{"id":49556,"date":"2026-10-22T09:30:35","date_gmt":"2026-10-22T04:00:35","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49556"},"modified":"2026-10-22T14:03:51","modified_gmt":"2026-10-22T08:33:51","slug":"php2shell-php-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/security-advisory\/php2shell-php-vulnerabilities\/","title":{"rendered":"PHP2Shell: Two Critical PHP Vulnerabilities, How They Work, and What to Do About Them"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">PHP powers roughly 70% of websites on the internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we&#8217;ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So when vulnerabilities show up in PHP&#8217;s core engine, it&#8217;s worth paying attention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name <strong>PHP2Shell<\/strong>. Both carry a CVSS score of 9.2 and can allow unauthenticated attackers to execute code on vulnerable servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The interesting part isn&#8217;t just the severity. These bugs had existed for years. AI helped researchers turn complex memory-safety issues into working exploits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s what happened, how the vulnerabilities work, and what you should do about them.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Key takeaways<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PHP2Shell<\/strong> is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.<\/li>\n\n\n\n<li>The flaws sit in the PHP runtime itself, so WordPress, Drupal, Joomla, and custom PHP applications can be exposed even when their own code is secure.<\/li>\n\n\n\n<li>Exploitation can lead to unauthenticated remote code execution (RCE) and leakage of sensitive data from PHP process memory.<\/li>\n\n\n\n<li>Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Patch, restart PHP workers, and confirm the version actually running in production.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_is_PHP2Shell\"><\/span>What is PHP2Shell?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell refers to two CVEs affecting PHP&#8217;s core engine:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>CVE<\/th><th>Severity<\/th><th>Key issue<\/th><\/tr><tr><td>CVE-2026-109618<\/td><td>CVSS 9.2<\/td><td>Upload-progress handling, memory corruption, and process-memory disclosure<\/td><\/tr><tr><td>CVE-2026-109619<\/td><td>CVSS 9.2<\/td><td>Stale internal state and OPcache type confusion<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The important distinction is that these are not WordPress plugin vulnerabilities or bugs in a particular CMS. The underlying issues exist in PHP itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wiz Research demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla. But these are examples of affected applications, not an exhaustive list. A vulnerable PHP runtime can expose an application even when its own code is secure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_do_the_PHP2Shell_vulnerabilities_work\"><\/span>How do the PHP2Shell vulnerabilities work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To understand PHP2Shell, you need to understand two concepts: use-after-free and type confusion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A <em>use-after-free<\/em> happens when software continues using a piece of memory after it has been released. A <em>type-confusion<\/em> bug happens when software interprets data as the wrong kind of object.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Both can be dangerous because they allow an attacker to influence how a program reads, writes, or interprets memory.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. CVE-2026-109618: PHP&#8217;s upload-progress handling<\/h3>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2404\" height=\"1548\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b0f443c5-php2shell-cve-2026-109618-attack-flow.png\" alt=\"PHP2Shell CVE-2026-109618 diagram showing how PHP upload progress handling leads to memory corruption and unauthenticated RCE\" class=\"wp-image-49560\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b0f443c5-php2shell-cve-2026-109618-attack-flow.png 2404w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b0f443c5-php2shell-cve-2026-109618-attack-flow.png 357w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b0f443c5-php2shell-cve-2026-109618-attack-flow.png 1536w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b0f443c5-php2shell-cve-2026-109618-attack-flow.png 2048w\" sizes=\"auto, (max-width: 2404px) 100vw, 2404px\" \/><figcaption class=\"wp-element-caption\"><em>How CVE-2026-109618 abuses PHP&#8217;s session upload progress handling to corrupt process memory.<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">PHP supports a feature called session upload progress. It lets applications track the progress of file uploads.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The problem identified by Wiz involves how PHP handles internal state during request processing, particularly when an out-of-memory error interrupts normal execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If PHP fails partway through processing a request, its cleanup routines may encounter internal data that was never fully initialized or that points to memory that has already been released.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under the right conditions, a subsequent request can interact with this stale state.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wiz demonstrated that this family of issues could be used to corrupt PHP process memory and achieve unauthenticated RCE on WordPress, Drupal, and Joomla. The researchers also demonstrated a related memory-disclosure issue that could expose sensitive data from a PHP worker.