PHP2SHELL: Critical PHP RCE Flaws Threaten Web Infrastructure Amid Active Exploitation (CVE-2026-109618 & CVE-2026-109619)
Executive Summary
On October 21st, 2026, the PHP project released fixes for two critical vulnerabilities in the PHP runtime that are under active exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws let an unauthenticated, remote attacker execute code as the web server worker by sending crafted requests that corrupt PHP's internal memory when request handling fails.
On October 20th, 2026, the PHP security team gave advance notice of a security release addressing two critical vulnerabilities. PHP is the server-side language behind WordPress, Drupal, Magento, and a large portion of shared hosting on the internet. Because these vulnerabilities affect PHP itself, updating applications alone may not eliminate exposure. Details and proof-of-concept (PoC) exploit code leaked before the release of patches, increasing the risk of widespread exploitation and urgency to patch.
On October 21st, Cloudflare reported early exploitation attempts against both flaws signaling attackers are already weaponizing these flaws in the wild. Given the reach of PHP, the leaked exploit details, and reported attacks, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.
Affected Systems or Products
The NCSC in the Netherlands have compiled a list of software products that use PHP. Additional details are available in the Appendix section of this advisory.
Mitigations / Workarounds
The PHP project states that updating to a release containing the fixes is the only complete mitigation, and that configuration workarounds do not provide complete protection. A single upgrade to a fixed release addresses both vulnerabilities. The two flaws have different root causes, so a measure aimed at one does not protect against the other, and the interim steps below block only specific confirmed paths.
If patching cannot be immediately applied, the following may help to temporarily reduce risk:
- Restrict PHP applications that do not require public access to trusted networks or a VPN. When taking a service offline, use a maintenance response or network restriction rather than disabling the PHP handler, which can expose application source code and credentials.
- Update and deploy WAF rules to restrict malformed or excessive multipart HTTP requests related to the flaw. CloudFlare has also published specific rules in its blog that may help block attack traffic. WAF protections may reduce exploitation attempts but should not be considered a substitute for patching.
- Inventory every server, container image, and appliance that runs PHP, including PHP bundled inside third-party products, and record the version each runs. Commands listed below may help with discovery.
Discovery - Unix Hosts
# Binaries on PATH and across the filesystem
which -a php php5 php7 php8 php-cgi php-fpm 2>/dev/null
find / -xdev -type f -iname "php*" -perm -u+x 2>/dev/null
# Version for each binary found
for bin in $(find / -xdev -type f -iname "php*" -perm -u+x 2>/dev/null); do
echo "$bin: $($bin -v 2>/dev/null | head -1)"
done
# Package manager records
dpkg -l | grep -i php # Debian/Ubuntu
rpm -qa | grep -i php # RHEL/CentOS/Fedora
brew list | grep -i php # macOS/Homebrew
# Web server wiring
grep -r "php" /etc/apache2/sites-enabled/ /etc/nginx/sites-enabled/ 2>/dev/null
find /etc -iname "*fpm*" -path "*php*" 2>/dev/null
# Running processes and listening sockets
ps aux | grep -i php
ss -tlnp | grep php-fpm# Search common install locations and PATH
Get-Command php -ErrorAction SilentlyContinue
where.exe php.exe 2>$null
# Filesystem sweep (slow on large disks)
Get-ChildItem -Path C:\ -Include php.exe,php-cgi.exe,php-win.exe -Recurse -ErrorAction SilentlyContinue -Force
# Common manual-install locations
Test-Path "C:\php", "C:\xampp\php", "C:\wamp64\bin\php", "C:\wamp\bin\php", "C:\Program Files\PHP", "C:\inetpub\php"
# Version per binary found
Get-ChildItem -Path C:\ -Include php.exe -Recurse -ErrorAction SilentlyContinue -Force | ForEach-Object {
$ver = & $_.FullName -v 2>$null | Select-Object -First 1
[PSCustomObject]@{ Path = $_.FullName; Version = $ver }
}Patches
The PHP project has released fixed versions for every supported branch, linked from its security advisories for CVE-2026-109618 and CVE-2026-109619, and its security team has made minimal source backports available for the end-of-life 7.4, 8.0, and 8.1 branches as an exception for source builders.
