Security Advisory: Critical PHP Vulnerabilities php2shell

Millions of websites and online shops run on PHP, a language that a large part of the internet is built on. With php2shell, two critical vulnerabilities in the PHP core have now become public, allowing an unauthenticated Remote Code Execution (RCE). The BSI considers widespread exploitation within a few hours of the security updates being released likely. We summarise what is known about the vulnerabilities, who is affected and which steps you should take now.

What is php2shell?

php2shell consists of two separate vulnerabilities in the PHP core, listed under the identifiers CVE-2026-109618 and CVE-2026-109619 , which do not reside in a CMS, plugin or theme. They were discovered by the security provider Wiz, and the PHP team classifies both as critical with a CVSS score of 9.2.

CVE-2026-109618 occurs when PHP runs out of memory while processing a request. The subsequent cleanup then treats the only half-created data as valid. An attacker triggers this state deliberately via prepared multipart requests, for example with a very large number of headers per part or nested field names.

CVE-2026-109619 exploits an outdated state between two requests in the same process. This is called a use-after-free (UAF). Confirmed attack paths run in practice through the "Session Upload Progress" function.

Both paths lead to Remote Code Execution. No login or user interaction is required for exploitation. Because the vulnerabilities lie in the language core, no CMS configuration helps. The gap can only be closed at server level through a PHP update.

Who is affected?

All PHP versions from 5.4 to 8.x that serve web requests are affected. This includes the usual operating modes such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team sees the highest risk with Apache and mod_php, where an attack already runs before application code starts.

Because PHP forms the basis for WordPress, Drupal, Joomla, Magento and Shopware, the vulnerability affects a large share of websites and online shops on the internet. Many other systems also use PHP without advertising it openly, such as control panels, appliances or software with bundled PHP.

Timeline of the disclosure

The vulnerabilities were made public on 20 October 2026 before the end of the embargo period. Screenshots of an exploit tool named php2shell subsequently circulated on social networks. The PHP team then brought forward the release of the emergency patches and published the security releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October.

The BSI has issued a warning with severity level 3 of 4 and expects broad exploitation to begin within a few hours of the patches being released. No reliable workarounds are known according to the BSI. Security vendors assume that attackers will compare the code changes with the old version and reconstruct working exploits from them.

What should you do now?

The most important step is to bring the PHP installations to a patched version and restart all PHP workers. Without a restart, the old, vulnerable version continues to run in memory. For PHP 8.1 and older there is no official release, only source code backports from individual distributions or LTS providers.

If an update is not immediately possible, only interim measures help. These include disabling "Session Upload Progress", limiting request sizes and isolating internet-facing applications from the public network, as also recommended by the BSI and CERT-EU. Such measures reduce the risk but do not make an installation secure.

In addition, it is worthwhile to inventory all PHP installations, including the less obvious ones. This includes control panels, appliances and software with bundled PHP. It is precisely there that a vulnerability otherwise goes unnoticed, because no regular patching process applies.

Suspected compromise by php2shell?

Because the exploits were available before the patch, it is possible that an attacker already gained access before the gap was closed. Indicators are suspicious processes that PHP starts, such as shells or download tools, new files in the web root, newly created cron jobs or unknown user accounts.

aramido supports you with Incident Response : We disconnect affected systems from the network, secure the evidence in a forensically sound manner and clarify whether and how far the attacker gained access. We then close the gap permanently and restore your operations cleanly from a forensic perspective.