Critical PHP2Shell RCE Vulnerabilities Affecting Global Infrastructure

In October 2026, Wiz Research and Calif.io disclosed 'PHP2Shell,' a pair of critical vulnerabilities in the PHP core engine (CVE-2026-109618 and CVE-2026-109619) both rated CVSS 9.2. These vulnerabilities stem from longstanding memory-safety issues in how PHP handles fatal errors, particularly out-of-memory states, which can leave corrupted internal states behind. The findings are significant because they mark a turning point in AI-assisted exploitation; researchers utilized frontier AI models like Gemini 4 Argon to chain complex memory corruption primitives that were previously considered too difficult for manual exploitation.

The impact is nearly universal, affecting every PHP version from 5.4.0 through 8.5.x. Attackers can achieve unauthenticated remote code execution (RCE) or read sensitive process memory (containing credentials and API keys) on platforms like WordPress, Drupal, and Joomla, even if the application code itself is secure. Mass exploitation was reported by Cloudflare within minutes of the patch release on October 21, 2026.

Organizations must prioritize updating to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately. Versions 8.1 and older are end-of-life and will not receive official fixes, necessitating immediate migration or the implementation of strict infrastructure-level mitigations like blocking multipart/form-data requests.