Distribution and vendor packages may carry backported fixes without a new upstream version number, so confirm with the package maintainer that the installed build addresses both CVEs, then restart all PHP workers so that requests are served by the patched runtime. The PHP security team states that the volunteer-maintained rpms.remirepo.net repository will not carry the updates on release day.
Indicators of Compromise
On October 21st, 2026, Cloudflare indicated detecting early attacks targeting the two flaws, and Cloudflare proactively deployed web application firewall (WAF) rules for the known exploit vectors. Neither Cloudflare nor the PHP project has published atomic indicators of compromise at the time of writing.
Exploitation occurs below the application layer, so PHP exploitation attempts may not appear in application logs. Review the following sources for signs of exploitation:
- Web server, reverse proxy, and WAF logs: unusual POST or
multipart/form-datarequests, including to endpoints that do not normally accept uploads; requests with excessive fields or headers, missing or malformed content lengths, deeply nested field names, or anomalous body sizes; references toPHP_SESSION_UPLOAD_PROGRESSwhere request-body inspection is available; and repeated HTTP 500 responses following such requests. - Response headers, where logged: unexpectedly large or malformed
PHPSESSIDresponse cookies, which Wiz identifies as a sign of the memory disclosure path. - PHP, PHP-FPM, and system logs: memory-limit errors, fatal errors, execution timeouts, worker crashes, unexpected restarts, out-of-memory (OOM) killer activity, and unexplained PHP worker churn, particularly when correlated with suspicious HTTP traffic
- Host and endpoint telemetry: child processes launched by PHP or web server workers, unauthorized changes to web files or scheduled tasks, unusual outbound connections, and suspicious access to credentials.
Preserve web, PHP, application, and host logs before restarting or rebuilding a suspect system. Because the memory disclosure path can expose passwords, authentication tokens, API keys, and certificates from other requests, treat secrets held by an affected PHP process as potentially exposed when these signs appear.
Technical Details
On October 21, 2026, the PHP development team released a security advisory addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution (RCE). Wiz Research combined the flaws into an exploit chain dubbed php2shell and demonstrated unauthenticated remote code execution (RCE) against current WordPress, Drupal, and Joomla container images. Because the flaws reside in PHP itself, even basic applications running vulnerable versions may be exposed.
Both vulnerabilities stem from PHP improperly handling memory exhaustion, potentially leaving corrupted memory that subsequent HTTP requests can exploit. Apache mod_php is particularly exposed due to its persistent worker processes, while exploitability varies across other PHP configurations
The exploit chain works as follows in the Wiz example:
- An attacker sends crafted multipart HTTP requests designed to trigger an out-of-memory (OOM) condition or fatal error, leaving internal PHP request state partially initialized.
- PHP terminates the request and frees its memory, but certain internal pointers continue referencing the freed memory.
- A subsequent request handled by the same worker accesses the stale state, potentially disclosing process memory through a
PHPSESSIDresponse cookie, or executing malicious code injected to the affected memory.
Researchers note that exploitation requires adaptation to the target's PHP version, configuration, underlying OS architecture, and memory layout, a process researchers can accellerate using frontier AI models.
How Beazley Security is responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
Appendix
The NCSC has published a GitHub repository cataloging hundreds of software products and libraries that use PHP.
The list underscores PHP’s widespread adoption and the potential reach of these vulnerabilities, spanning hundreds of popular web applications and libraries. Even the top 30 include products that power much of the internet:
- WordPress
- WooCommerce
- Composer
- Laravel
- Symfony
- phpMyAdmin
- Drupal
- Joomla
- cPanel EasyApache / MultiPHP
- Plesk (Linux + Windows)
- Docker Official PHP images
- Nextcloud Server
- Nextcloud
- PHPUnit
- Doctrine ORM / DBAL
- Twig
- Monolog
- Adobe Commerce / Magento
- MediaWiki
- Moodle
- PrestaShop
- Matomo On-Premise
- TYPO3
- Roundcube Webmail
- phpBB
- XAMPP
- Zabbix web frontend
- AWS SDK for PHP
- CloudLinux Alt-PHP
- Shopware 6
Sources
Aware of an incident impacting your industry? Let us know: