PHP2Shell Explained: Two Critical PHP Flaws That Can Hand Over a Server

Most of the web runs on PHP, and on 21 October the people who maintain PHP told everyone to stop what they were doing and update. The project shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and its security advisory said the releases fix two critical vulnerabilities that can allow unauthenticated remote code execution.

The pair, CVE-2026-109618 and CVE-2026-109619, goes by the nickname PHP2Shell. Security researcher Kirill Firsov coined it for an exploit chain he demonstrated on video, according to Tenable's FAQ. The bugs were credited to researchers at Calif, OpenAI and Wiz, and the full story of the leak that followed is in our timeline of PHP2Shell.

What is PHP2Shell?

It is two flaws in the PHP runtime itself, the engine that reads a web request and runs the code behind a page. PHP says each is rated 9.2 on the CVSS v4.0 scale, which sits in the critical band. An attacker needs no password and no user to click anything.

The affected setups are all the usual ones: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team says it considers the risk highest for mod_php, where a demonstrated exploit can fire before any application code has run.

What do the two bugs actually do?

Both bugs come from how PHP behaves when it runs out of memory partway through setting up a request. PHP describes CVE-2026-109618 as out-of-memory handling that can interrupt PHP while internal request data is only partly initialised, so cleanup later treats invalid data as valid. It describes CVE-2026-109619 as request state that survives after its memory has been freed, which a later request on the same worker can then use.

Wiz Research, in its write-up, ties this to two features most people never think about. PHP parses multipart/form-data requests, the format used for file uploads, before its modules finish starting up. The session upload-progress feature can publish a session identifier at that early stage. If an out-of-memory error aborts the request, that identifier can point at freed memory, and a later multipart request on the same worker can trust it. Wiz says this works even when the application never calls session_start().