PHP2Shell vulnerability: the 2 PHP flaws attackers are now using

New to this?Ping explains the 2 hardest parts in plain words.

Open all explanations

#What is the PHP2Shell vulnerability?

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two flaws in the PHP engine that can let someone who never logs in run their own commands on a web server. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates mod_php as the highest risk because the attack can fire before any of the site's own code runs.

Both bugs come from the same family of mistakes: PHP not cleaning up properly when a request goes wrong. CVE-2026-109619 abuses the built-in session upload progress feature, where PHP keeps pointers into memory that gets freed and reused, so an attacker can slip fake data into that spot. CVE-2026-109618 forces PHP to run out of memory mid-request, and the emergency exit skips normal cleanup, leaving half-built data behind that PHP later trusts during shutdown.

ELI5: explain it simply▾

Ping explainsNo experience needed.

THE WORDS

Use-after-free

A program keeps using a piece of memory after it has handed it back.

Heap

The pool of memory a program borrows from while it runs.

Worker

A PHP process that handles one web request after another.

Out of memory (OOM)

The program hits its memory limit and has to stop what it was doing.

THE IDEA

Picture a coat check that gives your hanger to someone else but still keeps your ticket pointing at it. If an attacker hangs their own coat there, the attendant hands back whatever is on that hanger. PHP2Shell tricks PHP into reading a hanger the attacker filled, and what is hanging there is a command to run.

Still fuzzy?Practice it in Security Pro ›

#How it was found, and how it leaked

Calif's Ryan Austin found the first bug on August 1 while auditing PHP with help from OpenAI's GPT-5.6 Sol, and reported it to PHP on August 11. Wiz Research and OpenAI's own team later found the same flaws independently and filed their own reports.

Wiz Research used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and confirmed working attacks against Drupal and WordPress within two days of its first find. The plan was a coordinated release on October 22, but the CVE numbers started circulating on forums around 15:00 UTC on October 20 with a wrong score of 10.0, so PHP moved the release up a full day.

The leak then got worse in two ways. Calif mistakenly published a video showing its proof of concept, which sped up public exploit code, and Chainguard published container images containing the fix more than six hours before the official release, which the PHP Foundation said disregarded weeks of coordinated work.

#Is PHP2Shell being exploited?

Yes. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, which means it has evidence of real attacks, and gave federal civilian agencies until October 29 to fix them.

The most detailed attack so far came from the security firm Dream, which says a suspected China-linked actor chained PHP2Shell with a Linux kernel bug called Fragnesia (CVE-2026-46300) to get root on 25 servers in the US, Japan, Taiwan and South Korea, including three in a US government-affiliated network. The targets were firewalls running PHP 8.0.30 on their management interface, and the attacker went on to go after Active Directory credentials.

#Which PHP versions are affected?

PHP is also built into appliances, network devices and management interfaces that don't advertise it, where admins often can't update PHP themselves. The Dutch NCSC is tracking 757 products with a PHP dependency, and as of October 28 it listed 218 of them as vulnerable and only 144 as fixed.

#How to check your PHP version for PHP2Shell

$ php -v | head -1
PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)
# 8.3.6 looks older than the fixed 8.3.36, so check the distro package
$ dpkg-query -W php8.3-cli
php8.3-cli	8.3.6-0ubuntu0.24.04.13
$ zcat /usr/share/doc/php8.3-cli/changelog.Debian.gz | grep -m2 "CVE-2026-10961"
    - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
    - CVE-2026-109618
# the CVE is in the changelog, so this build is patched
$ php -i | grep upload_progress.enabled
session.upload_progress.enabled => On => On
# still on: PHP suggests turning it off until the next release

ELI5: explain it simply▾

Ping explainsNo experience needed.

THE WORDS

Backport

Copying a fix into an older version instead of shipping a new version number.

Changelog

A file listing every change made to a package.

dpkg

The tool Ubuntu and Debian use to track installed packages.

THE IDEA

Ubuntu and Debian keep the same main version number for years and quietly patch it, like a car that keeps its model year after a recall repair. So the number from php -v is not the whole story. The package version and its changelog tell you whether the repair was actually done.

Still fuzzy?Practice it in Security Pro ›

#What to do now

Checking package versions, reading changelogs and restarting services are core sysadmin skills, and Server Administration is Level 2 of the Security Pro course, which runs in a simulated terminal in your browser, with Level 1 free.

#Other PHP vulnerabilities being fixed right now

CVE-2026-115560 (PHP): a third remote code execution path PHP disclosed on October 23. It only hits apps configured with session.serialize_handler set to php_binary or php_serialize that switch it back to php at runtime with upload progress still on, so PHP will fix it in its next regular release; turning upload progress off blocks it now.

CVE-2026-114509 (Laravel): an authentication bypass in Laravel's built-in token guard that, on MySQL or MariaDB, lets an attacker log in as an existing user without knowing their token. It is rated 9.2 on CVSS 4.0 and fixed in laravel/framework 12.68.0 and 13.29.0.

#The rest of the "2Shell" wave

Node2Shell (CVE-2026-111497): an out-of-bounds write in Google's Brotli decompression library, which Node.js builds in. Public exploits are out, threat intelligence firm ELLIO says its sensors have seen exploit traffic in the wild, and it's fixed in Node.js 26.12.1, 24.22.1 and 22.23.4, while end-of-life lines like 20.x get no fix.

Plex2Shell: four chained Plex Media Server bugs (CVE-2026-96652, -96654, -96655 and -96656) that attackers have used to plant crypto miners. CISA added them to KEV on October 21, and Plex Media Server 1.43.3.10861 fixes them.

opnF.sh

News that matters to the tools we teach.