PHP2Shell: What the Critical PHP Vulnerability Means for Your Business
If you run anything on PHP, and most of the web does, you need to know about PHP2Shell. On October 21, PHP maintainers rushed out emergency patches for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that could let an attacker remotely execute code on your server without ever logging in. Security researchers are calling it one of the most severe vulnerabilities in PHP's history.
Here's what happened, what it means, and what you should do about it.
What Makes This One Different
PHP vulnerabilities aren't new. What's new here is how these flaws were investigated. Calif and Wiz Research used AI-assisted tools to uncover and demonstrate long-standing flaws in PHP's core. Calif's work was part of OpenAI's Patch the Planet initiative; Wiz independently discovered and reported both vulnerabilities.
The discovery became part of a coordinated effort OpenAI calls "Patch the Planet," bringing together maintainers, researchers, and security vendors to get ahead of the problem before attackers could exploit it at scale. It's a preview of how AI is starting to change the way critical bugs get found. For now, the priority is making sure your systems are protected.
What's Actually Broken
CVE-2026-109618 is an out-of-memory handling flaw: PHP can leave request data only partly initialized, then use that invalid data during cleanup. CVE-2026-109619 is a separate use-after-free flaw: PHP can retain references to memory from an earlier request and use them after that memory has been freed. Fatal errors can leave that stale state behind; running out of memory is one possible trigger, not the sole cause of both flaws.
Both flaws can lead to unauthenticated remote code execution on susceptible deployments.
Exposure depends on the PHP build and patch status, server integration, configuration, and reachable application behavior. These flaws can affect platforms such as Magento, Shopware, WooCommerce, and Plesk-managed PHP, but the platform name alone does not establish exploitability. Confirm each deployment’s exposure; secure application code does not guarantee a safe PHP runtime.
What To Do Right Now
The fix is simple to describe and urgent to execute: update to a patched release. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Firewall protection varies by vendor, product, ruleset, and configuration. Cloudflare, AWS, and Microsoft publish different PHP2Shell mitigations; confirm which protections apply to your service, are enabled, and cover the known attack paths. Disabling session upload progress can reduce specific attack paths, but does not fix both vulnerabilities. These measures are temporary risk reduction, not a substitute for patching PHP.
Why This Matters Beyond the Patch
The real lesson of PHP2Shell is how much of the modern web rests on shared infrastructure that most businesses never think about until something like this happens.
That's exactly the kind of problem we help clients work through at Ovatio Technologies. Whether it's assessing your PHP footprint, deciding which systems need attention first, coordinating patching across a complex environment, or putting interim protections in place, our team can help you move quickly and with confidence.
If you're not sure where your organization stands, that's a conversation worth having today, not after something goes wrong. Reach out and we'll help you get a clear picture of your exposure and a plan to close it.