PHP2Shell Explained: Clear Answers on the Core PHP Vulnerabilities
Introduction
Most big security stories are about one product: a plugin, a library, a single app. PHP2Shell is different. It is the name for a set of memory-safety flaws in the PHP engine itself, the runtime behind WordPress, Drupal, Joomla, MediaWiki and, by commonly cited estimates, roughly 70% of all websites. A site can have perfectly clean application code and still be exposed.
Two things make this disclosure stand out. First, the flaws sat in the codebase for more than a decade. Second, the Wiz Research team says frontier AI models made it practical to turn those flaws into working exploits, a job that used to demand rare expertise and months of effort.
This post explains what was found, how the bugs work at a conceptual level, why the AI angle matters, and gives you a practical framework for deciding what to do next.
What Is PHP2Shell?
PHP2Shell is the name of the exploit script Wiz built by chaining several PHP engine bugs together. The bugs are grouped under two CVEs, CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2.
- Engine-level: the vulnerable code is in PHP itself, so the application running on top does not need to have a bug
- Wide version range: every PHP release from the last decade, going back to 5.4, is affected by at least one of the issues
- Unauthenticated: attackers do not need a login to reach the vulnerable code paths
- Two kinds of impact: remote code execution (RCE) and disclosure of sensitive process memory
- Patched: the PHP team released fixes on October 21, 2026, as part of a coordinated disclosure
The Root Cause: Fatal Errors That Leave a Mess Behind
All of the demonstrated bugs share one underlying pattern. When PHP hits a fatal error, especially an out-of-memory error, it throws away the memory used by that request. The problem is that some internal pointers are not cleaned up and keep pointing at the freed memory.
If the same worker process then handles another request, PHP can trust those stale pointers as if they were still valid. An attacker who has managed to place their own data in the freed memory can then influence what PHP reads or writes. That is the classic recipe for a use-after-free, and in the right chain it leads to memory disclosure or code execution.
This is also why the researchers say there are more variants beyond the four they reported. The weakness is architectural, which is why the PHP team’s patch targets the core issue rather than only the four examples.
The Four Bugs at a Glance
| Bug | What goes wrong | Impact demonstrated |
|---|---|---|
| Upload-progress unserializer use-after-free (CVE-2026-109618) | A failed allocation leaves unserializer state behind, and a later request reuses it | Pre-authentication RCE on WordPress, Drupal and Joomla |
| Remote process-memory disclosure (CVE-2026-109618) | A stale session ID pointer survives a crash, and a later multipart request leaks freed memory into a response cookie | Unauthenticated reading of live worker memory, regardless of the app |
| Fatal-error backtrace use-after-free (CVE-2026-109619) | The backtrace of the last fatal error is kept in a global that still points at freed memory | Pre-authentication RCE on Drupal |
| OPcache type confusion (CVE-2026-109619) | A failure partway through caching compiled code leaves workers disagreeing about shared memory slots | Pre-authentication RCE on WordPress |
The memory disclosure bug is worth singling out. It works even if the application never starts a session, and it can expose data from other requests, such as passwords, tokens, API keys and certificates.
Why AI Is the Real Story
The vulnerable code had been there for over a decade, so why was it not exploited sooner? According to Wiz, complexity was the barrier. Memory bugs behave differently across PHP versions, configurations and applications, and an exploit that works on one deployment often needs significant rework for the next one.
Wiz reports that frontier models changed this. They helped adapt exploits to different versions and memory layouts, analyze failures, and iterate until something worked. Wiz says it used its own Wiz Atlas tooling together with Gemini 4 Argon and GPT-5.6 Sol, and that a single researcher accomplished in about a week what would previously have taken a world-class team months.
The broader argument is about economics. When the cost of building and adapting complex exploits drops, bugs that were once “theoretically exploitable but impractical” become realistic targets. The same capability also helps defenders find and fix long-hidden flaws, which is how this issue was uncovered in the first place.
