What Is PHP2Shell? Critical PHP Vulnerabilities (CVE-2026-109618 / 109619) and How Partnerfy Responded

Short answer: PHP2Shell is the name given to two critical security vulnerabilities in the PHP core, patched on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. Both scored 9.2 (Critical) on the CVSS v4.0 scale. In the worst case, an attacker needs no account at all: specially crafted HTTP requests are enough to execute code on the web server (RCE). The problem is not in your application; it is in PHP itself. That means even a spotless WordPress or Laravel codebase, or a simple "Hello World" site, is at risk if it runs on a vulnerable PHP version. The only complete fix is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package) and restart every PHP worker. At Partnerfy, we didn't wait for the official patch: about three hours before it was released, we rolled out a temporary mitigation on our servers, took full account backups and tightened our defenses layer by layer. In this article, we explain how the vulnerability came to light, what it is technically, what you need to do and what we did on our side.

This article is written for business owners and technical teams whose website, e-commerce platform or custom software runs on PHP. The technical details are based on the PHP project's official security announcement, PHP's GitHub Security Advisories (GHSA) and the publications of the researchers who discovered the flaws. Where sources contradict each other, we say so explicitly. The situation is evolving fast; this article is current as of the evening of 21 October 2026.

What is PHP2Shell, and why is it so serious?

PHP is one of the most widely used server-side languages on the web. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel all run on PHP. Three characteristics make PHP2Shell so serious:

• No authentication required. The attacker doesn't need to register on your site, know a password or fill in a form. Specially crafted requests are enough.
• It can be triggered before your application code runs. According to the PHP project, the risk is highest on Apache mod_php setups. There, an unauthenticated request was shown to trigger the attack before any application code runs. Updated plugins, clean code and in-application security checks won't close this path.
• The impact is extremely broad. According to the PHP project, the exposure covers "all PHP installations serving web requests": PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. According to Wiz, one of the teams that discovered the flaws, every PHP version released in the last decade, going all the way back to 5.4, is affected by at least one of the two vulnerabilities. That scope claim is Wiz's; PHP's official advisory lists only the supported 8.2–8.5 branches.

The verdicts are stark. Wiz describes the findings as "among the most severe vulnerabilities discovered in PHP". According to statements reported in the press, the UK's National Cyber Security Centre (NCSC) recommended taking systems that cannot be patched immediately offline. CERT-EU likewise advised isolating internet-facing applications until a patch is in place. Security researcher Kevin Beaumont summed up the situation well: "The PHP situation will lead to a mass of incidents."

How did it come to light? The timeline

The PHP2Shell story begins in 2024 and turns into one of the most turbulent cybersecurity weeks of 2026. All times are given in UTC.

At the time of publication, no public source has confirmed that a specific server was successfully compromised through these flaws. But the attempts have begun, and researchers expect a long tail. In the words of incident responder Hal Pomeranz: "There will be a long tail for this one."

The AI factor: the gap between patch and exploit is now measured in hours

One more detail makes PHP2Shell a distinctly 2026 story: AI models played a role both in discovering the flaw and in finding the path to exploitation. OpenAI's Codex Security team independently reported one of the findings. Wiz, for its part, writes: "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit." A bug that stayed theoretical in 2024 was weaponized in 2026 with the help of machines. For defenders, the message is clear: the clock starts ticking the moment a patch is released, and the luxury of "we'll look at it over the weekend" is gone.

What's happening under the hood? Two flaws, two different root causes

Both vulnerabilities are memory safety bugs. Both relate to how PHP handles fatal errors (particularly out-of-memory errors) that occur while it is processing a request. But their mechanisms are different.

CVE-2026-109618: "Half-built" data at the moment memory runs out

When the memory limit is exceeded during a request (out-of-memory, OOM), PHP abruptly jumps out of its current context using a mechanism called longjmp() and aborts the request. The official advisory describes the problem like this: at certain points, request memory becomes reachable before it has been fully initialized. If a memory allocation fails at exactly that moment, PHP does not correctly account for this early exit, and the memory is left in an invalid state. The request shutdown routine then reads this half-built data and acts on it. The result is memory corruption and, when the attack is crafted correctly, code execution.

Think of a restaurant kitchen: a waiter is writing up an order ticket when they're suddenly called away, and the ticket is left half-written. The closing crew assumes it's complete and carries out whatever is on it. If an attacker can fill in that half-written ticket however they like, they end up running the kitchen.

So how does the attacker hit that exact moment? The techniques listed in the advisory rely on the multipart/form-data format used for file uploads:

• Multipart requests that don't declare a usable content length can slip past the initial post_max_size check.
• A single multipart part can contain an unlimited number of headers.
• Empty file fields don't count toward the max_file_uploads limit, yet they still create file metadata arrays.
• Nested field names multiply the array-building work.

