PHP2Shell: Critical PHP RCE Flaws — Complete Patch and Audit Guide

The story: a leak, a countdown, and a four-day head start for attackers

On October 20, 2026, two CVE identifiers started circulating on Hacker News and social media before any fix existed. The PHP security team had a release scheduled for October 22 — and moved it up a day, publishing the emergency update on October 21 at 14:00 UTC. The reason, per the PHP Foundation: the identifiers had leaked, and an exploit demonstration video was already public.

Then the timeline got worse. Amazon Threat Intelligence reported an exploitation attempt against its MadPot honeypot network on October 17 — four days before public disclosure — followed by more attempts on October 21 with payloads and infrastructure suggesting multiple actors. Cloudflare's CTO said the company was "seeing early attacks emerging" and shipped WAF rules to all customers, including the free tier, as a stopgap. watchTowr reported it reproduced both flaws and observed exploitation attempts against both.

The research credited by the PHP Foundation — Calif, OpenAI, and Wiz — has an uncomfortable detail for the industry: Calif and Wiz both said they used AI models in their research. The same class of tooling that found the bug can be pointed at unpatched servers. We covered a very different face of this problem in Google's Gemini incident: when AI agents breached three real companies — worth reading alongside this one, because both stories end with the same lesson: the patch window is now an AI-speed problem.

Quick Answer

The two flaws, in plain words

You do not need to be a C developer to understand what broke. Both flaws live in the same place: the gap between "a request died mid-processing" and "the worker cleans up and moves on."

The first flaw works like this: PHP enforces your memory_limit by aborting the offending request — think of it as an emergency brake. The bug is that when that brake fires at the wrong moment, the request's data is only half-built, and the cleanup crew that follows treats that half-built data as finished, valid instructions. An attacker can deliberately run the engine out of memory using nothing more exotic than a crafted form upload that stays within normal-looking limits — a request without a usable content length, or multipart parts carrying enormous numbers of headers.

The second flaw is a classic use-after-free wearing modern clothes. A PHP worker handles many requests in a row. After a fatal error, some global state — session data, error handlers, object and extension state — still points at memory that has already been freed. The next request served by that same worker can walk into that stale state before normal initialization resets it. Researchers demonstrated not just code execution this way, but also reading the worker's memory — which is where credentials and tokens live.

Who is affected — the honest matrix

PHP's advisory is blunt: every installation that serves web requests is at risk. But the risk is not equal everywhere.

Scale, for those who want it: W3Techs tracks PHP at 69.3% of websites whose server-side language is known. Researcher estimates of internet-exposed PHP hosts ranged from roughly 1.3 million to 1.9 million in the days after disclosure. Calif, the research group credited by the PHP Foundation, said it confirmed pre-authentication RCE against specific versions of WordPress, Drupal, Joomla, and Magento.

The version trap most guides skip

This is where a lot of coverage gets vague, so here is the full picture with nothing smoothed over:

Read that table twice if you manage older applications. The uncomfortable truth: if you are on PHP 8.1 or older, there is no package update coming for your exact branch. The PHP security team published minimal source backports for 7.4 through 8.1 for organizations that build PHP from source — that is a stopgap for fleets with hard compatibility constraints, not a home for your application long-term. The end-of-support treadmill is the same one Windows administrators know well; we track the Windows side of it in Is Windows 10 still safe? — the security math is identical on any platform.

The fix ladder — run it in order

Cannot patch today? The documented mitigations — and their limits

For servers that genuinely cannot update immediately, the PHP advisory lists these configuration changes:

• For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override. This removes the out-of-memory abort path the flaw abuses — at the cost of removing your memory safety net, so a runaway application can now consume all server RAM. PHP suggests a container or cgroup memory limit as the availability boundary if you go this route.
• For CVE-2026-109619: set session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0.
• Restart every PHP worker after making these changes — stale state already in memory is exactly what the second flaw feeds on.

Beyond PHP's own guidance:

• If you are behind Cloudflare: WAF rules covering the known exploit vectors were deployed to all customers, including the free tier. Cloudflare itself calls this a stopgap — it only covers traffic routed through Cloudflare, and new variants may not match the rules.
• CERT-EU's recommendation for organizations that cannot update right away: consider isolating internet-facing applications from public networks until the fix is applied and verified.
• CISA's recommendation for anything unpatchable or unsupported: take it offline.

How to check whether you were already hit

Amazon's guidance deserves emphasis: start investigations from at least October 17, not from the disclosure date — that is when the first honeypot exploitation attempt landed. Work through this checklist on every PHP host:

Do this, never that

Why this keeps happening — and what it means for you

This is not PHP's first rodeo with the CISA Known Exploited Vulnerabilities catalog. CVE-2024-4577 (PHP-CGI argument injection) and CVE-2019-11043 (PHP-FPM RCE on nginx) are both in KEV, and both have known ransomware use. PHP2Shell had not been added to KEV as of October 23 — but with in-the-wild exploitation already reported by multiple teams, the pattern is familiar: pre-auth engine flaws get productized fast, and the victims are rarely the interesting targets, just the unpatched ones.

The second lesson is the AI one. The disclosure credits — Calif, OpenAI, Wiz — include two teams that said they used AI models to find this. Attackers read the same advisories. The practical consequence for an administrator is simple: the viable patch window is shrinking, and "we'll get to it this quarter" is no longer a plan. Every serious security program we have covered — from AI agent containment to email authentication — reduces to the same discipline: know what you run, and patch it while the patch is boring.

Frequently asked questions

The bottom line

PHP2Shell is the rare vulnerability where the official guidance contains no nuance to debate: update to a fixed version, restart your workers, and — if you cannot — shrink your exposure deliberately instead of hoping. The flaws fire before your application code runs, the exploit had a four-day head start on the patch, and the memory-disclosure impact means credentials that crossed a compromised worker should rotate even when nothing else seems wrong. The version table above is the whole decision tree; everything else in this guide is execution. More security walkthroughs and hardening checklists live in All Guides, and our client-side security tools — including the Email Header Forensic Analyzer — are collected in the Pro Tools Hub.