One caution for readers: this framing comes from the researchers who did the work, and it is a vendor perspective. It is a credible and important argument, but it is still an interpretation.
Real-World Examples
- CMS takeover: Wiz demonstrated unauthenticated RCE against the latest container images of WordPress, Drupal and Joomla at the time of testing. These were chosen as representative targets, not because the CMSs were at fault.
- “Hello World” exposure: because the bugs live in the engine, even a trivial PHP app on an affected version can be vulnerable.
- Silent secret theft: even without achieving code execution, an attacker could read chunks of worker memory, which may contain credentials and keys belonging to other users’ requests or to the server itself.
Am I Affected? A Decision Framework
Ask these questions in order:
1. Do you run PHP anywhere (web servers, containers, shared hosting, CI images)? → No: you are not directly affected. Yes: continue.
2. Is your PHP version older than the patched release published October 21, 2026? → Yes: you are exposed. Check php.net for the fixed version in your release branch and plan the update now.
3. Are you on a managed platform or hosting provider? → Check their security bulletin. Many providers and CDNs prepared mitigations before disclosure (Cloudflare, Fastly, Google Cloud, Vercel), but confirm what they actually cover.
4. Can you not patch immediately? → Put mitigations in place: enable the WAF rules your provider has published, and monitor for the warning signs below. Treat this as a stopgap, not a fix.
A rough rule of thumb: for a bug in the engine itself, application-level hardening will not save you. Patching PHP is the only complete remediation.
Warning Signs to Monitor
Because these flaws operate below the application layer, normal application logs may show very little. The researchers suggest watching for:
- Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses
- Unexpectedly large or malformed
PHPSESSIDcookies in responses - Unexplained PHP worker crashes or restarts
These are investigation signals, not proof of compromise.
Timeline
- August 19, 2026: first vulnerability found
- August 20-21, 2026: RCE confirmed against Drupal, then WordPress
- August 24, 2026: vulnerabilities reported to the PHP security team
- September 21, 2026: PHP acknowledges the reports and begins work on a fix
- October 21, 2026: patched releases and public disclosure
Conclusion
PHP2Shell matters for two reasons. The first is scale: a flaw in a runtime that powers a large share of the web reaches far beyond any single application, and it affects releases going back a decade. The second is what it suggests about the future: if AI really does shrink the effort needed to turn a hard-to-exploit bug into a working attack, then “too complicated to exploit” stops being a safe assumption. Defenders get the same tools, but only if they use them and patch quickly.
The practical takeaway is simple. Find every place PHP runs in your stack, update to the patched release, and use mitigations only as a bridge until you can.
FAQ
Q: Is 70% of the internet compromised?
No. PHP powers a large share of websites, but being affected means running a vulnerable version. Actual exposure depends on your PHP version, configuration and whether you have patched.
Q: Do I need to run WordPress, Drupal or Joomla to be at risk?
No. Those were demonstration targets. The vulnerable code is in PHP itself, so any PHP application on an affected version can be at risk.
Q: Can a WAF replace patching?
No. Several providers released rules to reduce exposure before disclosure, which is useful when you cannot patch immediately, but the PHP update is the only complete fix.
Q: Why were these bugs not found earlier?
The code had been present for over a decade, but finding the flaw was only half the challenge. Proving it was exploitable required a very complex chain of steps, and that is the part Wiz says AI made practical.
Q: Where can I read the primary sources?
Start with the Wiz Research post, then the PHP Foundation’s security release announcement and the write-ups from Calif and OpenAI, which cover the history and technical details in more depth.
Sources and Further Reading
- Wiz Research: PHP2Shell, the original disclosure this post is based on
- PHP release announcement, October 21, 2026
- The PHP Foundation: today’s security release
- Calif: PHP2Shell write-up
- OpenAI: coordinated disclosure of critical vulnerabilities
- PHP2Shell: what you need to know
- Provider guidance: Cloudflare, Fastly, Google Cloud, Vercel
.webp)