In short, the attacker crafts a request that drives PHP to the edge of its memory at precisely the wrong moment. As Wiz points out, PHP parses multipart requests at request startup, before normal module initialization has completed. Apache mod_php, meanwhile, runs the shutdown routine unconditionally, even if request startup fails. That is why the entire chain can complete without a single line of your application's code running. Full RCE has been confirmed over HTTP against mod_php in a typical prefork configuration with multiple workers, using PHP's default input and memory limits. PHP-FPM is a different story, because the worker process is terminated when request startup fails: source code analysis indicates that FPM may also be affected, but a full exploit against FPM has not yet been demonstrated for this flaw.

CVE-2026-109619: The "ghost" of the previous request

PHP worker processes don't handle a single request and then exit; the same process serves many requests one after another. PHP maintains global state such as error, session, object and extension state. The advisory explains that some of this state is held by the worker but actually points to memory that belongs to a single request. If a request ends at an unexpected moment, these pointers are left behind. The next request to land on the same worker touches this stale state before normal initialization has had a chance to reset it. This is a classic use-after-free bug (using memory that has already been freed). With a strategically crafted heap layout, it can lead to full remote code execution.

The analogy: at a hotel, the previous guest's key card still works, and the new guest walks in before the room has been cleaned. The previous guest's belongings are still inside.

This flaw also has a data leakage dimension. According to Wiz, the memory disclosure can include passwords, authentication tokens, API keys and certificates belonging to other requests or to the server itself. One of the confirmed paths is the session upload progress feature. This feature is enabled by default, and the application doesn't even need to call session_start(); session handling can kick in before normal session initialization. The advisory also lists the fatal error backtrace path in PHP 8.5 as a second confirmed path. RCE via the session lifecycle has been confirmed on both mod_php and PHP-FPM.

An important note: according to PHP's official descriptions, CVE-2026-109618 concerns half-built data at the moment memory runs out, while CVE-2026-109619 concerns stale state left over between requests. Some sources (including Wiz) map the attack techniques to the CVE numbers differently. In this article, we follow PHP's GitHub Security Advisories.

Who is affected? Version table

It doesn't matter which application you run. Wiz carried out its demonstrations on the official WordPress, Drupal and Joomla images. That's not because these platforms are vulnerable themselves, but because they all run on PHP. Updating WordPress core or your plugins will not fix this vulnerability; what needs updating is PHP itself, on the server.

To give a sense of scale: according to Mallory's analysis based on Shodan data, as of 20 October there were roughly 884,000 servers on the internet advertising PHP 8.1 or older in their HTTP headers. These versions cannot receive official patches. This is a header count, not a verified number of affected systems, but it shows just how long the long tail is likely to be.

What did Partnerfy do? A 6-layer defense that didn't wait for the patch

When news of the vulnerability leaked, the picture was crystal clear: the official patch was still hours away, and attackers were already gearing up. On top of that, with everyone around the world trying to pull updates at the same time, package repositories were straining under heavy load and locking up. So we didn't settle for "let's wait for the patch". We built our defense layer by layer.

1. Early response: a temporary mitigation hours before the official patch

Our DevOps team tracked the news of the leak and the first technical assessments closely and, about three hours before the official patch was released, disabled session.upload_progress.enabled server-wide. This is precisely the temporary mitigation PHP recommends for CVE-2026-109619. And we didn't just flip the switch; we flipped it in the right place. The PHP team requires this setting to be applied at the main configuration level (php.ini / server configuration), not via ini_set() or .user.ini. Our change was made at exactly that level and verified in the live configuration.

2. The edge layer: filtering attacks before they reach the server

Our corporate website, partnerfy.co, and the projects we serve behind Cloudflare are shielded by Cloudflare's edge network. Cloudflare rolled out its first WAF ruleset against known PHP2Shell vectors by default early on 21 October. As a result, a significant share of suspicious requests is filtered out before it ever reaches our servers. Since attackers have reportedly been modifying their payloads to get past the initial rules, we never treat this layer as sufficient on its own; the other layers stand right behind it.

3. Hardened PHP configuration: cutting off the attacker's next move

The PHP configuration on our servers was hardened long before this crisis. Functions that execute system commands (system, popen, proc_open and the like) are disabled; remote file inclusion (allow_url_include) is disabled. Let's be candid: a memory-level RCE could, in theory, get around these restrictions. But in the real world, an attacker's first move is usually to open a command shell, download tools or drop a web shell. These restrictions make those critical post-exploitation steps far harder and far noisier. And noise means getting caught.

4. Account isolation: even if a door opens, the corridor stays locked

Every account on our servers runs inside its own isolated file system "cage". Even if the worst-case scenario plays out in one account, the attacker's ability to move laterally into other accounts' files and processes is severely restricted. One broken link does not mean the whole chain breaks.

