates were released, numerous companies and, particularly, public-sector organizations chose to take their PHP-based systems offline, following recommendations from national cybersecurity authorities such as the US Cybersecurity and Infrastructure Security Agency (CISA) and Spain’s National Cybersecurity Institute (INCIBE).

PHP2Shell is not only one of the year’s biggest cybersecurity stories; it also highlights several issues that are critical to organizational security and business continuity:

• The role of AI in vulnerability discovery and exploitation, and the speed at which these activities can now be carried out.
• Software supply chain security.
• Vulnerability management.

Below, we examine eight key questions about PHP2Shell and explain the importance of continuous security assessments and vulnerability management in protecting organizations.

1. What is PHP2Shell?

As mentioned above, PHP2Shell actually encompasses two distinct vulnerabilities:

• CVE-2026-109618. A vulnerability that enables remote code execution through memory corruption during an out-of-memory (OOM) condition.
• CVE-2026-109619. This vulnerability also enables remote code execution, in this case through stale global state pointing to request memory.

Both are memory-safety vulnerabilities affecting the PHP core engine. They can enable the disclosure of sensitive information stored in PHP process memory and unauthenticated code execution, potentially allowing attackers to install malware on compromised servers.

These vulnerabilities exist independently of the application running on PHP. Consequently, any website developed using this programming language could potentially be affected by PHP2Shell.

It is therefore unsurprising that both vulnerabilities have been classified as critical, with a CVSS score of 9.2 out of 10.

Considering that PHP is used by WordPress, Drupal, and Joomla, some of the world’s leading content management systems, as well as thousands of other applications, it is easy to understand why these vulnerabilities have raised widespread alarm.

2. Which systems are affected by PHP2Shell?

All PHP versions from 5.4.0 through 8.5.11 are affected by at least one of the two vulnerabilities.

However, as discussed below, fixes are already available for certain supported release branches: 8.2, 8.3, 8.4, and 8.5. Earlier versions are no longer officially supported and may not receive security patches.

The PHP project itself has warned that all PHP installations processing web requests are potentially at risk, including those using:

• PHP-FPM.
• Apache with mod_php.
• php-cgi.
• FrankenPHP.
• LiteSpeed.

However, the greatest risk concerns servers running Apache with mod_php, as an exploit has been identified that can trigger an attack before any application code is executed.

3. What can malicious actors do by exploiting these vulnerabilities?

According to a warning issued by the US National Security Agency (NSA), malicious actors exploiting PHP2Shell could take control of servers running vulnerable PHP versions without requiring authentication or prior access.

Once they have compromised a server, attackers could:

• Execute malware.
• Steal sensitive data.
• Modify websites hosted on the server.
• Disrupt services.
• Move deeper into the network.
• Fully compromise a system.

Many organizations do not operate dedicated servers, instead relying on shared hosting infrastructure alongside other businesses.

Consequently, an attack against a single server could have serious repercussions for multiple organizations simultaneously.

4- Is PHP2Shell already exploitable?

Yes. Even before the patches were released, proof-of-concept (PoC) exploits were already circulating, enabling attackers to target vulnerable servers.

In fact, INCIBE has reported that attacks against PHP servers were observed before the security updates became available.

Furthermore, some companies, including a leading multinational content delivery network (CDN) provider, have already reported detecting attacks.

This explains why, during the period between the public disclosure of the vulnerabilities and the release of security patches, many organizations chose to take their websites offline to prevent the consequences outlined above.

5. How can an organization determine whether it has been targeted by an attack exploiting PHP2Shell?

First, public authorities such as the FBI recommend that organizations maintain an inventory of assets running PHP and identify the version deployed on each system, prioritizing internet-facing assets.

This assessment must also account for PHP components embedded in software supplied by third-party technology vendors.

Second, organizations should monitor web servers running PHP for suspicious activity, such as unexpected command execution or file downloads.

What should happen if potentially malicious activity is detected?

The organization should activate its incident response plan and immediately isolate the affected systems.

6. How can PHP2Shell be remediated?

By installing one of the four security updates released by the PHP Foundation:

• PHP 8.5.12.
• PHP 8.4.27.
• PHP 8.3.36.
• PHP 8.2.35.

