PHP powered about 70% of websites worldwide, according to Wiz Research. So when researchers reported two critical vulnerabilities in the popular programming language, the news raised urgent security concerns. The issues affected PHP’s core engine—not just application code—so even a carefully built website could face risk.
The reported impact included unauthenticated remote code execution and sensitive memory disclosure. That meant an attacker might run code or access data without first signing in. The findings reached beyond one CMS or site, making this a concern for web teams across many industries.
Wiz Research said affected versions went back to PHP 5.4. The PHP security team released fixes on October 21, 2026, and rated the two flaws critical, with a CVSS v4.0 score of 9.2. This guide explains which versions needed attention, how to choose a patch, and what to check on legacy systems. If you saw the name “php2 shell” in a post, this is the vulnerability it described. You’ll also learn how to investigate possible exposure and plan your next steps.
Key Takeaways
- The flaws affected PHP’s core engine, not only application code.
- Reported impacts included remote code execution and memory disclosure without authentication.
- Researchers found affected versions as far back as PHP 5.4.
- PHP security releases addressing the vulnerabilities came out on October 21, 2026.
- Check your PHP version, apply the right patch, and review legacy systems for exposure.
PHP2Shell: Scope and Severity of the Vulnerability
A flaw in PHP’s core engine could affect far more than one site. The programming language ran beneath WordPress, Joomla, Drupal, and MediaWiki, which powers Wikipedia. That wide reach made these vulnerabilities a concern across the web, even when a website’s application code had no known bugs.
Wiz Research demonstrated an exploit in a simple “Hello World” application and in tested WordPress, Drupal, and Joomla container images. The PHP security team rated both critical vulnerabilities 9.2 under CVSS v4.0. That score signaled a serious security risk for exposed servers.
Why the core engine mattered
A core vulnerability can affect many sites at once. It is not limited to a flaw in a plugin or a single application. Any vulnerable server using the affected language could become an attack point.
What attackers could access
Without signing in, attackers could seek remote code execution and run commands with the web worker’s privileges. A separate memory disclosure could expose passwords, authentication tokens, API keys, or certificates without successful execution.
Unauthenticated access could put both server control and sensitive data at risk.
| Risk | Potential impact | Why it mattered |
|---|---|---|
| Code execution | Commands run as the web worker | No login was required |
| Memory disclosure | Passwords, tokens, keys, or certificates exposed | Data could leak without code execution |
| Broad reach | Major platforms and simple apps affected | The flaw sat in PHP’s core |
Affected PHP Versions and Available Security Releases
Wiz Research traced the vulnerabilities to releases dating back to PHP 5.4. Its findings covered every PHP version released in the prior decade. So checking only your application’s framework was not enough. You needed to identify the exact build on each server.
Check your installed release
Inventory all servers, including those that run PHP through hosting services or bundled tools. The language’s support status and available fixes varied by branch and vendor.
Fixed releases for supported branches
On October 21, 2026, the PHP team published security releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Match your installed version to its branch, then confirm that your vendor’s package includes the patch. A version number alone may not confirm remediation.
Older branches and vendor backports
PHP 8.1 and earlier were no longer supported by the project. The PHP team offered minimal source backports for 7.4, 8.0, and 8.1. Some Linux distributions and long-term support vendors also received fixes before publication.
- Check package notices from your distribution or hosting provider.
- If you build from source, verify the backport and apply the fix.
- Do not assume an older version is safe without vendor confirmation.
Confirm each package’s security status before you close your review.
How PHP2Shell Can Lead to Code Execution
A request that ran out of memory could leave PHP’s cleanup process with an incomplete view of the work in progress. This failure helped turn memory-safety bugs into risks that reached beyond a single application.
Fatal errors could disrupt cleanup
During request setup, a fatal allocation error could interrupt initialization. PHP might then treat partly initialized state as valid. In the upload-progress path, stale unserializer data could remain after the request ended. Another flaw left the last-fatal-error backtrace pointing to freed memory.
Stale data created a path to exploitation
If the same server worker handled a later request, it could encounter old memory from the prior one. That could expose live worker data beyond the attacker’s own request. An interrupted OPcache persistence step could also leave shared metadata in an inconsistent state, causing type confusion across workers.
These vulnerabilities had distinct paths: one could disclose memory, while another could support code execution. Researchers at Wiz demonstrated unauthenticated exploit chains against WordPress, Drupal, and Joomla. Their findings showed how attackers could combine PHP-level flaws to gain execution without logging in. For your team, php2 shell described a real attack risk—not just a theoretical bug.
Where to Check for PHP2Shell Exposure
Start with internet-facing servers, then search internal systems and vendor appliances. Some tools may include PHP without making that dependency clear. Record each version and where you are running PHP, including hosted services and Windows software with php.exe or php-cgi.exe.
