PHP2Shell Flaws Enable Pre-Authentication RCE in PHP Applications
Summary
PHP2Shell comprises two PHP Core flaws disclosed Oct. 21, 2026, that can enable unauthenticated RCE and memory disclosure. PHP 8.2–8.5 are affected below specified fixed releases; patching is the complete remediation.
Key points
- The two flaws affect PHP Core and are described as PHP2Shell; the article says any web application running vulnerable PHP may be affected.
- CVE-2026-109618 (CVSS 9.2) involves out-of-memory corruption and was demonstrated to enable pre-authentication RCE on WordPress, Drupal, and Joomla.
- CVE-2026-109619 involves stale global state across requests and can cause use-after-free, memory disclosure, or code execution; pre-authentication RCE was demonstrated on WordPress and Drupal.
- Vulnerable releases are PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12.
- The article recommends patching as the only complete remediation. Suggested interim workarounds include disabling session upload progress tracking, disabling fatal-error backtraces on PHP 8.5.x, respawning workers after one request, and setting a server-level memory cap.
- The researchers say AI models aided discovery and exploit development; the flaws had been present in PHP code for over a decade.
Article Details
- Vulnerability Types
- Out-of-memory (OOM) corruption
- Stale global state across requests
- Use-after-free
- Severity
- Critical; CVSS 9.2 reported for CVE-2026-109618. No severity score stated for CVE-2026-109619.
- Affected Versions
- PHP 8.2 (< 8.2.35)
- PHP 8.3 (< 8.3.36)
- PHP 8.4 (< 8.4.27)
- PHP 8.5 (< 8.5.12)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable session upload progress tracking: session.upload_progress.enabled = 0
- On PHP 8.5.x, turn off error backtraces: fatal_error_backtraces = 0
- Force individual workers to respawn after a single request: pm.max_requests = 1
- Apply the stated server-level memory configuration: memory_limit = -1
MITRE ATT&CK
Vendors
OpenAIOn October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team.PHPOn October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team.
Products
DrupalPre-authentication remote code execution (RCE) on WordPress, Drupal, and JoomlaJoomlaPre-authentication remote code execution (RCE) on WordPress, Drupal, and JoomlaPHP CoreThe vulnerabilities are in PHP Core, which means any web application running on top of PHP is likely vulnerable.WordPressPre-authentication remote code execution (RCE) on WordPress, Drupal, and Joomla
Tools
Gemini 4 ArgonThe team used a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol models, noting that Gemini 4 Argon was specifically useful in uncovering the vulnerability and exploit development.OpenAI GPT 5.6 SolThe team used a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol models, noting that Gemini 4 Argon was specifically useful in uncovering the vulnerability and exploit development.Wiz AtlasThe team used a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol models, noting that Gemini 4 Argon was specifically useful in uncovering the vulnerability and exploit development.