Although PHP versions earlier than the 8.2 branch have reached end of life and are no longer officially supported, the severity of PHP2Shell prompted the PHP security team to publish minimal source-code patches for PHP 7.4, PHP 8.0, and PHP 8.1.

What about systems that cannot be updated immediately?

Although the PHP project has outlined several measures to reduce exposure to attacks, these do not fully remediate PHP2Shell.

For example, setting memory_limit=-1 is recommended, while ensuring applications cannot override this setting, such as by using php_admin_value in the FPM pool or Apache configuration.

This mitigates the issue related to PHP’s configurable memory limit, but it does not resolve the underlying vulnerability.

For this reason, leading cybersecurity authorities, including INCIBE, CISA, and the NSA, emphasize that applying the security updates is the only way to fully remediate PHP2Shell.

Until affected systems can be updated, isolating them from the internet is recommended to prevent security incidents.

7. How were these critical vulnerabilities discovered?

Beyond its potential impact on thousands upon thousands of organizations worldwide, the disclosure of PHP2Shell has attracted considerable attention because of how the vulnerabilities were discovered.

More precisely, because of how researchers demonstrated that they were exploitable rather than merely theoretical weaknesses.

The vulnerabilities had actually existed in the PHP core for years. An out-of-memory vulnerability in PHP was identified in 2020 and identified again in 2024.

However, researchers were unable to demonstrate that it could be exploited, and consequently, it was not patched.

The use of frontier AI models subsequently made it possible to demonstrate that the vulnerabilities collectively known as PHP2Shell were indeed exploitable and could enable remote code execution.

The teams that established the exploitability of these vulnerabilities notified the PHP project in August.

The project began developing security patches, and coordinated disclosure of both the vulnerabilities and the security updates was scheduled for October 22, with the aim of preventing thousands of systems from being exposed to attacks.

However, information about the vulnerabilities leaked on October 20, accelerating the sequence of events.

What are the main lessons from the discovery of PHP2Shell?

1. Collaboration between cybersecurity companies and software developers is essential to protect businesses, public-sector organizations, and society as a whole against cyberattacks.
2. AI is already enabling the discovery and exploitation of long-standing software vulnerabilities that had previously gone unnoticed or whose exploitability had not been demonstrated.
3. The time required to identify a vulnerability and develop a proof-of-concept exploit is becoming increasingly short. Within hours of PHP2Shell becoming public, exploitation attempts had already been detected and proof-of-concept exploits were circulating. Vulnerability remediation processes must therefore become faster as well.
4. Vulnerability management is more critical than ever and must be both efficient and agile. Organizations need to continuously monitor their entire technology infrastructure and remediate vulnerabilities as quickly as possible.

8. Why are security assessments and vulnerability management essential?

PHP2Shell also highlights the importance of cybersecurity services in identifying weaknesses and remediating them before they can be exploited and lead to security incidents.

Which services are particularly relevant?

1. Continuous security assessments of web applications and servers. This type of assessment combines automated tools with analysis performed by cybersecurity experts to maximize the identification of weaknesses and threats that could compromise the security of web applications and their underlying infrastructure.

Performing targeted security tests in accordance with established industry methodologies, such as those developed by OWASP, makes it possible to identify weaknesses related to:

• Server infrastructure.
• Insecure coding practices.
• Application-specific business logic.
• Failure to follow security best practices.

The objective is to identify configuration, authentication, or application logic weaknesses that could enable unauthorized access to sensitive information, user impersonation, data theft, or server compromise.

2. Vulnerability management. This type of service enables organizations to maintain a classified asset inventory with clearly assigned owners for each asset.

Based on this inventory, all assets can be continuously monitored to identify weaknesses, prioritize remediation, and prevent risks associated with outdated or end-of-life software.

Effective vulnerability management reduces the time required to detect and mitigate weaknesses, helping ensure that vulnerabilities are remediated before attackers can successfully exploit them.

Ultimately, companies and public-sector organizations must ensure that their websites and applications are not hosted on servers that have yet to be patched against PHP2Shell.

Otherwise, they risk experiencing security incidents that could compromise the information stored in their systems or disrupt their operations.