Check web setups that use PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed. Also review cPanel and Plesk, plus websites built with WordPress, Drupal, Joomla, or Magento. Updated application code cannot fix vulnerable PHP beneath it.
- List each server, site, and bundled installation.
- Include vendor appliances and hosting services.
- Use asset tools to find overlooked installations.
With mod_php, an attacker could send an unauthenticated request before the application ran.
So, application checks alone could miss this path to exploitation. Review the PHP process and its memory risk, then include every affected website in your response plan.
| Area to check | Examples | What to record |
|---|---|---|
| Web servers | PHP-FPM, mod_php, FrankenPHP, LiteSpeed | Host and PHP version |
| Bundled software | Vendor appliances, Windows tools | Binary path and owner |
| Websites and panels | WordPress, Magento, cPanel, Plesk | Site and service dependencies |
How to Patch PHP and Protect Legacy Systems
Use a risk-based plan to reduce exposure while you confirm each fix. Prioritize public-facing servers and check bundled installations, which may sit outside your main web stack.
Start with exposed and bundled installations
Review internet-facing systems first, then scan websites, appliances, and tools for hidden copies. Track each server, its version, and the services that depend on it. This helps your team plan a safe update and protect data.
Get the vendor’s confirmed fix
Fixed releases published October 21, 2026, were 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Apply the patch through the project, your Linux distribution, or your hosting provider. The PHP team said some Linux and long-term support vendors received fixes before public release, so confirm that your package includes the fix before closing the review.
Reduce risk on unsupported versions
Versions 8.1 and older no longer received project support. Upgrade when you can. If that takes time, remove the system from the internet or place it behind a VPN or web application firewall. For deprecated releases, setting session.upload_progress.enabled = Off may limit known abuse cases. It does not replace a supported release or prevent all code execution risks. Review exposure again post-update.
Interim Mitigations and Signs to Monitor
Monitoring could help you spot activity that needed review, but it could not replace a security fix. Check PHP worker behavior along with web server and application logs.
Watch for unusual processes, errors, and requests
Look for a PHP process that launches shells, interpreters, or download tools. Huntress flagged commands such as sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, nc, and certutil.exe for investigation. Commands like whoami, id, or uname -a may also signal reconnaissance when a worker runs them.
Review multipart requests followed by memory-limit errors, repeated HTTP 500 responses, malformed or oversized PHPSESSID cookies, and unexplained worker churn. These signs do not prove an exploit or confirm execution, but they can help you assess a possible attack. Keep logs from affected services and tools for investigation.
Temporary restrictions may reduce exposure while you investigate. An attacker could still attempt exploitation, so apply the PHP security update as the complete fix.
| Signal | What to review | Why it matters |
|---|---|---|
| Unexpected child process | Worker activity and command history | May indicate shell or tool use |
| Errors and unusual requests | HTTP logs, multipart data, and memory errors | May reveal suspicious request patterns |
| Cookie or worker changes | PHPSESSID size and worker churn | Can help identify activity for follow-up |
PHP2Shell Disclosure Timeline and Exploitation Updates
The disclosure unfolded over two months, giving security teams time to prepare a coordinated fix. The timeline also shows how researchers tested the risk before the public release.
Wiz Research used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to find the first flaw. After validating the impact, the team shared its findings with the PHP team. A leak about two critical vulnerabilities surfaced before the planned announcement, so the release became a key point for defenders tracking CVE-2026-109618 and related bugs.
Use the dates below to place php2 shell reports in context. The post-leak period and later post-disclosure analyses added detail, but they did not replace patching. Apply a fixed release and verify your installed build.
| Date | Event | Security significance |
|---|---|---|
| Aug. 19–21, 2026 | Wiz found the vulnerability, then confirmed unauthenticated RCE in Drupal and WordPress. | Testing showed real-world impact. |
| Aug. 24–Sept. 21, 2026 | Wiz reported the vulnerabilities; PHP acknowledged them and began coordinated work. | Teams prepared a fix. |
| Oct. 20, 2026 | Information on critical vulnerabilities leaked online. | Disclosure came early. |
| Oct. 21, 2026 | PHP published fixed releases and public details. | Researchers later shared technical analyses. |
Conclusion
PHP2Shell showed how a flaw beneath everyday websites could create broad risk. Wiz Research reported vulnerabilities reaching back to PHP 5.4, so your inventory should include old and bundled systems.
The PHP team released fixes on October 21, 2026. Identify each version, apply the right fix, and plan an upgrade or restrict access if support has ended. Mitigations can reduce exposure, but they do not replace a complete patch.
As part of your review, check worker behavior and request patterns for signs of memory disclosure, code execution, or data access. A suspected attacker may leave clues, though no single signal proves exploitation. Patch first, then investigate and preserve relevant logs.
Wiz Research, Calif, and OpenAI worked with the PHP team to verify the issue and lower further risk. Keep that coordinated security response in view as you protect your systems.
