Table of Contents
Two critical vulnerabilities in PHP exposed a serious weakness in the technology powering millions of websites. Known collectively as PHP2Shell, the flaws allowed attackers to potentially execute malicious commands on vulnerable servers without requiring login credentials or user interaction.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026, with each receiving a critical CVSS v4.0 score of 9.2.
What made PHP2Shell particularly dangerous was its location. Unlike traditional web application vulnerabilities affecting individual plugins or frameworks, these security flaws existed within the PHP runtime itself. Consequently, websites built using WordPress, Drupal, Joomla, Laravel, and other PHP-based technologies could face exposure even when their application code was properly maintained.
More concerning was the timing. Amazon Threat Intelligence identified an attempted exploitation of PHP2Shell on October 17, four days before the official disclosure and release of security patches.
The incident quickly evolved from a critical vulnerability disclosure into a real-world cybersecurity concern involving active exploitation attempts, server compromise, privilege escalation, and attacks against network infrastructure.
What Is PHP2Shell and Why Was It So Dangerous?
PHP is a popular server-side programming language that is used to handle dynamic web requests, maintain sessions, communicate with the database, and produce content for the website. When a user browses a website that runs on PHP, the server gets the request, PHP executes the necessary instruction, and the response is returned back.
Usually, the PHP runtime keeps strict boundaries between the user data coming in and the instructions that the server will execute.
However, PHP2Shell showed some vulnerabilities in PHP’s way of handling memory, errors, and data that is specific to request. In certain situations, the specially designed requests could result in some issues with how the runtime was handling internal memory structures. As a result, attackers could be able to execute remote code.
Remote code execution is when a hacker is able to run commands on another system. In this case, the hacker could perform the attack without having to log into the victim machine or system.
Depending on the system configuration and available privileges, this access could facilitate malicious file uploads, webshell deployment, data theft, or further exploitation.
The vulnerabilities affected PHP deployments using technologies such as Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, although the conditions and reliability of exploitation differed between configurations.
How the PHP2Shell Attack Worked
The PHP2Shell attack involved two distinct but related vulnerabilities. Both originated from failures in how the PHP runtime maintained internal state when request processing encountered unexpected conditions.
CVE-2026-109618: Memory Corruption During Error Handling
The first vulnerability involved PHP’s handling of out-of-memory conditions.
During normal processing, PHP allocates memory for incoming requests, temporary data structures, and internal operations. If memory allocation fails, the runtime must safely interrupt the operation and clean up any resources already created.
However, CVE-2026-109618 exposed a weakness in this process. An attacker could send a specially crafted HTTP request designed to trigger memory exhaustion during request processing. Under vulnerable conditions, PHP could interrupt an operation before its internal data structures were fully initialized.
The problem occurred when subsequent cleanup operations treated those incomplete structures as valid. This memory corruption could potentially redirect execution toward attacker-influenced operations.
To understand the issue, imagine a system creating an important record. The process stops halfway through, but the cleanup mechanism mistakenly assumes the record is complete and processes it using incorrect information.
In PHP2Shell, a comparable failure occurred inside memory management, creating conditions that could ultimately lead to arbitrary command execution. The flaw was particularly concerning because the vulnerable processing could occur before the website’s application code started running.
CVE-2026-109619: Reusing Memory After a Request Ends
The second vulnerability involved stale global state and a memory-safety problem commonly associated with use-after-free.
PHP servers often maintain long-running worker processes that handle multiple web requests over time. When a request finishes, memory assigned specifically to that request should be released, and any references to that memory should be cleared.
CVE-2026-109619 exposed situations where internal PHP pointers could continue referencing request-owned memory even after the request ended. When another request reached the same worker process, it could potentially interact with these stale references.
An attacker exploiting the condition could influence how PHP interpreted previously released memory, creating another route toward memory corruption or remote code execution.
Unlike the first vulnerability, this attack scenario could involve state left behind by one request and consumed by a later request. PHP’s advisories describe both vulnerabilities as critical runtime issues, although they arise through different internal failure mechanisms.
From Vulnerability to Attack: Understanding the Exploitation Sequence
The general PHP2Shell exploitation process can be understood through several stages:
- Internet-facing PHP server receives external traffic
- Crafted HTTP request reaches vulnerable PHP processing
- Memory or state-handling failure occurs
- Potential remote code execution under the PHP worker account
- Possible post-exploitation: webshell, privilege escalation, persistence, or data access
First, attackers identify internet-facing servers running potentially vulnerable PHP versions. They then attempt to reach exposed request-processing functionality through crafted HTTP traffic.
If the server’s runtime and configuration allow exploitation, the malicious request can trigger the relevant memory-management failure. Successful exploitation may result in command execution under the PHP process account.
From there, attackers may attempt to establish persistent access, inspect sensitive files, or exploit additional vulnerabilities to obtain higher privileges. However, these later stages are not automatic. Their success depends on the system’s configuration and the attacker’s additional capabilities.
Real-World Exploitation Began Before Public Disclosure
One of the most alarming findings emerged from Amazon Threat Intelligence. According to its investigation, the company’s MadPot honeypot infrastructure recorded an attempted PHP2Shell exploitation on October 17, 2026. This occurred four days before the vulnerabilities were publicly disclosed.
A honeypot is a deliberately exposed system designed to observe suspicious activity and collect information about attacker behavior.
The early attempt originated from infrastructure associated with a commercial anonymization service. Amazon could not establish how the actor obtained knowledge of the vulnerabilities before public disclosure.
