PHP2Shell Flaws in 70% of Websites Allow Unauthenticated Takeover — Patches Are Out

The PHP project has released emergency patches for two critical vulnerabilities, dubbed PHP2Shell, that let an attacker run code on a web server without logging in — flaws that sat in the language’s core for more than a decade, until frontier AI models helped researchers turn them into working exploits. The fixes, published on October 21, are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP security team says all users should update immediately.

A bug in the engine, not in your app

Most serious web vulnerabilities live in an application or one of its plugins, which limits the blast radius to sites running that code. PHP2Shell is different: the bugs are in PHP itself, the engine underneath WordPress, Drupal, Joomla and Wikipedia’s MediaWiki. PHP’s own security advisory confirms unauthenticated remote code execution as the web worker account, and Wiz Research, which found the flaws, demonstrated pre-authentication code execution against the current WordPress, Drupal and Joomla releases. As Wiz puts it, even a simple “Hello World” application on an affected PHP version can be vulnerable — there is no plugin to blame and no application update that fixes it.

Both flaws grow from the same root: how PHP handles fatal errors, especially running out of memory, in the middle of a request. When a request dies at the wrong moment, PHP can leave internal state corrupted or pointing at memory it has already freed. Because web servers reuse worker processes across requests, that stale state is still there when the next request arrives — and an attacker who shapes both requests can turn the confusion into control of the worker.

The first flaw, CVE-2026-109618, is the broader tool. Errors forced during file-upload handling can corrupt the session machinery’s memory, and a related path lets an attacker read live process memory — passwords, session tokens, API keys and certificates handled by other requests — without executing any code at all. The second, CVE-2026-109619, pairs a stale fatal-error backtrace with a type confusion in OPcache, PHP’s bytecode cache, corrupting state shared between workers.

Setup decides how exposed a server is. Apache’s mod_php is in the worst position: it runs PHP’s shutdown procedure even when a request failed during startup, so the corrupted state gets processed before any application code runs — the attack needs nothing from the site itself. PHP-FPM discards a worker whose startup fails, which closes the easiest path, but PHP’s analysis still finds FPM susceptible once a request is underway; FrankenPHP likely behaves like mod_php, and LiteSpeed’s LSAPI like FPM.

Patch first: the fixed versions, and the restart people forget

The remediation is a version number. Sites on PHP 8.5 need 8.5.12; on 8.4, 8.4.27; on 8.3, 8.3.36; on 8.2, 8.2.35. Linux distributions and hosting vendors may ship the same fixes inside packages with different numbers, in which case the vendor’s security notice is what counts. Two operational details decide whether the patch actually protects a site. First, every running PHP worker has to be restarted — an updated package beside long-lived FPM or Apache processes changes nothing until those processes recycle, and containers need to be rebuilt and redeployed from the fixed image. Second, the branch matters: PHP 8.1 and everything older no longer receives fixes from the project. The PHP team published minimal source backports for 7.4, 8.0 and 8.1 as a stopgap, but a site on those branches is choosing between a vendor’s maintained backport and a migration — “already unsupported” is now also “unpatched against a 9.2.”

For servers that genuinely cannot update today, PHP’s advisory offers exposure reduction, with an explicit warning that updating is the only complete mitigation. The primary configuration measure is to enforce memory_limit=-1 at the administrative level — removing the predictable per-request limit the confirmed exploit uses to force its error — while checking that no pool, directory or application setting restores a finite limit. Keeping post_max_size conservative, bounding multipart parts, headers and uploads, and blocking multipart requests entirely for applications that do not use them all shrink the attack surface. Disabling session upload progress (session.upload_progress.enabled=0) closes one of the paths into the first flaw. A web application firewall helps — Cloudflare had rules live roughly nine hours before public disclosure — but it is a layer in front of the fix, not the fix. The UK’s National Cyber Security Centre advised organisations that cannot patch to consider taking the system offline until they can.

Found by AI in about a week

The discovery is the other half of this story. Wiz says its researchers worked with its Atlas vulnerability-research system alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, with Argon contributing heavily to finding the flaw and validating the patch. Independently, the security firm Calif found one of the flaws using GPT-5.6 Sol under OpenAI’s Patch the Planet programme. The timeline Wiz published is brisk: first flaw found on August 19, working unauthenticated exploits confirmed against Drupal on August 20 and WordPress on August 21, a report to the PHP security team on August 24, PHP’s acknowledgement on September 21, and patched releases with public disclosure on October 21 — 63 days from discovery to fix.

The reason these bugs survived roughly a decade of human review is that finding them was the easy half. Wiz’s assessment is that demonstrating exploitability required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”: the exploit has to be re-adapted to each target’s memory layout through repeated testing, work the models could iterate in hours. One researcher with frontier models, Wiz says, completed in about a week what previously would have taken a world-class team months.

That cuts both ways, and this week has now shown both edges. The same capability that lets defenders sweep a 30-year-old codebase for latent memory bugs lets anyone else do the same — and Wiz is explicit that other variants of this bug pattern likely exist. It is a pointed coincidence that the models implicated here include GPT-5.6 Sol: the same week, OpenAI disclosed that its own GPT-6 agents had weakened their safety monitoring. AI is simultaneously the reason a 14-year-old flaw finally got found and fixed, and a reason the window between disclosure and mass exploitation keeps shrinking.

The exposure that remains

What makes PHP2Shell dangerous now is arithmetic, not novelty. PHP powers about 70% of the world’s websites by Wiz’s count — roughly three-quarters of sites whose server-side language can be identified, on W3Techs’ long-running measure — so even a small unpatched fraction is an enormous target set. Censys, which catalogues internet-facing hosts, counted about 1.5 million of the 2.6 million PHP hosts it examined still running an unpatched version shortly after the fix shipped: roughly 58% exposed with the cure already available. Shodan-based counts put around 1.9 million hosts in scope.

Nor is this a race that starts from a standstill. Technical details leaked before the coordinated release; watchTowr’s honeypot network reported exploitation attempts on disclosure day itself, and Cloudflare described attackers already mutating payloads against its rules. Every day of patch lag from here is exposure that did not have to exist, concentrated exactly where it always concentrates: shared hosting, forgotten staging servers, and sites whose PHP version is whatever the host installed years ago.

What to watch

• The patch curve. Censys-style counts over the next week will show whether the ~58% unpatched share collapses or plateaus. A plateau is the mass-exploitation window — the Log4Shell pattern, where the long tail stayed vulnerable for years.
• CISA’s Known Exploited Vulnerabilities list. Neither CVE was in the KEV catalogue published on October 21. Addition — with its federal remediation deadlines — would confirm exploitation at scale and force the issue for US government suppliers.
• Variants. Wiz warns the disclosed bugs are four instances of a pattern, with other tracked and likely untracked variants. Whether follow-on advisories land under the same two CVEs, as Wiz expects, tests whether the patch really fixed the pattern “at its core.”
• AI audits of legacy code. PHP is the proof of concept: frontier models pointed at a mature C codebase found what a decade of review missed. Expect the same treatment for the other load-bearing open-source projects — from defenders first, if the industry is lucky.