PHP2Shell Emergency: What Businesses Need to Know About Critical PHP RCE Flaws

Two critical vulnerabilities in the PHP runtime can allow an attacker to execute code on a web server without authentication. The flaws, collectively known as PHP2Shell, affect the software layer underneath WordPress, Drupal, Joomla, Magento, Laravel, and custom PHP applications. On October 23, PHP also published guidance for a separate, narrower RCE vector (CVE-2026-115560) that is not part of PHP2Shell.

The Short Version

On October 21, 2026, the PHP project released emergency security updates for CVE-2026-109618 and CVE-2026-109619, two critical memory-safety vulnerability classes that can allow unauthenticated remote code execution. Researchers also demonstrated process-memory disclosure that can expose passwords, tokens, API keys, certificates, and other sensitive data present inside a PHP worker.

The first fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP's official guidance is clear: configuration mitigations can reduce exposure to specific attack paths, but updating the PHP runtime is the only complete remediation.

Amazon Threat Intelligence reported PHP2Shell exploitation attempts in honeypot telemetry dating back to October 17, four days before public disclosure. After disclosure, AWS observed additional proof-of-concept activity and broad exploitation attempts against sensors.

On October 23, PHP published a separate informational advisory for CVE-2026-115560. PHP describes this additional RCE path as unlikely in practice because it requires an unusual combination of session configuration and application behavior. Until its next routine bugfix release, PHP recommends disabling session upload progress for potentially affected configurations.

Immediate action:

Inventory every PHP runtime exposed to web traffic, upgrade to a fixed or vendor-patched build, verify the running workers actually use the patched runtime, keep WAF protections enabled, and review logs for signs of exploitation dating back to at least October 17, 2026.

What Is PHP2Shell?

PHP2Shell is the name given to two related vulnerability classes in the PHP core runtime: CVE-2026-109618 and CVE-2026-109619. Both involve unsafe internal state after request processing fails unexpectedly.

These are not WordPress plugin bugs, theme vulnerabilities, or flaws in one specific CMS. The vulnerable behavior exists in PHP itself. That distinction matters because a website can have fully updated application code and still be running on an affected PHP runtime.

Why PHP2Shell Is So Serious

1. The vulnerable layer is PHP itself

Cloudflare and Wiz cite PHP usage at roughly 70% of websites. That does not mean 70% of the web is confirmed exploitable, but it explains why a vulnerability in the PHP engine has such a large potential blast radius.

2. Authentication may not be required

PHP's official advisory states that the two critical CVEs can permit unauthenticated RCE. For certain demonstrated paths, an attacker does not need a valid CMS account, administrator password, or existing foothold.

3. A secure application can still sit on a vulnerable runtime

Researchers demonstrated exploitation against representative WordPress, Drupal, and Joomla environments, but emphasized that the vulnerable code is in the PHP runtime. Even simple custom applications can be affected if the underlying runtime is vulnerable and the necessary conditions are present.

4. Memory disclosure can expose secrets

Wiz demonstrated application-agnostic disclosure of PHP worker memory. Depending on what is present in memory, this can expose credentials, API keys, authentication tokens, certificates, or data belonging to other requests.

5. Exploitation activity began before public disclosure

AWS says its MadPot honeypot telemetry recorded an exploitation attempt on October 17, before the October 21 public advisory. Organizations should not assume that patching on disclosure day automatically means there was no earlier exposure.

The AI Security Inflection Point Behind PHP2Shell

PHP2Shell is also significant because of how the vulnerabilities were discovered and developed. OpenAI says Calif identified a critical PHP flaw using GPT-5.6 Sol as part of its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerability classes. Wiz says its team used frontier models including Gemini 4 Argon and GPT-5.6 Sol during research, exploit development, detection, and patch validation.

The vulnerable code had existed for years. What changed was the economics of complex vulnerability research. AI-assisted research can reduce the time required to analyze, test, and adapt difficult memory-safety findings.

This helps defenders find hidden vulnerabilities faster, but it can also shorten the time between public disclosure and practical exploitation. AWS recommends thinking in hours rather than traditional seven- or thirty-day patch windows for critical internet-facing vulnerabilities.

Which Systems Should Businesses Check?

PHP's October 21 advisory says the affected category includes PHP installations serving web requests through common server APIs such as PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP, and LiteSpeed environments. PHP considers risk particularly high for mod\_php because an unauthenticated request was demonstrated to trigger an attack path before application code executed.

Inventory PHP underneath WordPress, WooCommerce, Drupal, Joomla, Magento/Adobe Commerce, Laravel, Symfony, Moodle, Nextcloud, MediaWiki, custom portals and APIs, legacy internal applications, staging systems, forgotten subdomains, and container images that may recreate outdated runtimes.

Which PHP Versions Should Be Installed?

