What is PHP2Shell? Inside the Critical Core PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

PHP2Shell is the collective moniker given to a pair of catastrophic runtime vulnerabilities discovered in the core C interpreter of the PHP programming language in mid-October 2026. Formally tracked under CVE-2026-109618 and CVE-2026-109619, both flaws carry a Common Vulnerability Scoring System (CVSS v4.0) base score of 9.2 (Critical).

Unlike common web vulnerabilities that emerge from buggy WordPress plugins, custom CMS modules, or flawed user input handlers, PHP2Shell resides deep inside the fundamental PHP runtime engine itself.

Crucially, an unauthenticated remote attacker can trigger remote code execution (RCE) by sending specially crafted HTTP requests to virtually any web server running an unpatched version of PHP—granting them interactive shell access with the privileges of the web worker process (www-data, apache, or nobody). This direct jump from a generic HTTP request to a shell prompt gave the vulnerability its name: PHP2Shell.

Think of a web application as a secure bank guarded by heavy vault doors and biometric locks. PHP2Shell doesn't bother picking the vault lock; it blows up the building's structural foundation before the guards even look at the visitor's badge.

The Key Takeaway

PHP2Shell represents a critical memory safety flaw residing silently in the PHP core for over 12 years (since PHP 5.4.0). It allows unauthenticated remote attackers to bypass application-level firewalls and acquire server shell access before application code executes. The PHP Group has released emergency security updates: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Every PHP-powered server must be updated immediately.

Why Did This Happen?

PHP powers more than 75% of dynamic websites across the global internet, anchoring content management systems like WordPress, Drupal, and Joomla, as well as millions of enterprise APIs.

While most modern developers focus on application-layer risks like SQL Injection (SQLi) or Cross-Site Scripting (XSS), PHP's core is written in C. Under the hood, the Zend Engine handles intricate memory allocations, garbage collection cycles, and state rollbacks between consecutive HTTP requests.

Uncovered through coordinated research involving Calif, Wiz, and OpenAI, PHP2Shell stems from subtle memory mismanagement during abnormal request termination and session upload tracking:

1. Over a Decade of Exposure: The vulnerable logic trace dates back to the introduction of native session upload progress hooks in PHP 5.4.0 (circa 2012).
2. Enabled by Default: The vulnerable upload tracking feature is enabled in standard out-of-the-box php.ini distributions (session.upload_progress.enabled = On).
3. Pre-Execution Target: Attackers do not need to identify specific file upload forms, login portals, or vulnerable plugins. Any URL routed through the PHP interpreter can trigger the exploit.

Technical Breakdown of the Vulnerabilities

PHP2Shell consists of two distinct but complementary CVEs:

+-------------------------------------------------------------------------+
|                          Incoming HTTP Request                          |
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
|                  Web Server SAPI Layer (PHP-FPM / mod_php)               |
+-------------------------------------------------------------------------+
          |                                                   |
          | [CVE-2026-109619]                                 | [CVE-2026-109618]
          v                                                   v
+-----------------------------+                     +---------------------+
| session.upload_progress     |                     | Out-of-Memory (OOM) |
| Multipart Upload Tracking   |                     | longjmp() Cleanup   |
+-----------------------------+                     +---------------------+
          |                                                   |
          v                                                   v
+-----------------------------+                     +---------------------+
| Use-After-Free (UAF) State  |                     | Dangling Pointers & |
| in Session Memory Table     |                     | Memory Corruption   |
+-----------------------------+                     +---------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
|        Heap Spraying Overwrites Zend Engine Function Pointers           |
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
|             Remote Code Execution (Unauthenticated Shell)               |
+-------------------------------------------------------------------------+

1. CVE-2026-109619: Use-After-Free in Upload Progress Tracking

• Component: The core session extension (session.upload_progress).
• The Mechanism: PHP provides a mechanism to track file upload progress in real-time by registering session arrays when a multipart form upload includes a specific progress identifier.
• The Flaw: When an attacker sends a crafted multipart HTTP request and abruptly terminates the connection midway, PHP initiates an early request tear-down. During cleanup, internal session tracking structures are freed from the heap, but global reference pointers are left dangling.
• The Exploit: By executing controlled heap spraying using simultaneous requests, an attacker can overwrite the freed memory chunk with forged function pointers (such as hijacking zend_call_function). Once the worker process dereferences the stale pointer, it transfers execution control directly into the attacker's shellcode.

