PHP2Shell: Critical PHP Vulnerabilities Require Immediate Action

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution (RCE) and sensitive memory disclosure. Security teams should immediately identify exposed PHP deployments, apply the available security updates, and investigate potential exploitation.

The vulnerabilities, collectively known as PHP2Shell, affect the PHP runtime itself—not just a specific application or plugin. Successful exploitation could enable attackers to execute commands, access sensitive data, or compromise web servers. WordPress, Drupal, and Joomla deployments are among the demonstrated targets. Read the technical analysis by Wiz Research.

What Makes These Vulnerabilities Significant?

The flaws involve memory-safety issues in PHP’s handling of fatal errors and memory allocation failures. Research demonstrated how these conditions could be chained into remote code execution.

The disclosure also highlights how AI-assisted research can reduce the effort required to exploit complex software flaws, changing how organizations should assess practical risk.

How to Check and Reduce Your Exposure

Security teams should take the following steps:

1. Inventory PHP deployments. Check production servers, containers, PHP-FPM, Apache, managed hosting, and third-party appliances. Identify the PHP versions actually running.
2. Apply security updates immediately. Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For older or vendor-maintained versions, confirm patch availability with the relevant provider.
3. Investigate suspicious activity. Review web server, endpoint, and application logs for unusual multipart requests, memory errors, unexpected PHP worker behavior, shell processes, unfamiliar files, and unexplained outbound connections.
4. Contain suspected compromise. Isolate affected systems where necessary, preserve logs and forensic evidence, and investigate possible credential or secret exposure. Rotate potentially compromised credentials after containment.
5. Validate remediation. Confirm the patched runtime is deployed across all instances and pipelines. WAF rules can provide additional protection but must not replace patching.

Securify AI Recommendation

Treat PHP2Shell as a priority vulnerability-management issue. Patching, exposure validation, and investigation should proceed together, especially for internet-facing systems.

For additional guidance, consult the Canadian Centre for Cyber Security advisory.

Securify AI helps organizations move beyond compliance checklists to practical security validation, risk reduction, and measurable remediation.