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That data could include credentials, tokens, or API keys belonging to other requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The security implication is important: a memory-safety flaw can expose more than the application handling the request. It can potentially expose data held in the same process. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. CVE-2026-109619: Stale state and OPcache<\/h3>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2404\" height=\"1182\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b744e91a-php2shell-cve-2026-109619-opcache-type-confusion-use-after-free.png\" alt=\"PHP2Shell CVE-2026-109619 diagram showing fatal error backtrace use-after-free and OPcache type confusion paths leading to pre-auth RCE\" class=\"wp-image-49565\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b744e91a-php2shell-cve-2026-109619-opcache-type-confusion-use-after-free.png 2404w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b744e91a-php2shell-cve-2026-109619-opcache-type-confusion-use-after-free.png 1536w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/10\/b744e91a-php2shell-cve-2026-109619-opcache-type-confusion-use-after-free.png 2048w\" sizes=\"auto, (max-width: 2404px) 100vw, 2404px\" \/><figcaption class=\"wp-element-caption\"><em>How CVE-2026-109619 turns stale state after a fatal error into use-after-free and OPcache type confusion.<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The second CVE involves additional problems with internal state retained across requests and with OPcache, PHP&#8217;s bytecode caching system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PHP workers and OPcache maintain internal references to objects and memory. Those references must remain valid as requests finish, new requests begin, and cached code is managed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a reference survives after the memory it points to has been released, later execution can access invalid state. Separately, inconsistencies in how OPcache tracks runtime objects can cause a memory slot to be interpreted as an object of the wrong type.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are different exploitation paths, but both create opportunities for memory corruption.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wiz demonstrated unauthenticated RCE against Drupal and WordPress using the relevant exploit paths.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The important point is that these are runtime-level weaknesses. Fixing a CMS plugin or reviewing application code alone does not resolve them. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_PHP2Shell_is_different_from_other_PHP_vulnerabilities\"><\/span>Why PHP2Shell is different from other PHP vulnerabilities<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are three things worth paying attention to.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. The attack surface is much larger than a single application.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PHP runs across hosting providers, containers, CMS platforms, and custom applications. Security teams may not even have a complete inventory of every PHP runtime in their environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Memory disclosure can make exploitation easier.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker does not always need to jump straight to code execution. Information leaked from process memory can reveal addresses, credentials, or other data that makes subsequent exploitation easier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. AI changes the economics of exploit development.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to Wiz, frontier AI models helped researchers discover these issues and develop working exploits. The process involved chaining bugs, adapting to different memory layouts, testing, and debugging.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where I think the bigger story lies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The code had existed for years. The fact that a bug has survived for a long time does not mean it is safe. And complexity is becoming a weaker barrier when AI can help researchers reason through it and iterate on working exploits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That cuts both ways. Attackers can move faster, but defenders can also use AI to find weaknesses and improve detection before they are exploited.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Disclosure_timeline\"><\/span>Disclosure timeline<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The responsible disclosure process unfolded as follows:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Date<\/th><th>Event<\/th><\/tr><tr><td>August 19, 2026<\/td><td>Wiz Research discovered the first vulnerability<\/td><\/tr><tr><td>August 20, 2026<\/td><td>Unauthenticated RCE was confirmed against Drupal<\/td><\/tr><tr><td>August 21, 2026<\/td><td>Unauthenticated RCE was confirmed against WordPress<\/td><\/tr><tr><td>August 24, 2026<\/td><td>The findings were reported to the PHP security team<\/td><\/tr><tr><td>September 21, 2026<\/td><td>PHP acknowledged the reports and began developing a coordinated fix<\/td><\/tr><tr><td>October 21, 2026<\/td><td>Fixed PHP releases became available and the vulnerabilities were publicly disclosed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The response required coordination between the PHP team, researchers, and security providers preparing patches, detections, and mitigations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_fix_PHP2Shell\"><\/span>How to fix PHP2Shell<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Patching is the primary remediation.