Patches released for PHP2Shell PHP flaws after leak and early exploitation

PHP2Shell is the name given to a security flaw in PHP, the programming language used by many websites and web applications. Wikipedia estimates that almost 70% of websites use PHP, and it underpins systems including WordPress, Drupal and Joomla. The issue consists of two separate memory-related vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers could exploit them to compromise a site using PHP and potentially execute code remotely. The vulnerabilities are rated 9.2 out of 10 for severity.

Sergey Lozhkin, head of the Research Center for APAC and META at Kaspersky GReAT, told TechRadar: "The potential impact is considerable: if successfully exploited, this vulnerability could enable remote code execution, one of the most serious forms of cyber compromise. In practical terms, attackers could potentially execute malicious code on affected systems, including the deployment of web shells, thereby gaining control over vulnerable servers." That means an attacker could run their own code and alter a website's content, steal data, or redirect visitors to a malicious site for phishing or malware installation.

The disclosure was disorderly. The vulnerabilities were disclosed before the official announcement, and someone leaked details on the Hacker News forum before the embargoed announcement, leaving security experts scrambling to put defenses in place faster than expected. Amazon Threat Intelligence said an exploitation attempt was made as early as Oct. 17, although it "remains unclear how the actor acquired exploit information prior to disclosure." Malwarebytes pointed to Dane Knecht, chief technology officer at Cloudflare, who reported "early attacks emerging" before the PHP team rolled out patches. Amazon Threat Intelligence warned that "PHP2Shell is now being broadly exploited in the wild."

An attack starts with a server running a vulnerable version of PHP. An unauthenticated attacker sends a specially crafted, unauthorized payload request directly to the PHP web server. A critical flaw in the core PHP runtime lets the payload hijack the backend process; as PHP processes the code, an execution error or breakout occurs. Because the runtime is hijacked, the attacker could execute remote commands, gain access to the operating system and compromise the entire device.

Patches have been deployed to close the exploits. The PHP team issued emergency security updates for PHP 8.5, 8.4, 8.3 and 8.2; the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website owners must then apply the update themselves or contact their hosting provider to ensure it has been done. TechRadar reported that, given the urgency, the patching work should have been completed by now and users should in theory be safe on any given website, but there is no cast-iron guarantee.