Critical PHP Remote Code Execution Vulnerabilities (PHP2Shell)

In October 2026, two critical zero-day vulnerabilities in the PHP core, collectively known as 'PHP2Shell,' were leaked online and subsequently addressed via emergency security updates. The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) carry a CVSS v4.0 rating of 9.2 and enable unauthenticated remote code execution (RCE) on a vast majority of the world's web servers, including those powering WordPress, Drupal, and Magento. The vulnerabilities were discovered and weaponized with significant assistance from frontier AI models, highlighting a shift in the exploit development landscape.

Technical analysis reveals the flaws stem from heap use-after-free (UAF) conditions in how PHP handles session upload progress and fatal errors, specifically out-of-memory (OOM) events. Attackers can trigger these conditions via specially crafted multipart POST requests to corrupt internal global state, allowing them to redirect execution to system commands. These operations occur during request initialization, meaning application-level security controls (like authentication) are bypassed entirely.

Organizations must prioritize patching immediately, as early signs of exploitation have been observed in the wild. Because PHP 8.1 and older versions are end-of-life, many legacy systems remain vulnerable without official vendor support. High-risk environments should consider isolating internet-facing PHP applications or implementing aggressive WAF rules as temporary stopgaps while preparing for infrastructure-level updates.