5. Disaster-scenario backups: ready for the worst

Ahead of the patch window, we took full backups of the accounts on our servers. The goal is simple: if something goes wrong, the question is not "what have we lost?" but "which clean restore point do we go back to?" A good security strategy is not only about blocking attacks; it is also about being able to return quickly to a clean state even if an attack succeeds.

6. Patching, restarts and hunting for indicators

As the official patched packages land in the distribution channels, we apply them to our servers and then restart all PHP workers. The restart is non-negotiable: old workers that keep running continue to use the old code. Because the patch introduces a new hard memory limit, we are also reviewing our memory settings in that light.

At the same time, we combed through our access logs for the indicators described by researchers. A concrete example: about three hours after the patch was released, a series of POST requests hit our site's root and paths such as /api and /app from a single cloud IP address posing, one after another, as various search engine and AI bots (CCBot, Amazonbot, ClaudeBot and others). Every single one of these requests was rejected with a 403 by the server-side security layer before it could reach our application. We cannot say for certain that these were PHP2Shell attempts, but the timing and the fake-identity pattern are consistent with the mass scanning that began after the patch. As of publication, we have detected no sign of compromise on our systems.

The Partnerfy approach: we never leave security to a single lock. Filtering at the edge, hardening on the server, isolation between accounts, backups behind us, rapid response up front. If one layer is breached, the next one is already on duty.

What should you do? A step-by-step checklist

1. Find out your PHP version

If you use cPanel, you can check it on the "MultiPHP Manager" or "Select PHP Version" screen; if you have server access, use php -v. Be careful: the PHP version on the command line may differ from the one running your website. The most reliable method is to ask your hosting provider which PHP version your site uses, or to check with a temporary phpinfo() page and delete it immediately afterwards. If you're on shared hosting, the update is your hosting provider's job, not yours. Ask them today: "Have you applied the PHP2Shell patch?"

2. Update and restart

Target versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. In Linux distribution packages, the version number may look different. As Debian also recommends, look for the CVE number in the package changelog rather than relying on the version number. After updating, restart Apache, PHP-FPM and any long-running PHP workers.

3. If you can't update right away: temporary mitigations

Let's start with the PHP project's own warning: these measures "reduce exposure to specific attack paths but do not make an installation safe." The only complete fix is to update.

4. If you're on an old PHP version: the upgrade can't wait

PHP 8.1 and earlier no longer receive updates from the PHP project. For a site running on these versions, the real fix is not a patch but an upgrade. Remember: support for PHP 8.2 also ends on 31 December 2026. Moving to 8.2.35 today will get you out of trouble, but if you enter 2027 on 8.2, there will be no patch for you in the next crisis. If your legacy codebase doesn't run on newer PHP versions, that's a sign the time has come for a software modernization project.

5. Check for signs of compromise

Indicators researchers recommend checking for after patching:

• Unusual multipart requests immediately followed by memory limit errors or bursts of HTTP 500 responses
• Unexpectedly large or malformed PHPSESSID cookies
• Unexplained PHP worker restarts or crashes
• php-fpm, httpd or apache2 processes spawning a shell, an interpreter or a download tool (such as sh, bash, curl or wget)
• New files in the web root (web shells), new cron jobs, new user accounts

Because the attack happens below the application layer, it may leave very few traces in your application logs. Check your web server and PHP logs. If anything looks suspicious, isolate the server, preserve the logs, then investigate. Since CVE-2026-109619 can also lead to memory disclosure, it also makes sense to rotate database passwords, API keys and session secrets if in doubt.

The lesson from this crisis: security is not a product, it's a reflex

PHP2Shell made three things abundantly clear. First, no matter how clean your application is, you are only as secure as the platform it runs on. Second, in the age of AI, the gap between patch and exploit has shrunk to hours. Third, when leaks and embargo breaches happen, the "we'll stick to the official schedule" approach collapses. The winners are the teams that read the news in the first hour, apply the temporary mitigation, keep their backups ready and never leave their defense to a single lock.

At Partnerfy, this reflex comes as standard across our managed hosting and server management, cybersecurity and backup and disaster recovery services. As a software company headquartered in Sakarya, with offices in Türkiye, Germany, Russia and Ireland, we can help you pin down which PHP version your site runs on, whether it is exposed to PHP2Shell and how to prepare for the end of PHP 8.2 support. Get in touch with us and let's check your site together.

Sources

• PHP: Security announcement of 21 October 2026
• GHSA-w8hw-w9fx-j79w: CVE-2026-109618 (RCE via OOM corruption)
• GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 (RCE via stale global state)
• The PHP Foundation: Today's PHP security release and how we're strengthening PHP security
• Wiz: PHP2Shell research
• Help Net Security: PHP2Shell vulnerabilities patched
• The Hacker News: PHP issues emergency patches for two critical flaws

Frequently Asked Questions (FAQ)