PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP2Shell comprises two critical remote code execution vulnerabilities tracked as CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state) with a CVSS score of 9.2. These vulnerabilities reside in PHP's core memory management and error handling, affecting nearly all PHP versions since 5.4. They allow unauthenticated attackers to execute arbitrary code on servers running PHP with web request handling, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Exploitation attempts were observed in the wild concurrent with patch releases. The vulnerabilities also permit reading sensitive process memory, risking exposure of credentials and API keys. Patches were released in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, and minimal backports for 7.4, 8.0, and 8.1. The PHP Foundation coordinated a rapid disclosure following an early leak and public PoC release. Mitigations short of patching reduce exposure but do not fully secure installations.

Successful exploitation of these vulnerabilities allows unauthenticated remote code execution on affected PHP installations, potentially leading to full server compromise. Attackers can also read sensitive process memory, exposing credentials, API keys, and other secrets. Given PHP's widespread use powering approximately 70% of websites, including major CMS platforms, the impact is extensive. Exploitation attempts have been detected in the wild, increasing the urgency for patching. The vulnerabilities undermine the security of web applications even if their own code is secure, due to flaws in PHP's core engine.

Official patches addressing these vulnerabilities are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and minimal backports for 7.4, 8.0, and 8.1. Immediate application of these updates is strongly recommended. Where patching is not feasible, users can implement measures to reduce exposure to specific attack paths; however, these do not guarantee safety. The PHP Foundation and security vendors have deployed some protective measures, but patching remains the primary and most effective mitigation. Organizations should prioritize identifying PHP installations and applying updates urgently.