PHP 8.1 and older no longer receive upstream support. Some Linux distributions and commercial LTS vendors may provide backported security fixes. Verify the vendor advisory and package changelog rather than relying only on the visible upstream PHP version string.

PHP also provided minimal source backports for 7.4, 8.0, and 8.1 because of the severity of the issue, but unsupported runtimes should still be treated as technical debt requiring an upgrade plan.

Updating WordPress Is Not the Same as Updating PHP

A WordPress dashboard can show that WordPress core, plugins, and themes are fully updated while the hosting environment is still running an affected PHP runtime. The same is true for Drupal, Joomla, Laravel, and other PHP-based software.

Application patching and runtime patching are different layers.

PHP2Shell requires administrators or hosting providers to update the PHP runtime itself.

If a third-party hosting provider manages PHP, ask for confirmation of the runtime version or the vendor's backported security package. Do not assume that a managed CMS update automatically includes the PHP fix.

What Changed on October 23: CVE-2026-115560

Two days after the emergency PHP2Shell patches, PHP published an informational advisory for a separate RCE vector, CVE-2026-115560.

PHP says this issue requires an unusual combination of conditions: the application is configured with `session.serialize_handler` set to `php_binary` or `php_serialize`; the application changes that setting to `php` at runtime with `ini_set()`; the change happens before `session_start()`; and session upload progress is still enabled.

Applications that never change the serialize handler at runtime are not exposed through this specific path, according to PHP. Because PHP considers the setup unlikely in practice, it is handling the fix in the regular release cycle.

