---
title: "PHP2Shell probes preceded disclosure; four PHP branches now have fixes"
description: "Two 9.2-rated runtime flaws can turn unauthenticated requests into code execution, before application checks run"
author: "Luis Goa"
published: 2026-10-22T15:25:02Z
modified: 2026-10-23T03:42:16Z
url: https://rews.cc/a/php2shell-probes-preceded-disclosure-four-php-branches-now-h-a23b18
language: en
tags: ["php", "security", "ai", "openai", "cybersecurity", "tech"]
publisher: "Rews (https://rews.cc)"
---

# PHP2Shell probes preceded disclosure; four PHP branches now have fixes

*Two 9.2-rated runtime flaws can turn unauthenticated requests into code execution, before application checks run*

By Luis Goa · October 22, 2026 · https://rews.cc/a/php2shell-probes-preceded-disclosure-four-php-branches-now-h-a23b18

## In brief

- The Financial Times reported hostile probes four days before defenders were told about PHP2Shell
- Two vulnerabilities rated CVSS 9.2 can enable unauthenticated remote code execution
- Researchers demonstrated attacks against major PHP applications; probing does not establish confirmed compromise
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; maintainers say updating is the only complete remedy

Four days separated the first reported hostile probes of PHP2Shell from defenders being told about the vulnerabilities, according to [Financial Times reporting republished by Ars Technica](https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/). Probing is evidence of attempted discovery or exploitation, not proof that a server was compromised. The distinction matters for two runtime flaws that can let an unauthenticated request execute code before a website’s application code runs.

PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under the Common Vulnerability Scoring System’s version 4.0. The [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) identifies all PHP installations serving web requests as potentially exposed, with the highest stated risk for Apache’s mod\_php integration. Its instruction is unusually direct: “There are no complete mitigations, updating is the only safe choice.”

Alphabet-owned security company Wiz estimates that PHP powers about 70 percent of websites worldwide. That is a language-usage estimate, not a count of exploitable installations. Its [technical account](https://www.wiz.io/blog/php2shell-php-rce) demonstrates attacks against WordPress, Drupal and Joomla, but actual exploitability depends on the server integration, configuration and application. WordPress’s dependence on PHP helps explain the deployment footprint; it does not establish a successful attack against every WordPress site.

## The failure crosses request boundaries

PHP normally allocates memory for a web request, runs the application and releases the request’s resources. These vulnerabilities break assumptions about what remains valid when an allocation fails or a fatal error interrupts that sequence. Cleanup can encounter partially initialized data. Alternatively, a worker—the server process handling requests—can retain a pointer after the memory it references has been freed.

CVE-2026-109618 concerns out-of-memory corruption. CVE-2026-109619 concerns stale internal state surviving into later processing. A subsequent allocation can reuse freed memory for attacker-controlled contents. Code that still trusts the old pointer then interprets those contents as PHP’s own bookkeeping. Depending on the route, the result can be memory disclosure or remote code execution.

**One request poisons another** A stale-state attack path described by PHP’s maintainers

| From | To | How |
| --- | --- | --- |
| Attacker sends request | Fatal error interrupts processing |  |
| Fatal error interrupts processing | Request memory is freed |  |
| Request memory is freed | Worker retains stale reference |  |
| Worker retains stale reference | Later request uses reference *(Memory disclosure or code execution possible)* |  |

![One request poisons another. A stale-state attack path described by PHP’s maintainers](https://rews.cc/img/1ca48c63b796bf786dc68579182e15faeef62273.webp)

Based on [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5). A simplified stale-state path, not every exploit route covered by the two CVEs.

That diagram explains why fixing a website’s login checks is insufficient. PHP’s advisory describes a demonstrated mod\_php exploit that runs before application code. Authentication cannot reject a request before the runtime has safely initialized enough state to execute the authentication check.

The deployment distinction is also material. In [Calif’s technical investigation](https://calif.io/php2shell/), PHP-FPM avoids two startup-failure routes by terminating the worker, whereas an application-stage fatal error can leave a worker available for reuse. Calif reports unauthenticated code execution across 11 named applications and frameworks, including WordPress, Drupal, phpMyAdmin, Laravel and Symfony. These are reported demonstrations, not 11 documented victim organizations.

## Discovery preceded disclosure by months

The [PHP Foundation’s account](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) traces the out-of-memory concern to work following a 2024 Quarkslab audit. It credits Calif researcher Ryan Austin with reporting demonstrated remote code execution on August 11, 2026. Calif dates its identification of multiple execution paths to August 1 and says PHP confirmed its proof of concept on August 14–15.

Wiz reports a separate discovery on August 19, demonstrations against Drupal on August 20 and WordPress on August 21, and submission to PHP on August 24. It says PHP acknowledged that submission on September 21. These are different research timelines, not interchangeable dates for a single discovery.

![Two overlapping magnifying glasses with orange handles inspect a cream document with dark lines, with a large envelope behind it against a blue background.](https://rews.cc/img/d5b64f149bf7c89e1fa4d6b8b4bc4d33654f28ee.webp)

OpenAI worked with PHP, Calif and Wiz to verify the vulnerabilities and develop fixes. In its Wednesday statement, quoted by the Financial Times, the company said: “To our knowledge, frontier AI found these vulnerabilities before attackers did.” It also warned that the same capabilities could help attackers rapidly develop offensive tools and exploits. The Foundation says OpenAI independently identified the underlying defect. Neither statement establishes when hostile actors first understood it; the reported pre-disclosure probes make that an operational question rather than a benchmark result.

The Foundation says maintainers had found no working public exploit at disclosure, despite circulating proof-of-concept claims and a leaked demonstration video. That does not contradict reports of private probing. A public exploit, an observed probe and a confirmed compromise are three different kinds of evidence.

## The update is the security boundary

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier no longer receive regular upstream updates; maintainers linked exceptional minimal source backports for 7.4, 8.0 and 8.1. Operators using distribution-maintained packages need their vendor’s fix, rather than assuming a different-looking package version is necessarily vulnerable.

![A hand places a red brick into a cream brick wall as a dark, curling tentacle reaches toward it against a blue background.](https://rews.cc/img/c73ebadf53b0ff9a3706233200c7a855fadcee74.webp)

PHP lists partial exposure reductions, including disabling session upload-progress tracking and restarting every worker for stale-state paths. Its out-of-memory guidance includes request-size controls and, under specified configuration conditions, removing PHP’s memory limit. Those settings have availability consequences and do not constitute a complete repair. The [earlier emergency-patch notice](https://rews.cc/a/two-9-2-rated-php-flaws-are-due-for-emergency-patches-0a807d) has now become a deployment task.

The NSA warned that such vulnerabilities can expose a server’s filesystem or database and recommended taking systems offline if an immediate update is infeasible. Britain’s National Cyber Security Centre urged immediate action, saying attackers could potentially take control without login credentials. The White House said federal agencies were assessing impacts on government systems and critical infrastructure.

The Foundation is adding funded security engineering, auditing, sanitizer testing and AI-assisted report validation, with earlier escalation when fixes stall. The next useful measurements are how much of the installed PHP fleet has received the fixes, and how many of the reported probes can be tied to confirmed code execution.

## Sources

[Financial Times, via Ars Technica](https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/); [PHP advisory](https://www.php.net/archive/2026.php#2026-10-21-5); [Wiz research](https://www.wiz.io/blog/php2shell-php-rce); [Calif research](https://calif.io/php2shell/); [PHP Foundation account](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)