<\/strong><\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"border-left-color:#1D4ED8;border-left-style:solid;border-left-width:5px;background-color:#EEF4FF;padding-top:20px;padding-right:24px;padding-bottom:20px;padding-left:24px\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Which PHP versions have a PHP2Shell patch?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Official patched releases exist only for the four PHP branches that still receive security support. Every older branch is affected but has no official patched release.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>PHP branch<\/th><th>PHP2Shell fix status<\/th><th>Security support until<\/th><\/tr><\/thead><tbody><tr><td>PHP 8.5<\/td><td><strong>Patched<\/strong> in 8.5.12<\/td><td>Dec 31, 2029<\/td><\/tr><tr><td>PHP 8.4<\/td><td><strong>Patched<\/strong> in 8.4.27<\/td><td>Dec 31, 2028<\/td><\/tr><tr><td>PHP 8.3<\/td><td><strong>Patched<\/strong> in 8.3.36<\/td><td>Dec 31, 2027<\/td><\/tr><tr><td>PHP 8.2<\/td><td><strong>Patched<\/strong> in 8.2.35<\/td><td>Dec 31, 2026 (ending soon)<\/td><\/tr><tr><td>PHP 7.4, 8.0, 8.1<\/td><td><strong>No official release.<\/strong> Minimal source backports only<\/td><td>End of life<\/td><\/tr><tr><td>PHP 5.4 to 7.3<\/td><td><strong>No fix<\/strong> from the PHP project<\/td><td>End of life<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Running PHP 8.1 or older?<\/strong> Upgrade to a supported branch, install a backported package from your Linux distribution or LTS vendor, or build PHP from source with the PHP security team&#8217;s backports for 7.4, 8.0, and 8.1. Systems older than PHP 7.4 should be upgraded, isolated, or decommissioned.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Running PHP 8.2?<\/strong> Patch to 8.2.35 now, but plan a move to 8.3 or newer. Security support for 8.2 ends on December 31, 2026.<\/p>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Check the <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noopener\">PHP security advisories for CVE-2026-109618<\/a> and <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noopener\">CVE-2026-109619<\/a> for the technical details and remediation guidance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your PHP comes from an operating system or hosting provider, check its advisory for the patched package. Distributions often backport fixes without changing the version number, so the version string alone may not tell you whether you are protected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s what I&#8217;d prioritize:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Find every PHP runtime.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inventory PHP across web servers, containers, CMS installations, and applications managed by other teams. Don&#8217;t limit the audit to your primary production application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Patch and verify.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Install the appropriate fixed release. Restart PHP-FPM, web servers, and long-running workers as required. Verify the version actually running in production.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Updating WordPress or another application does not update the PHP runtime beneath it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Update WAF rules.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Apply available protections from your WAF provider. These can provide an additional layer of defense, but the PHP security update remains essential.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Investigate potential exploitation.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review web server and application logs for unusual requests, unexpected PHP worker errors, unexplained process activity, and suspicious outbound connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These signals are not proof of exploitation, but they can help guide an investigation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Check older and less visible environments.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Staging systems, forgotten CMS installations, legacy applications, and third-party managed servers are easy to miss. They still matter if they are exposed to the internet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Astra_helps_customers_detect_PHP2Shell\"><\/span>How Astra helps customers detect PHP2Shell<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At Astra, our focus is not just finding vulnerabilities. It&#8217;s helping customers understand where they are exposed and what needs to be fixed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Astra&#8217;s <a href=\"https:\/\/www.getastra.com\/autonomous-pentesting\">Autonomous Pentest<\/a> and <a href=\"https:\/\/www.getastra.com\/dast\">DAST<\/a> capabilities are actively detecting PHP2Shell vulnerabilities for our customers.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DAST helps identify exposure in running web applications, while Autonomous Pentest goes further by testing applications for exploitable weaknesses and <a href=\"https:\/\/www.getastra.com\/blog\/penetration-testing\/how-autonomous-pentesting-kills-false-positives\/\">validating attack paths<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction matters. Knowing that a vulnerable technology exists in your environment is useful, but understanding whether an exposed application can be attacked helps security teams prioritize remediation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detection is not a substitute for patching. Customers should still update affected PHP runtimes and verify remediation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"A_busy_week_for_security_teams\"><\/span>A busy week for security teams<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell is not happening in isolation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This week has also brought a compromised LiteLLM release containing credential-stealing malware, a Railway security incident involving customer environment variables, and the disclosure of compromised eMudhra intermediate certificate keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are different incidents with different root causes. But they point to a shared challenge: trust in the software, infrastructure, and cryptographic systems we depend on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A vulnerable runtime, a compromised software release, exposed environment secrets, and compromised certificate keys are not the same problem. Yet each can create consequences far beyond the original component.