2. CVE-2026-109618: Out-of-Memory (OOM) Desynchronization

• Component: Zend Memory Manager and exception-handling routines.
• The Mechanism: When a script exceeds its configured memory allocation (memory_limit), PHP invokes the standard C library's longjmp() mechanism to abort the current execution stack immediately and jump straight into cleanup.
• The Flaw: When an OOM threshold is crossed during complex object initialization, longjmp() skips mandatory destructor sequences, leaving internal request structures in an inconsistent, half-allocated state.
• The Exploit: Because persistent worker processes (such as long-lived PHP-FPM workers) reuse state between consecutive HTTP requests, subsequent requests can access or branch on this corrupted state, leaking sensitive memory (such as database credentials or API keys) or facilitating second-order code execution.

Why is PHP2Shell So Dangerous?

Security vendors categorize PHP2Shell as a critical emergency for three major reasons:

1. Execution Precedes Application Code (Pre-Execution Flaw)

In a typical software stack, security middlewares, authentication checks, and Web Application Firewalls (WAFs) filter out malicious requests before core logic executes.

With PHP2Shell, the SAPI interface (PHP-FPM, Apache mod_php, LiteSpeed, or FrankenPHP) parses the request headers and initializes upload progress hooks before invoking any PHP script.

• Two-Factor Authentication (2FA) or password protections are completely bypassed.
• An empty PHP file containing nothing more than <?php echo "ok"; ?> is just as vulnerable as a massive enterprise portal.
• The target application does not even need to support file uploads.

2. Universal Exposure Across Server Architectures

Unlike bugs confined to a specific web server (e.g., Nginx-only or Windows IIS-only), PHP2Shell strikes the cross-platform runtime engine:

• Apache + mod_php: Extreme hazard due to shared worker memory spaces.
• PHP-FPM (Nginx / Caddy): The standard enterprise configuration; provides attackers with full worker shell access (www-data).
• Containerized Environments: Docker containers running unpatched base images are readily exploitable if exposed to public traffic.

3. Active In-The-Wild Exploitation

Security monitoring networks observed automated reconnaissance and exploitation attempts within hours of the initial advisory. Automated botnets have already weaponized proof-of-concept scripts to drop cryptominers, establish persistent reverse shells, and exfiltrate environment files (.env).

How AI Discovered a 12-Year-Old Bug

The uncovering of PHP2Shell marks a turning point in cybersecurity: it is one of the most prominent demonstrations of advanced AI models discovering deep runtime architecture vulnerabilities in foundational open-source software.

For over a decade, PHP has undergone relentless audits, fuzzing campaigns, and code reviews by seasoned security practitioners. Why did this bug remain hidden for 12 years?

Traditional fuzzing utilities rely heavily on crashes (Segmentation Faults). CVE-2026-109619, however, requires a delicate sequence: an asynchronous network drop during a multipart boundary, an incomplete longjmp() unwind, followed by an immediate heap replacement before the next request cycle begins. Fuzzers routinely dismissed these dropped connections as standard network timeouts.

The research teams at Calif and Wiz harnessed OpenAI's deep reasoning models and autonomous AI security agents:

• Cross-Function Semantic Understanding: AI agents analyzed the entire Zend Engine C codebase holistically, tracing the lifespan of memory pointers across error-handling branches that human reviewers often inspect in isolation.
• Automated Exploit Chain Synthesis: Upon spotting the asymmetry in session.upload_progress cleanup routines, the AI model reasoned through potential memory layouts and autonomously generated a reproducer script demonstrating control of CPU registers.
• Instant Defensive Signatures: Coordinated with the PHP core team, the AI system helped generate precise WAF inspection patterns and Suricata signatures simultaneously with the disclosure, shielding defenders before attacks peaked.

This milestone demonstrates that frontier AI models have moved beyond high-level code refactoring into rigorous systems-level vulnerability research.

