PHP2Shell: Two Critical PHP Flaws Trigger Global Site Shutdowns

PHP, the scripting language that runs a large share of the web's server-side code, was hit by two critical security flaws disclosed in October 2026. Collectively nicknamed "PHP2Shell" and tracked as CVE-2026-109618 and CVE-2026-109619, the bugs allow an attacker with no account or password to execute arbitrary code on an affected web server.

What the vulnerabilities do

According to security firm watchTowr, CVE-2026-109618 occurs when PHP runs out of memory partway through setting up an incoming request, leaving internal request data only partially initialized; PHP's cleanup routine then mistakenly treats that invalid data as valid. CVE-2026-109619 involves internal state tied to one request surviving after the memory it points to has already been freed, so a later request handled by the same worker process can use that stale state before normal initialization resets it.

Research firm Wiz, which examined the flaws, told Help Net Security that the issues had gone unnoticed for years and rank among the most severe ever found in the language. Beyond full remote code execution, watchTowr said the bugs can also crash PHP worker processes, allow arbitrary file reads, or leak server memory.

Who found it, and when

The two flaws were reported through separate research efforts. WatchTowr's advisory credits the security research team at Calif with the discovery, while Help Net Security's coverage attributes identification and disclosure to researchers at Wiz. The disclosure timeline was unusual: details intended to stay under embargo leaked publicly on October 20, 2026, and watchTowr confirmed the leaked information was genuine. PHP's maintainers responded by releasing patches a day ahead of the originally planned October 22 date, at 14:00 UTC on October 21, 2026.

Scope: who runs vulnerable PHP

PHP remains one of the most widely used server-side languages on the web, and the flaws can affect any setup that processes incoming HTTP requests through it. Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, per watchTowr, meaning the bug sits in the server layer itself rather than in any single application.

Because PHP 7.4, 8.0 and 8.1 are no longer officially supported, watchTowr says there is no patch from the PHP core project for sites still running those branches, though Linux distribution or long-term-support vendor backports may be available as an interim option; otherwise those installations need to move to a supported branch. PHP 7.3 and older have no fix at all, according to watchTowr. PHP's advisory states that no configuration change fully closes the vulnerabilities short of updating the software.

Impact and exploitation

Help Net Security reported that a honeypot network run by Amazon detected exploitation attempts on October 17, 2026 — four days before the public patch — suggesting some attackers had early access to exploit details. WatchTowr said its own "Attacker Eye" honeypot network observed active exploitation in the wild continuing after the October 21 patch release. Content management systems built on PHP, including WordPress, Drupal and Joomla, along with Laravel-based applications and e-commerce platforms, are all within the affected footprint because they run on top of the vulnerable PHP engine.

As patching got underway, government agencies, online forums, gaming platforms and some infrastructure-linked sites were taken offline as a precaution while operators applied fixes, according to the coverage summarized on the PHP2Shell Wikipedia entry. The UK's National Cyber Security Centre urged organizations that could not patch immediately to take vulnerable systems offline instead, Help Net Security reported.

Severity rating and what site operators should do

PHP's own developers rated both flaws 9.2 out of 10 on the CVSS v4.0 scale, a "critical" score, according to watchTowr's advisory. The clear remediation path, per both PHP's advisory and watchTowr, is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on which branch a server runs; sites on 7.4, 8.0 or 8.1 should use a distribution backport or move to a supported branch, while servers on 7.3 or older have no fix available and need to upgrade.