PHP2Shell is the nickname for two bugs in PHP’s own engine: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 under CVSS v4, and both allow unauthenticated remote code execution. In plain terms, an attacker sends ordinary web requests and ends up running commands on your server.
The first flaw corrupts memory when PHP runs out of it mid-request. The second leaves stale data behind after one request finishes, so the next request on the same worker can abuse freed memory. Neither needs a password, a plugin or a misconfiguration.
The fix is a version bump. The PHP security advisory lists the patched releases:
| PHP branch | Fixed release | Support status |
|---|---|---|
| 8.5 | 8.5.12 | Active support |
| 8.4 | 8.4.27 | Active support |
| 8.3 | 8.3.36 | Security fixes only |
| 8.2 | 8.2.35 | Security fixes only, end of life December 31, 2026 |
| 8.1 and older | No official release | Vendor backports only |
That last row is where most of the risk sits. On disclosure day, security firm Mallory counted about 2.6 million internet-facing services exposing a PHP version. Roughly 73.5% of them ran PHP 8.1 or older.
Why Patched WordPress Sites Were Still Exposed to the PHP Vulnerability
Many teams felt safe because their CMS was current. It didn’t matter. PHP2Shell lives in the runtime underneath the application, so WordPress, Drupal, Joomla, Magento and custom Laravel apps were all exposed until PHP itself was updated.
Wiz showed this directly. Its researchers ran unauthenticated code execution against current container images of WordPress, Drupal and Joomla. Security plugins and CMS updates did nothing, because the bug sits below them.
This is the blind spot worth taking to your next leadership meeting. Most patch programs track applications well and runtimes poorly. Who owns the PHP version on the marketing microsite a vendor built in 2021? Often nobody.
Two details make it worse:
- Version numbers can lie. Ubuntu, Debian and Red Hat backport fixes into the version they already ship. A patched Ubuntu 24.04 server still reports PHP 8.3.6, which looks older than the fixed 8.3.36. Check the vendor advisory and package changelog, not just
php -v. - Old branches have no fix. PHP 8.1 and earlier get no official release. If you’re still there, PHP2Shell is a forcing function for legacy system modernization, not a one-off patch ticket.
An AI-Discovered Vulnerability That Attackers Reached First
PHP2Shell is the first internet-scale flaw where AI got the headline. Researchers at Calif found one of the bugs using an AI system, working with OpenAI. Wiz found and reported both independently, using AI-assisted tooling. Its technical write-up explains the chain step by step.
The nuance matters. AI didn’t find these bugs on its own. Human researchers used models to form hypotheses and test them faster, then PHP maintainers wrote the fixes. That’s the realistic picture: AI as a force multiplier for skilled people, on both sides.
And the attacking side kept pace. Amazon’s threat intelligence team logged a PHP2Shell exploitation attempt on October 17, four days before the patch existed. After disclosure, threat actors were seen using agentic AI platforms for post-exploitation work on compromised servers. If your team is exploring agentic analytics and similar tools, assume attackers are running the same playbook.
The takeaway for CIOs is simple. The gap between “a flaw exists” and “someone is exploiting it” is shrinking, and AI is why. More AI coverage for IT leaders lives in our AI & Automation section.
PHP2Shell Checklist: What CIOs Should Do This Week
If your team hasn’t closed this out yet, here’s the order that matters:
- Find every PHP runtime. Start with internet-facing systems: websites, customer portals, vendor-hosted microsites, internal tools exposed through a VPN. Include containers and shared hosting.
- Apply the PHP security update. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the backported package from your Linux vendor.
- Restart PHP workers. Running processes keep the old code in memory. A patched package with unrestarted PHP-FPM is still vulnerable.
- Verify, don’t assume. Confirm the fix through vendor advisories and package changelogs that name CVE-2026-109618 and CVE-2026-109619.
- Hunt from October 17. Review web and server logs from that date onward. Look for new admin accounts, unfamiliar files in web directories and unusual outbound traffic.
- Treat WAF rules as a bridge. Cloudflare and others pushed temporary rules, which buy time. They don’t replace the patch.
- Ask your vendors in writing. Any SaaS or agency running PHP on your behalf should confirm their patch date.
One more date belongs on your roadmap now: PHP 8.2 reaches end of life on December 31, 2026. Anything on 8.2 today needs a migration plan, not just this patch.
Rethinking Patch Management After PHP2Shell
Patching PHP is the easy part. The harder question is whether your process would handle the next one faster. A monthly patch cycle assumes you have weeks. PHP2Shell gave defenders negative four days.
Three changes are worth pushing for:
- Own the runtime layer. Every PHP, Node.js, Java and Python runtime needs a named owner and a version on record. If an asset inventory stops at the application name, it’s incomplete.
- Pre-approve emergency changes. Agree in advance which systems can be patched or taken offline within hours, and who signs off. Several governments chose to go dark rather than wait. Your board should know you’d make the same call.
- Budget for the boring upgrades. Unsupported runtimes turn every critical CVE into a crisis. Clearing old PHP branches costs less than one incident response.
None of this is new advice. What’s new is the speed. When AI helps researchers and attackers find flaws faster, the teams that win are the ones who already know what they run. For more on making that case to the business, see our CIO Leadership coverage.
PHP2Shell FAQ
Which PHP versions are affected by PHP2Shell?
Every release before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, including end-of-life branches. PHP 8.1 and older get no official fix, only vendor backports.
Is WordPress affected by PHP2Shell?
Yes, if the server runs a vulnerable PHP version. Updating WordPress or its plugins doesn’t fix it. Only updating PHP does.
Is a WAF enough to stop PHP2Shell?
No. Web application firewall rules can block known attack patterns while you patch. They don’t remove the vulnerability.
How do I check if a server is patched?
Check the PHP version against the fixed releases. On Ubuntu, Debian or Red Hat, check the package changelog for CVE-2026-109618 and CVE-2026-109619, since backported fixes keep the old version number.
Was PHP2Shell really discovered by AI?
AI helped. Human researchers at Calif and Wiz used AI models to speed up finding and confirming the bugs. PHP’s maintainers wrote the fixes.