Website operators are racing to install emergency PHP updates after two critical vulnerabilities became public, exposing a foundation of the web to attacks that require no login credentials.
Patches were released on Oct. 21, replacing advance warnings with an immediate security response. The flaws, collectively called PHP2Shell, carry severity scores of 9.2 out of 10 and can enable unauthenticated remote code execution.
The danger has already moved beyond theory. Amazon says its threat intelligence systems detected an exploitation attempt on Oct. 17, four days before disclosure, and subsequently observed broader exploitation.
Two Critical Flaws Beneath Everyday Websites
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP’s internal memory management and error handling.
The first can leave partially initialized data behind when a request exhausts PHP’s memory allowance. The second can leave internal references pointing to memory that has already been freed. Those failures can create opportunities for attackers to execute code or expose sensitive information.
Researchers demonstrated attacks against WordPress, Drupal and Joomla installations. However, the underlying problem sits inside PHP itself, meaning secure application code alone does not eliminate exposure.
Researchers also demonstrated memory disclosure that could reveal passwords, authentication tokens and API keys.
PHP’s maintainers identify Apache installations using mod_php as the highest-risk configuration, with an attack demonstrated before application code executes. Other deployments, including PHP-FPM, also require attention.
The headline’s two-decade history needs qualification. Calif traces the research lineage to a PHP memory-limit vulnerability discovered in 2004, but identifies its earliest confirmed affected attack path in PHP 5.4.0. That does not establish that both newly disclosed flaws affect every release since 2004.
Attack Attempts Predated the Public Warning
Amazon’s MadPot monitoring network recorded an Oct. 17 exploitation attempt originating from commercial anonymization infrastructure. The company said it remains unclear how the actor obtained information before disclosure.
Further attempts appeared before the scheduled release on Oct. 21. Amazon cautioned that it had not determined whether those early attempts would have succeeded against real-world systems, while reporting that PHP2Shell was subsequently being broadly exploited.
The disclosure process also became disrupted. According to the PHP Foundation, circulating vulnerability identifiers prompted developers to advance publication by one day.
A mistakenly published demonstration video and prematurely available patched images added information before coordinated disclosure.
Wiz says AI-assisted research helped turn complex memory bugs into working demonstrations across multiple applications, reducing the effort required to adapt attacks to different deployments.
Patches Are Available, but Application Updates Are Insufficient
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should obtain updates through PHP or their operating-system vendor and restart the relevant services and workers.
Updating WordPress alone will not repair the underlying runtime. WordPress explicitly says no WordPress update is required or planned for these issues and urges users to coordinate with hosting providers.
Older installations require particular care. PHP 8.1 and earlier are outside upstream security support, although distribution vendors may supply fixes. Exceptional minimal source backports are also available for PHP 7.4, 8.0 and 8.1.
European cybersecurity authorities recommend prioritizing internet-facing systems and considering isolation where immediate remediation is impossible. Their warning also covers products that embed PHP behind the scenes.
Firewall protections can reduce exposure, but researchers stress that updating PHP is the only complete remediation. The outstanding question is how quickly operators can deploy it across their affected systems.
Top Trending Crypto Articles
