What is PHP2Shell? Critical PHP RCE Flaws (CVE-2026-109618 and CVE-2026-109619) and their Remediation
Introduction to PHP2Shell
What is PHP Shell Vulnerability? PHP2Shell Explained, PHP powers a vast number of websites, making its security a critical concern for website administrators and developers.
So, how did AI manage to discover critical RCE (Remote Code Execution) vulnerabilities in PHP that ended up affecting 70% of the websites on the internet. In this article, we will learn everything about PHP2Shell - two critical PHP flaws (CVE-2026-109618, CVE-2026-109619).
What is PHP Shell Vulnerability
A PHP shell vulnerability is a security weakness in a PHP application that allows attacker to steal data, change your website, unauthorized access, enabling users to execute system commands, install malware or upload malicious scripts and control server without proper permissions.
"Shell" refers to a command line interface on a server, from which an attacker executes their commands and interact with the operating system. PHP2Shell is a recent example of this.
A "Web Shell" is a malicious script residing on a web server, which an attacker inserts into a site they have already compromised. This file is hidden and allows the attacker to gain unauthorized access.
What is PHP2Shell
PHP2Shell name means "PHP-to-shell". "PHP2Shell" is a nickname for two critical security flaws in PHP are CVE-2026-109618 and CVE-2026-109619.
This name originated from exploiting a script to turn a PHP server into a command-line interface (a Shell).
What is CVE-2026-109618
CVE-2026-109618 is one of the two security flaws in PHP2Shell. It is known as out-of-memory (OOM) corruption.
Whenever PHP runs out of memory, some internal data remains incomplete during the processing of a request. Subsequently, during the cleanup phase, PHP handles this data incorrectly and attacker can exploit this security weakness to inject malicious code onto the server.
Example of CVE-2026-109618
PHP runs out of memory while processing a request, it may treat unfinished data as valid during the cleanup process, which creates a security risk.
What is CVE-2026-109619
CVE-2026-109619 is the second security vulnerability in PHP2Shell. It is known as stale global state and involves a type of memory error called use-after-free.
Later, PHP starts uses that outdated memory data that is not actually needed.
Example of CVE-2026-109619
PHP releases memory, but sometimes old references inadvertently remain. Later, the attacker exploits these old references a vulnerability that can be leveraged.
Simple difference between CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 = PHP runs out of memory and mishandles unfinished data during cleanup
CVE-2026-109619 = PHP uses old memory that it has already released
Who Discovered PHP2Shell and How
PHP2Shell was discovered during security research conducted by Calif research team, Wiz Research and OpenAI. Calif was the first to report the vulnerability to the PHP team on August 11, 2026.
Subsequently, Wiz Research carried out independent research and identified related vulnerabilities. Following this, OpenAI Research reported additional attack methods.
Researchers investigated PHP's internal memory handling and discovered a security weakness that could potentially allow an attacker to execute commands on the server.
Calif is a security research team that investigates software to identify and fix security vulnerabilities. Calif researcher Ryan Austin, investigated PHP as part of his project, name "Patch the Planet" with the help of AI model. He examined PHP's code and discovered a memory-handling vulnerability.
Impact of PHP2Shell
The PHP2Shell issue has had a very serious impact, as a vast number of websites worldwide are built using PHP.
AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, this highlights the need to identify and fix security weaknesses in software. While it is also a fact that many sites use PHP, this does not mean that all of them are vulnerable to PHP2Shell.
With 70% of websites globally running on PHP, owners are now deeply concerned about potential data leaks or their sites being hacked. Many government websites around the world are built on PHP, and a large number of them have been taken offline following official directives. They will remain down until a security patch is released.
The actual impact depends on factors such as the PHP version, server configuration and the operating system.
Does PHP2Shell affect WordPress, Drupal, and Joomla
Yes, PHP2Shell will affect WordPress, Drupal and Joomla, because these are content management systems that rely on PHP. Security researchers have successfully carried out exploits on all three of these platforms.
Vulnerabilities are in the PHP itself, then updating or removing a plugin, changing a theme or replacing it with some other PHP-based CMS will not help.
Website owners should use the updated patch version of PHP as soon as possible and check their hosting environment also.
Which PHP Versions are Vulnerable to PHP2Shell
PHP2Shell affects all versions of PHP, from the very first to the latest. This issue was discovered by an AI, not by a human; in fact humans were not even aware of this issue until now.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. So, update your security patches both within your application and with your hosting provider.
Important: PHP 8.1 and its older versions have no security patches and they no longer receive regular upstream security updates, so you need to pay close attention to this or simply update to a newer version.
How to patch PHP2Shell: Fixed Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35
If you want to protect your site from PHP2Shell, ensure you use an updated, patched version of PHP that is compatible with both your application and your hosting provider. Here are step guide for PHP patch.
- First, take a backup of your site, including the database, code, and existing work.
- Next, check the PHP version compatibility in relation to your application and hosting provider.
- Then, download the appropriate PHP patch version and install it after removing the previous PHP version. Be careful when performing this on a live site; your site could go down.
- Now, verify whether your site is functioning correctly with the new PHP patch.
- Finally, be sure to check the server logs or suspicious activity or any errors indicates security issues.
If you are using a PHP-based CMS such as WordPress, Joomla or Drupal contact your hosting provider to confirm whether a patched version of PHP is installed and active.
How Techy Donut Can Help
At Techy Donut, our goal is to make technology accessible to everyone, ensuring that everyone can learn about and understand it.
If you, as a reader, encounter any difficulties in understanding topics related to PHP2Shell or if you are facing issues with PHP2Shell on your website such as an inability to apply a patch etc, please feel free to contact us. There is no charge for this assistance.
Conclusion
PHP2Shell refers to two critical PHP memory-handling flaws: CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (use-after-free).
Both can let attackers execute commands on servers and take control without permission. Because PHP powers roughly 70% of websites, the impact is serious, and WordPress, Drupal and Joomla are affected too.
Every PHP version is vulnerable. Owners should back up their sites, then upgrade to patched releases 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and confirm with hosting providers. PHP 8.1 and older receive no patches.
Frequently Asked Questions (FAQs)
What is PHP and Why did it spark a global cyber-security scramble
In October 2026, two critical vulnerabilities in PHP, collectively known as 'PHP2Shell' (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP with the help of AI model, triggering global security concerns.
In this an attacker can hide a malicious file on the server and then use the command line to interact with server potentially taking your site offline, altering its content, stealing data and more.
Many government websites around the world are built using PHP; consequently due to such security vulnerabilities, some governments have had to take their sites offline until a security patch for PHP becomes available.
What is RCE Vulnerability
RCE in cyber security stands for RCE (Remote Code Execution) vulnerability. This is a security flaw that allows an attacker to remotely execute malicious code or scripts on a server or computer, without requiring physical access to the system.
RCE vulnerabilities are considered a very high-risk security threat because an attacker can use them to steal data from your website, take your site offline, or alter its content.
Is PHP 8.1 or Older Safe to Use, and What should you do
No, Security support for PHP 8.1 last receive in December 2025, so using it is risky. If you are still using older PHP version, please upgrade with PHP2Shell patch fix version.