For environments that may match the affected pattern, PHP recommends temporarily setting:

``` session.upload_progress.enabled=0 ```

If that setting was already disabled as part of the October 21 mitigation guidance, PHP says no additional action is required for this specific issue.

If You Cannot Patch Immediately

PHP explicitly warns that configuration changes do not make an affected PHP2Shell installation fully safe. They are temporary risk-reduction measures while the update is completed.

For CVE-2026-109618

• PHP recommends considering `memory_limit=-1` in a configuration layer applications cannot override.
• Reduce `post_max_size` and keep `upload_max_filesize` below it based on application needs.
• Enforce request-size and complexity limits at the web server or proxy layer where practical.
• Use container or cgroup memory boundaries rather than unsafe substitute memory-limit mechanisms.

For CVE-2026-109619 and the new session-related guidance

• Set `session.upload_progress.enabled=0` in a configuration layer that applies before request parsing.
• Restart or recycle affected workers after changing server-level configuration.
• On PHP 8.5, PHP's advisory also recommends disabling fatal error backtraces as a temporary mitigation for one confirmed attack path.
• Fix attacker-reachable fatal errors and timeouts rather than simply hiding diagnostic output.

Test emergency configuration changes because controls that reduce attack surface can also affect uploads, memory consumption, application behavior, or availability.

Can a WAF Protect Against PHP2Shell?

A web application firewall can provide valuable defense in depth, but it should not be treated as the fix. Cloudflare deployed managed WAF protections before public disclosure and continues to update them as payloads evolve. AWS also published WAF mitigation guidance for customers that need temporary protection while patching.

WAF controls can block known patterns, reduce exposure during a maintenance window, and provide useful telemetry. But PHP and Cloudflare emphasize the same priority: patch the PHP runtime even if WAF protections are active.

What Should Security Teams Investigate?

Because AWS observed exploitation attempts before the public advisory, organizations with internet-facing affected PHP should consider retrospective investigation rather than only confirming that the patch is now installed.

• POST requests containing `PHP_SESSION_UPLOAD_PROGRESS`
• Unusual or malformed multipart requests
• Unexpected spikes in HTTP 500 errors
• Memory-limit errors or unexplained PHP worker crashes/restarts
• Unexpected child processes launched by web-server or PHP worker accounts
• Unexpected file creation or modification
• New web shells, scheduled jobs, SSH keys, or persistence mechanisms
• Unexpected outbound network connections from web servers
• Changes to credentials, secrets, API keys, or environment files

AWS recommends investigating from at least October 17 for the original PHP2Shell CVEs.

The 15-Point PHP2Shell Response Checklist

1. Inventory every PHP runtime, including production, staging, containers, legacy systems, and forgotten subdomains.
2. Prioritize internet-facing systems.
3. Verify the actual runtime version, not only the CMS version.
4. Upgrade supported branches to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later supported builds.
5. Verify vendor backports for distribution-managed or LTS packages.
6. Plan retirement of unsupported PHP.
7. Restart or recycle workers as required so patched binaries and configuration are active.
8. Keep WAF protections enabled as defense in depth.
9. Disable session upload progress where required by current PHP guidance.
10. Review upload functionality before changing request-size controls.
11. Review logs back to at least October 17 on exposed systems.
12. Hunt for unexpected process execution and file changes.
13. Rotate secrets if compromise is suspected.
14. Validate the site after patching with functional and security checks.
15. Document ownership so runtime security does not fall between the web developer, hosting provider, and internal IT team.

Related reading: Why vulnerability exploitation is now a leading breach path (2026 DBIR), 24/7 cybersecurity monitoring for small businesses, and modern web development practices.

Why This Is a Business Risk, Not Just a Developer Problem

A compromised PHP server can expose customer databases, CMS administrator credentials, payment integrations, API credentials, SMTP accounts, cloud tokens, personal data, and internal application connections. It can also become a foothold for lateral movement if the web server can reach other business systems.

That is why vulnerability management needs clear ownership across development, hosting, infrastructure, cybersecurity, and business leadership.

What South Florida Businesses Should Do Now

PHP2Shell is a global vulnerability, not a South Florida-specific threat. But businesses in Miami, Miami Lakes, Fort Lauderdale, Broward County, and across South Florida run the same WordPress sites, e-commerce systems, customer portals, and PHP applications affected by this class of risk.

SMBs are especially vulnerable to ownership gaps: a marketing agency may manage WordPress, a hosting provider may manage PHP, internal IT may manage DNS and security, and nobody may have explicit responsibility for the runtime underneath the site.

Website maintenance is infrastructure security.

How CompuAce Helps Reduce Web and Server Security Risk

CompuAce helps businesses manage the infrastructure and security layers web applications depend on, including managed IT, cybersecurity, patching, monitoring, cloud and hosting, web development, and vulnerability management.

• PHP runtime and hosting inventory
• Version and patch verification
• Exposure review for internet-facing systems
• Web server and PHP-FPM configuration review
• WordPress and web application maintenance
• WAF and edge-security review
• Log review and threat hunting
• Server hardening
• Credential and secret rotation planning after suspected compromise
• Ongoing patch and vulnerability management
• 24/7 monitoring and backup planning

Explore CompuAce SMB Security, our IT solutions, and our editorial and sourcing standards.

Is Your Website Running a Vulnerable PHP Runtime?

A fully updated CMS does not guarantee that the PHP engine underneath it is secure. If you are unsure which PHP version your websites or applications are actually running, now is the time to verify.

Request a Web & Server Security Review

PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the name used for two critical memory-safety vulnerability classes in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution and, in some attack paths, disclosure of sensitive process memory.

Which PHP versions fix PHP2Shell?

The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. Administrators should use their operating-system or hosting vendor supported security packages when applicable.

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is in the PHP runtime itself, not in WordPress, Drupal, Joomla, or a specific plugin. Updating the CMS alone does not update the PHP runtime beneath it.

Can a WAF fully replace the PHP security update?

No. WAF rules can reduce exposure to known attack paths and provide defense in depth, but PHP states that updating to a fixed runtime is the only complete remediation for CVE-2026-109618 and CVE-2026-109619.

What is CVE-2026-115560?

CVE-2026-115560 is a separate, narrower PHP RCE vector disclosed on October 23, 2026. PHP says it requires an unusual combination of session serialization settings, a runtime handler change, and enabled session upload progress. PHP recommends disabling session upload progress until the next regular bugfix release for potentially affected configurations.

What should I check after patching PHP?

Verify that every PHP runtime is actually on a fixed or vendor-patched build, restart or recycle long-running PHP workers as required, review web and application logs for suspicious requests, check for unexpected process execution or file changes, and confirm that temporary mitigations have not introduced application problems.

Are WordPress, Drupal, and Joomla specifically vulnerable?

Researchers demonstrated unauthenticated remote code execution against representative WordPress, Drupal, and Joomla environments, but the underlying flaws are in PHP itself. Any web application running an affected PHP runtime may be exposed depending on version, configuration, server API, and attack path.

Sources & Editorial Transparency

This article prioritizes first-party security advisories and technical research from the PHP project, OpenAI, Wiz, AWS, and Cloudflare. Secondary reporting was used only to track the October 23 developing advisory and was cross-checked against PHP's official publication.

• PHP Project — October 21 critical RCE advisory and October 23 session upload progress advisory
• PHP Project — PHP 8 release changelog
• PHP Manual — Session runtime configuration
• OpenAI — Patch the Planet
• Wiz Research — PHP2Shell technical research
• AWS Security Blog — exploitation observed before disclosure
• AWS Security Blog — WAF mitigation guidance
• Cloudflare — PHP2Shell WAF protections and technical overview
• The Hacker News — October 23 update on CVE-2026-115560

Editorial note: This is a rapidly developing security event. Vulnerability status, vendor backports, threat activity, WAF rules, and recommended mitigations may change after publication. CompuAce reviewed the cited guidance on October 23, 2026. Administrators should verify the latest PHP and operating-system vendor advisories before making production changes.

By CompuAce Team — 2026-10-23

Schedule a Consultation | View Our Services | Back to Blog