Two Critical PHP Flaws Dubbed "PHP2Shell" Expose Most of the Web

On October 21, 2026, the PHP project released patched versions of the language after security researchers disclosed two critical remote-code-execution vulnerabilities collectively nicknamed "PHP2Shell." The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were found by the cloud-security company Wiz Research, which credited the organizations Calif and OpenAI for contributing to discovery, coordination and patch verification, according to Wiz's public writeup.

What the two vulnerabilities do

Wiz says the two CVEs actually bundle four distinct underlying bugs. CVE-2026-109618 covers a use-after-free flaw in PHP's session upload-progress unserializer, which can be abused for remote code execution, plus a related bug that can leak memory from a running PHP worker process without authentication. CVE-2026-109619 covers a use-after-free in PHP's fatal-error backtrace handling and a separate type-confusion flaw in OPcache, PHP's shared-memory bytecode cache.

According to Wiz, both issues sit in code paths that almost every PHP request passes through: memory management and error handling. The PHP Foundation made the same point in comments reported by the outlet SecurityWeek.

Discovery timeline

Wiz's research team — named in its blog post as Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz — says it found the first bug on August 19, 2026, and confirmed working remote-code-execution exploits against WordPress and Drupal installations the following two days. The team reported its findings to the PHP security team on August 24, 2026. Public disclosure and the corresponding patches followed on October 21, 2026.

Wiz says it used AI coding models, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, to help build proof-of-concept exploits, describing work that would previously have taken specialist researchers months as achievable in hours.

Who is affected

Wiz states the underlying flaws exist in every PHP version released over roughly the past decade, with at least one of the two CVEs present from PHP 5.4 onward. The company says it confirmed unauthenticated remote code execution against current releases of three widely used content-management systems: WordPress, Drupal and Joomla. SecurityWeek reports the bugs affect common PHP deployment methods, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Wiz frames the scale of exposure as affecting roughly 70% of the Internet, a reference to the share of websites that run on PHP in some form, according to the company's writeup.

Exploitation attempts since disclosure

Multiple security firms monitored attack traffic around the disclosure. SecurityWeek reports that the firm watchTowr detected the first in-the-wild exploitation attempts around the time patches landed but had not confirmed a successful compromise. Hadrian told SecurityWeek it observed large-scale exploitation attempts before the patches were even released, concentrated on PHP's session upload-progress code path. Patchstack, Cloudflare and Vega logged attempts on the day of disclosure, and Amazon said it had identified exploitation attempts four days before the patches shipped.

Why PHP's scale makes this significant

PHP was created by Danish-Canadian programmer Rasmus Lerdorf, first released in 1995, and remains one of the most widely used server-side scripting languages for building websites, according to Wikipedia. The same source notes that as of November 2025, more than half of PHP-powered websites were still running the unsupported PHP 7 branch, and about 9.7% were still on PHP 5, which was discontinued years earlier — a legacy-software pattern that security researchers say complicates rapid patching across the wider PHP ecosystem.