What Is PHP2Shell? The PHP Vulnerability Explained
PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. This page explains in plain English what PHP2Shell is, who found it, and why so many websites went offline the day it became public.
PHP2Shell in one paragraph
PHP2Shell is a family of memory-safety bugs in core PHP, rated CVSS 9.2. Under certain error conditions PHP did not clean up its internal state properly, and that mistake could be abused remotely. An attacker who needs no login could run code on the server or read memory that may contain passwords, session tokens, API keys and certificates. Because the bug lives in PHP rather than in any one application, a site can be affected even when its own code is perfectly written. The fix is a PHP update: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a vendor package that includes the patch.
How PHP2Shell works, in plain English
Every request to a PHP site borrows memory and gives it back when it finishes. PHP2Shell is about what happens when a request ends badly. The two CVEs describe two versions of the same weakness:
- CVE-2026-109618: after certain failures, PHP could treat leftover, half-finished data as if it were valid.
- CVE-2026-109619: after certain failures, PHP could keep pointing at memory it had already given back, and a later request could end up using it.
Both are classic memory-safety problems, the same family of bugs behind many famous vulnerabilities in C programs. PHP itself is written in C. The PHP team says its fix addresses the underlying failure patterns, not only the specific attacks the researchers showed. More detail per CVE is on the CVE page.
Why it is called PHP2Shell
"php2shell" was the name of the researchers' demonstration script, which turned access to a PHP website into a shell on the server. The name stuck for the whole body of research, and the official disclosure site uses it.
Who found PHP2Shell, and the role of AI
Three teams are credited: Wiz Research, OpenAI Codex Security and Calif, working with the PHP security team and Google's Gemini team. Calif says its researcher found the first bug on August 1, 2026, starting from older PHP memory-limit bugs and working with an AI audit assistant. Wiz says it found bugs independently from August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The PHP Foundation says a core developer had already seen early signs of one of the problems in 2024, but the competing fixes stalled. It has since changed how its security team makes decisions.
PHP2Shell timeline
| Date (UTC) | Event |
|---|---|
| Aug 11, 2026 | Calif and OpenAI report to the PHP security team |
| Aug 24 | Wiz reports its findings |
| Sep 18 | OpenAI reports further issues |
| Oct 20, afternoon | The CVE numbers leak on forums and social media, with an incorrect CVSS of 10.0 |
| Oct 20, evening | PHP publishes its pre-announcement early; more details leak |
| Oct 21, ~14:00 | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day earlier than planned |
Based on the PHP Foundation and Calif. CERT-EU gives the release time as 13:30 UTC.
Why so many websites went offline
Because details leaked before the patches were out, the UK NCSC told operators to consider taking systems offline if they could not protect them, and many organisations did exactly that while they updated. Government portals in the Netherlands and Finland, Wikimedia's tool servers, Nintendo services and several Japanese games paused service. Almost all of these were precautions, not hacks. See the PHP2Shell outages list.
What to do about PHP2Shell
- Check your PHP version with the PHP2Shell checker.
- Update PHP with the patch guide, or install your distribution's fixed package from the Ubuntu, Debian and RHEL page.
- If you cannot update today, apply the temporary mitigations.
- If the server was exposed, run through the "was I hacked?" checklist.
What is PHP2Shell: FAQ
What is PHP2Shell in simple terms?
PHP2Shell is a pair of serious bugs inside PHP itself, the language behind roughly 70% of websites. On a server that has not been updated, an attacker without an account could take control of the server or read sensitive data from its memory.
Why is it called PHP2Shell?
The researchers named their demonstration script php2shell, because it turned access to a PHP website into a command shell on the server. The name now covers the whole research.
Was PHP2Shell found with AI?
AI models were part of the research. Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, Calif says its researcher worked with an AI audit assistant, and OpenAI Codex Security also reported issues.
Is PHP2Shell the same as a WordPress bug?
No. WordPress, Drupal and Joomla were demonstration targets, but the flaw is in PHP, so any PHP application on an unpatched version is exposed.
Is my site safe if it was not taken offline?
Not necessarily. Staying online says nothing about the PHP version. Check it with the PHP2Shell checker and update if needed.