On October 21, additional attempts appeared before the official release of security updates at 14:00 UTC. Following disclosure, researchers observed broader scanning and exploitation activity targeting vulnerable PHP servers.
However, Amazon cautioned that detecting an exploit attempt does not necessarily mean the attack succeeded against a real-world production system.
PHP2Shell Exploitation Escalated Into Attacks Against Firewalls
The threat became more significant when researchers uncovered evidence of attackers combining PHP2Shell with another security vulnerability to gain elevated privileges.
On October 26, 2026, Dream Research published findings about a campaign targeting vulnerable Palo Alto Networks PAN-OS management interfaces.
The attackers reportedly combined PHP2Shell with a Linux kernel privilege-escalation vulnerability, CVE-2026-46300, also known as Fragnesia.
The attack involved two major stages. Initially, attackers exploited the vulnerable PHP environment to obtain code execution under a restricted account. They subsequently used the kernel vulnerability to elevate their privileges to root, providing substantially greater control over the compromised system.
Dream Research reported that the campaign successfully compromised 24 firewalls, with an additional internal management server compromised during subsequent activity.
The researchers also identified post-exploitation behavior involving webshell deployment, reverse SSH tunneling, and attempts to access internal infrastructure.
Importantly, Palo Alto Networks Unit 42 stated in its October 29 update that it had independently verified the attacker’s tooling and the reported results.
Unit 42 also emphasized that affected PAN-OS management interfaces should not be exposed directly to the public internet and that available security fixes interrupt the observed exploitation chain.
This incident demonstrated how a runtime vulnerability could become the starting point for a much broader intrusion. An attacker initially gaining restricted code execution might subsequently reach sensitive management systems if other weaknesses are present.
Which PHP Versions Were Vulnerable?
The PHP development team released security fixes on October 21, 2026, covering the supported branches.
PHP branch | Affected versions | Fixed release |
PHP 8.2 | Before 8.2.35 | 8.2.35 |
PHP 8.3 | Before 8.3.36 | 8.3.36 |
PHP 8.4 | Before 8.4.27 | 8.4.27 |
PHP 8.5 | Before 8.5.12 | 8.5.12 |
Older PHP branches, including 7.4, 8.0, and 8.1, required particular attention because their official upstream support had already ended. Some vendors provided specially backported fixes, but administrators needed to verify the patch status of their specific distributions.
The disclosure also highlighted a practical complication: PHP 8.4.27 and 8.5.12 were associated with a separate SimpleXML memory-management regression. This required additional compatibility testing but did not justify remaining on vulnerable PHP2Shell versions.
How Security Teams Can Detect PHP2Shell Attack
Identifying an attack using PHP2Shell depends on other factors than just database logs showing a specific HTTP request. As the attack consists of making changes in the PHP memory, the security teams are advised to connect the site-logger data with the system data.
Data suggesting that an PHP2Shell attack may have taken place includes unexpected, incorrectly set HTTP POST requests, unpredicted PHP fatigue errors, frequent worker process failures, and surprising processes that have come from available web services.
For instance, PHP-FPM or Apache worker senselessly opening the shell may mean that any command was run successfully. Stopping SSH connection failed with some PHP files appears in web directories without permission.
Moreover, the experts should look for signs of some unexpected outbound connections, changes of services running on the server, repetitiveness of some scheduled tasks, and signs of escalation of privileges.
In conclusion, these signs are not just specific to PHP2Shell. A suspicious request or process can be attributed to other weaknesses and most importantly to administrational task at the server. Therefore, to detect PHP2Shell exploitations it is essential to rely on the connected evidence rather than just stand-alone IOCs.
Organizations reviewing historical activity should examine relevant telemetry beginning at least October 17, 2026, the earliest attempted exploitation date identified in Amazon’s investigation.
How Organizations Can Protect Their Servers
Installing a secure version of PHP or a similar security patch is the best way to defend against PHP2Shell.
Web application firewalls provide some level of protection against malware but do not deal with the vulnerabilities within the memory management system.
Organizations should focus on updating PHP systems used across internet-connected web servers, containerized applications, and hosting services.
When an update is done, administrators are required to restart or terminate already running PHP workers. Newly installed packages do not mean new versions will automatically stop using vulnerable code.
The security team should determine if the PHP version used for web requests has been patched as well.
In the absence of immediate patching programs, companies can take to limit risk by restricting certain multipart upload activities, putting in adaption requests limits, and limiting availability to the admin interface.
They should additionally preserve relevant logs, investigate suspicious activity, and assess whether any credentials accessible to compromised services require rotation.
PHP’s official security advisory makes the essential distinction clear: configuration changes may reduce exploitability, but updating the vulnerable runtime is the only complete mitigation.
What the PHP2Shell Incident Teaches About Modern Cybersecurity
A major flaw had been uncovered concerning the manner in which organizations handled the security of software that was widely used. Even if a site was updated, had appropriate plug-ins, secure application codes, and a properly configured firewall, it could still be vulnerable because its programming platform had a critical vulnerability.
The PHP2Shell was a reminder that cybersecurity specialists could not assume that they would get a patch before getting exploited. In the case of PHP2Shell, some suspicious activities were noted before the incident and were later identified as using the PHP2Shell with the privilege extending methods and after-exploitation operations. This event taught the lessons that are even bigger than PHP. It should serve as a reminder that companies ought to monitor their software runtimes, control the deployment of the fixes from the developed vulnerabilities, and keep an eye on too much exposure of their management mechanisms.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
