PHP2Shell: Critical PHP Vulnerabilities Threaten Website Security
Introduction
PHP is widely used to build and run websites and web applications. This programming language also powers popular content management systems such as WordPress, Drupal, and Joomla. Since many online services rely on PHP, security issues in the core PHP system can pose risks to many websites.
On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both could potentially allow attackers to execute code remotely on affected servers without having to log in to an account first.
How PHP Processes Website Requests
PHP processes code to display website pages when visitors access them. To understand the risks of PHP2Shell, we need to know two common ways PHP runs on a web server.
First, Apache mod_php is a method that runs PHP inside the Apache web server process. Second, there is the worker model, which is used by PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. In this model, PHP runs through separate processes that can remain active and handle multiple requests.
There are two important things to note. With Apache mod_php, the vulnerability can be exploited while PHP is still processing a request, before the application runs its code. Meanwhile, in the worker model, old processes may remain at risk even after PHP has been updated. Therefore, workers need to be restarted to ensure the changes are fully applied. Updating PHP files alone may not be enough.
What Is PHP2Shell and How Does the Vulnerability Work?
PHP2Shell consists of two vulnerabilities that both originate from memory management errors. They occur because PHP does not handle data correctly, either while processing a request or when cleaning up that data after the process has finished.
Both vulnerabilities exist in the part of PHP that reads and parses requests from visitors. This process runs before the application code, including the login process, is executed. Therefore, the attack does not require an account. An attacker only needs to send a specially crafted request to any accessible PHP endpoint. The important thing to understand is that these memory errors do not simply cause the server to stop working. PHP stores both data and its internal instructions in the same memory, so an attacker who can manipulate memory contents may be able to turn this corruption into control over the code executed by the server.
CVE-2026-109618 (Out-of-memory (OOM) errors to exit the current context and abort handling of the request)
When PHP runs out of memory, it forcibly stops the current request using an internal mechanism called longjmp. The problem is that if the out-of-memory condition occurs while a new request is only partially constructed, the cleanup code that runs afterward may still read and make decisions based on incomplete data. An attacker can deliberately trigger this out-of-memory condition while PHP parses multipart form data, for example, through a request containing a very large number of headers, without necessarily exceeding an obvious limit. With Apache mod_php, all of this happens at the beginning of the request, before a single line of application code is executed, so the attack does not require an account.
CVE-2026-109619 (Use-after-free leading to memory corruption)
This vulnerability involves data being used again after it should no longer be valid, and its impact can extend beyond a single request. When a fatal error occurs, including an out-of-memory error, a worker process that remains active may still hold pointers to memory belonging to a request that has already finished. The next request handled by the same worker may then access this old data before the normal initialization process has had a chance to clear it. This vulnerability is more difficult to exploit, but the PHP team confirmed successful code execution through mod_php, and a session-based exploitation path was also demonstrated in PHP-FPM.
Why Is This Vulnerability a Serious Risk?
PHP2Shell could allow attackers to execute code remotely on vulnerable servers without having to log in first. If the attack succeeds, the impact may include :
Data breach : Attackers may gain access to sensitive information stored on the server.
Unauthorized system changes : Attackers may modify files or website content.
Service disruption : Websites or applications may be disrupted, affecting company operations.
Further attacks : A compromised server may be used to carry out other malicious activities.
These risks need to be addressed immediately. Amazon Threat Intelligence reported attempts to exploit PHP2Shell on October 17, 2026, before the vulnerabilities were publicly disclosed. Additional attempts were also detected around the disclosure date.
These reports indicate attempts to exploit PHP2Shell. Therefore, companies should update PHP as soon as possible to reduce the risk of attacks.
Although PHP2Shell is a serious vulnerability, it does not mean that all websites using PHP must be taken offline immediately. The appropriate response should depend on each system's conditions, including the PHP version, server configuration, and whether the system is accessible from the internet.
The PHP2Shell challenge on StealMyBitcoin.com was reportedly solved in more than 19 hours and involved a PHP server that had been deliberately misconfigured. This suggests that a system's technical conditions can influence the level of risk and the success of an exploit. However, this does not guarantee that other systems are safe.
Therefore, companies should conduct technical assessments to identify which systems may be affected and determine the appropriate actions. This approach helps organizations address vulnerabilities in a targeted manner rather than making decisions based solely on media coverage.
Which Systems Could Be Affected?
PHP2Shell affects the core PHP system, not just specific website platforms. Therefore, using WordPress, Drupal, or Joomla alone is not enough to determine whether a website is vulnerable. The PHP version and how it is deployed in the system must also be checked.
Organizations need to identify every environment that uses PHP, including production websites, internal applications, and other services accessible through the internet. Older PHP versions also require attention, especially if they no longer receive security updates.
What Should Businesses Do to Protect Their Systems?
1. Identify All PHP Installations
Check which websites, applications, servers, and environments are running PHP. Record the installed version in each location, then determine which systems are directly accessible from the internet, as these are the most urgent to address.
2. Update PHP Immediately
Update PHP to a fixed version that matches the version currently in use: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
However, updating PHP files alone is not enough. After the update, restart all PHP workers (PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed) to ensure that old processes still holding vulnerable code are fully replaced.
3. Review the Configuration After Updating
After updating, make sure the system configuration is appropriate for your needs. If temporary settings were previously used, review them and restore reasonable values. For example, set the memory usage limit (memory_limit) to an appropriate value and disable upload progress tracking (session.upload_progress) if the application does not need it.
To ensure that no systems are overlooked, companies can use Sawah Cyber Security's Vulnerability Scan service to scan for vulnerabilities and identify areas that require further attention.
4. Verify That the Fix Has Been Applied and Monitor Remaining Risks
Verify that the fixed PHP version is actually running across all environments.
Keep in mind that you should check the version used by each PHP execution method, not just by running php -v in the terminal. The version used by the web environment (for example, PHP-FPM, checked with php-fpm -v) may differ from the CLI version. This means the web environment may remain vulnerable even if the terminal version has been patched. Also, ensure that applications continue to work normally, then review logs and system activity for suspicious signs.
In addition, companies need to identify all their digital assets and monitor areas that could potentially serve as entry points for attacks. Sawah Cyber Security's Attack Surface Management (ASM) service can help identify and monitor the exposure of these digital assets, allowing each risk to be addressed more effectively.
If your company needs assistance in evaluating the impact of PHP2Shell and determining the right protective measures, contact us at [email protected].
The Sawah Cyber Security team is ready to provide solutions and recommendations tailored to your company's system security needs.