Comparison: PHP2Shell vs. Standard Web Vulnerabilities

What Non-Technical Stakeholders and Managers Need to Know

If you oversee engineering teams, marketing websites, or digital operations, keep three principles in mind:

1. This Cannot Be Solved in Your CMS Admin Dashboard: Your team cannot resolve PHP2Shell by simply clicking "Update Plugins" in WordPress. Server operations (DevOps / Sysadmins) must patch the server operating system or rebuild Docker containers.
2. Audit All Web-Facing Assets: Don't limit your attention to the corporate homepage. Legacy subdomains, internal staging environments, customer portals, and CRM backends running PHP are all in scope.
3. Managed Hosting vs. Self-Hosted VPS: Managed hosting providers (such as WP Engine, Kinsta, or Cloudways) generally apply platform patches automatically. If you manage your own virtual machines (AWS EC2, DigitalOcean, Linode), you are directly responsible for updating your servers.

Who is Affected?

Impacted PHP Versions

• PHP 8.5: All releases prior to 8.5.12
• PHP 8.4: All releases prior to 8.4.27
• PHP 8.3: All releases prior to 8.3.36
• PHP 8.2: All releases prior to 8.2.35
• End-of-Life (EOL) Versions: PHP 8.1, 8.0, 7.x, and 5.4 through 5.6 contain the vulnerable architecture. The PHP Group does not issue official patches for EOL branches.

High-Risk Server Profiles

• Default php.ini configurations where session.upload_progress.enabled = On.
• Publicly accessible HTTP/HTTPS ports.
• PHP worker processes running with broad filesystem permissions.

How to Test and Remediate

Follow this three-step action plan to safeguard your servers:

Step 1: Check Your Current PHP Version

Log into your server terminal and check the active PHP CLI and FPM version:

php -v

If your version is lower than the following patched releases, your system is vulnerable:

• PHP 8.2: Upgrade to 8.2.35 or later
• PHP 8.3: Upgrade to 8.3.36 or later
• PHP 8.4: Upgrade to 8.4.27 or later
• PHP 8.5: Upgrade to 8.5.12 or later

Step 2: Apply Official Patches (The Definitive Fix)

Upgrade the PHP runtime packages and restart dependent services:

Ubuntu / Debian Systems:

sudo apt update
sudo apt --only-upgrade install php8.3-fpm php8.3-cli php8.3-common
sudo systemctl restart php8.3-fpm
sudo systemctl restart nginx # or apache2

Docker Container Environments:

Update base image tags in your Dockerfile and rebuild:

# Pull the latest patched release
FROM php:8.3.36-fpm-alpine

Deploy the updated container:

docker compose pull
docker compose up -d --force-recreate

Step 3: Emergency Workaround (If Upgrades Must Be Delayed)

If production constraints prevent immediate service restarts or package upgrades, apply an immediate configuration workaround to disable the primary exploit vector for CVE-2026-109619.

Open your php.ini configuration file (commonly at /etc/php/8.x/fpm/php.ini):

; Disable upload progress tracking
session.upload_progress.enabled = Off

Reload the PHP service to apply the setting without terminating active connections:

sudo systemctl reload php8.3-fpm

Warning: Disabling session.upload_progress.enabled neutralizes the direct trigger for CVE-2026-109619, but does not resolve the underlying OOM memory safety issue in CVE-2026-109618. Upgrading PHP remains mandatory for complete protection.

Our Perspective: The AI Defense Paradigm Shift

PHP2Shell is more than just another vulnerability headline; it signals an inflection point in internet infrastructure security:

1. Legacy Infrastructure Under the AI Microscope: Decades of C/C++ foundational code (the Linux kernel, OpenSSL, PHP, cURL) are being scrutinized by AI reasoning systems capable of tracing non-deterministic state machines across millions of lines of code. Hidden memory bugs that survived decades will surface in rapid succession.
2. The Reaction Window Has Collapsed: In an era where AI agents can analyze a vulnerability advisory and synthesize weaponized exploits within hours, defensive remediation windows have shrunk from weeks to minutes. Organizations must adopt automated container rebuilds and continuous patch delivery.
3. Zero Tolerance for End-of-Life Stacks: Many organizations still run unmaintained PHP 7.x instances under the philosophy of "if it isn't broken, don't touch it." PHP2Shell proves that running unmaintained runtimes on public networks is an existential business risk. Modernization is no longer optional.

Sources

• The PHP Group Security Announcements: https://www.php.net/archive/2026.php
• PHP2Shell Vulnerability Analysis Portal: https://php2shell.com/
• NIST National Vulnerability Database (CVE-2026-109618): https://nvd.nist.gov/
• NIST National Vulnerability Database (CVE-2026-109619): https://nvd.nist.gov/
• Date of Research: 2026-10-23