PHP2Shell is the name given to two critical vulnerabilities in the PHP programming language, disclosed on October 21, 2026. They can allow an unauthenticated attacker to execute commands on a vulnerable server remotely.
What makes it dangerous?
- Remote code execution (RCE): An attacker may run commands on a server without first logging in.
- Sensitive data exposure: Exploitation may expose secrets held in PHP worker memory.
- Broad potential impact: The risk applies to PHP installations serving web requests, not just to any particular website platform.
What are the vulnerabilities?
| CVE | Description |
|---|---|
| CVE-2026-109618 | Memory corruption associated with out-of-memory error handling |
| CVE-2026-109619 | A use-after-free flaw involving stale internal state |
Both have a reported severity score of 9.2 out of 10 (CVSS 4.0).
How PHP2Shell works?
1. Attacker sends a crafted HTTP request
- An attacker may run commands on a server without first logging in.
- Exploitation may expose secrets held in PHP worker memory.
- The request targets vulnerable behavior in PHP itself, potentially before an application executes its normal application-level security checks.
2. PHP encounters a memory-safety flaw
The vulnerabilities involve memory corruption and a use-after-free condition associated with PHP’s upload-progress handling.
3. Potential server compromise
Depending on the exploit, an attacker may execute commands with the PHP worker’s privileges or expose sensitive data held in memory, including credentials and tokens.
Which PHP versions are affected?
- PHP 8.5
- PHP 8.4
- PHP 8.3
- PHP 8.2
- PHP 8.1 and older
How do you protect against it?
The PHP project released fixes for supported branches:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Important: A further PHP vulnerability, CVE-2026-115560, was reported on October 23 and is not fixed by the October 21 PHP2Shell updates. The PHP security team recommends disabling session upload progress as a temporary mitigation: session.upload_progress.enabled = Off.