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For security teams, this is why asset inventory, dependency visibility, credential hygiene, and continuous validation matter. You cannot respond quickly to a risk you don&#8217;t know exists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The response also cannot stop at a single scan or a single patching cycle. Systems change, new vulnerabilities emerge, and yesterday&#8217;s trusted dependency can become tomorrow&#8217;s incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Final_thoughts\"><\/span>Final thoughts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell is a reminder that <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/web-application-security\/\">application security<\/a> does not stop at application code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your application can be well written and still inherit serious risk from the runtime it depends on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The immediate priority is straightforward: identify affected runtimes, patch them, and investigate anything suspicious.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The longer-term lesson is about AI. Vulnerabilities that were difficult to discover and exploit are becoming more accessible to researchers. Defenders need to use these same advances to discover weaknesses earlier and reduce the time between disclosure and remediation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The goal is not just to know which vulnerabilities exist. It&#8217;s to know where you&#8217;re exposed, validate the risk, and fix it before someone else gets there.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"PHP2Shell_FAQs\"><\/span>PHP2Shell FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-php2shell-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is PHP2Shell?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>PHP2Shell is the name given to two critical vulnerabilities in PHP&#8217;s core engine, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 and were publicly disclosed on October 21, 2026, together with fixed PHP releases.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Which PHP versions fix the PHP2Shell vulnerabilities?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Official fixes are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older are end of life and have no official patched release. The PHP security team published minimal source backports for 7.4, 8.0, and 8.1, and some Linux distributions and LTS vendors ship backported packages. Versions older than 7.4 have no fix from the PHP project.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does updating WordPress, Drupal, or Joomla fix PHP2Shell?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. PHP2Shell lives in the PHP runtime, not in CMS code or plugins. Updating your CMS leaves the vulnerable runtime in place, so the PHP installation itself must be upgraded and its workers restarted.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Why are these PHP vulnerabilities considered so serious?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They can allow unauthenticated remote code execution, and one exploit path can leak data from PHP process memory, such as credentials or API keys belonging to other requests. Because PHP runs a large share of the web, the potential attack surface is very large.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can a WAF protect against PHP2Shell?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>WAF rules from your provider can add a layer of defense while patches roll out, but they do not replace the PHP security update.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How do I check if my applications are exposed to PHP2Shell?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Inventory every PHP runtime you operate, including staging, legacy, and third-party managed servers, then verify the version running in production. Astra&#8217;s DAST and Autonomous Pentest can help identify exposed applications and validate whether they can be attacked.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Who discovered PHP2Shell, and when was it disclosed?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Wiz Research discovered the first vulnerability on August 19, 2026, and confirmed unauthenticated RCE against Drupal and WordPress within two days. The findings were reported to the PHP security team on August 24, 2026. PHP acknowledged the reports on September 21, 2026, and fixed releases and public disclosure followed on October 21, 2026.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does CVE-2026-109618 work?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>CVE-2026-109618 abuses PHP&#8217;s session upload progress handling. If an out-of-memory error interrupts a request partway through, PHP&#8217;s cleanup routines can touch internal data that was never fully initialized or that points to memory already released. A later request can then interact with that stale state, which Wiz used to corrupt process memory and achieve unauthenticated RCE. A related path can disclose data held in the PHP worker&#8217;s memory.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-9\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does CVE-2026-109619 work?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>CVE-2026-109619 involves internal state that PHP keeps across requests and OPcache, PHP&#8217;s bytecode cache. If a reference survives after its memory has been released, later execution can access invalid state, which leads to a use-after-free. Separately, inconsistencies in how OPcache tracks runtime objects can cause a memory slot to be read as an object of the wrong type. Both paths create opportunities for memory corruption.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-10\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What should I do if I&#8217;m running PHP 8.1 or older?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>PHP 8.1 and older are end of life, so there is no official patched release. Upgrade to a supported branch, install a backported package from your Linux distribution or LTS vendor, or build PHP from source using the PHP security team&#8217;s backports for 7.4, 8.0, and 8.1. Systems older than PHP 7.4 should be upgraded, isolated, or decommissioned.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-11\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Why doesn&#8217;t the PHP version number always show whether I&#8217;m protected?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Operating system vendors and hosting providers often backport security fixes without changing the PHP version number. If your PHP comes from one of them, check their advisory for the patched package instead of relying on the version string alone. After patching, restart PHP-FPM, web servers, and long-running workers, then confirm the version actually running in production.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-12\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What role did AI play in the PHP2Shell research?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>According to Wiz, frontier AI models helped researchers discover these issues and develop working exploits, including chaining bugs, adapting to different memory layouts, testing, and debugging. The vulnerable code had existed for years. The lesson is that complexity is a weaker barrier than it used to be, for attackers and defenders alike.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-13\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What signs of PHP2Shell exploitation should I look for?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Review web server and application logs for unusual requests, unexpected PHP worker errors, unexplained process activity, and suspicious outbound connections. These signals are not proof of exploitation, but they help focus an investigation. Because one exploit path can leak credentials or API keys from other requests, consider rotating secrets on any system where you find suspicious activity.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-php2shell-14\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is Astra&#8217;s detection a substitute for patching PHP2Shell?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Astra&#8217;s DAST and Autonomous Pentest help identify exposed applications and validate whether attack paths are exploitable, which helps you prioritize remediation. You should still update every affected PHP runtime and verify the fix.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">Sources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener\">Wiz Research: PHP2Shell, PHP RCE vulnerabilities<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.php2shell.com\/\" target=\"_blank\" rel=\"noopener\">PHP2Shell technical overview<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noopener\">Official PHP advisory for CVE-2026-109618<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noopener\">Official PHP advisory for CVE-2026-109619<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\" target=\"_blank\" rel=\"noopener\">LiteLLM security incident<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\" target=\"_blank\" rel=\"noopener\">Railway security disclosure<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/emudhra.com\/en\/post\/certificate-security-incident\" target=\"_blank\" rel=\"noopener\">eMudhra certificate security incident<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.google\/security\/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates\/\" target=\"_blank\" rel=\"noopener\">Google&#8217;s response to the eMudhra certificate issue<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell is a pair of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can enable unauthenticated RCE on WordPress, Drupal, and Joomla. Here is how they work and how to fix them.<\/p>\n","protected":false},"author":2,"featured_media":49582,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[819],"tags":[817,818,390,387,816],"class_list":["post-49556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-advisory","tag-cve-2026-109618","tag-cve-2026-109619","tag-php-security","tag-php-vulnerabilities","tag-php2shell"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49556"}],"version-history":[{"count":10,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49556\/revisions"}],"predecessor-version":[{"id":49595,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49556\/revisions\/49595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49582"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}