PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Code Execution
PHP2Shell sounds like a movie exploit, but the problem is dull and serious: two flaws in PHP itself, rated CVSS 9.2, that let a stranger run code on your server before your application even wakes up.
What PHP2Shell Is and Why It Is Not a Plugin Bug
On October 21, 2026, at 14:00 UTC, the PHP project shipped an out-of-band security release fixing two interpreter vulnerabilities collectively known as PHP2Shell. There is no third-party module or theme involved: the code that fails is the same code that runs any file ending in .php.
Two CVEs, One Story: CVE-2026-109618 and CVE-2026-109619
The first enables remote code execution. The second leaks process memory and supports the first. They share an origin: how requests with a multipart/form-data body are handled inside the session extension.
CVSS 9.2 and Unauthenticated Remote Code Execution
Both score 9.2 under CVSS v4.0. In plain terms: the attacker needs no account, no valid session and no login form. Crafted HTTP requests to a server that speaks PHP are enough.
Read also
The Flaw Lives in the Interpreter: WordPress, Laravel and Your Own Script Alike
That is what changes the math. WordPress, Drupal, Laravel and the forty-line script someone left in a subdirectory share the same attack surface: if the PHP running them is unpatched, they are all exposed. If you have never looked below the framework, what PHP is and why it matters puts the piece in place.
How It Works, Without Reading C Code
You do not need to parse the patch to grasp the risk. The mechanism fits in three steps and one analogy.
The Upload Progress Bar Almost Nobody Uses and That Ships Enabled
PHP includes an optional feature called session upload progress: it exists so a site can show a bar while a large file uploads, with the interpreter reading the request body as it arrives. It is enabled by default and runs even when your application never uses sessions.
The Use-After-Free: Freed Memory That Keeps Being Used
While reading that body, PHP keeps references to the session and uses them until the upload finishes. If the upload is cut off at the right moment, the session is reinitialized and that memory is freed, but the references still point at it: that is a use-after-free, writing into memory you no longer own. With that control, execution is redirected. The analogy: the key was left in a room the front desk has just reassigned.
Why Your Application Authentication Does Not Stop the Attack
The flaw triggers while PHP is still reading the request body, before the framework decides which route to serve. An auth middleware or a login screen never runs. The researchers who reproduced both flaws are blunt: application-level authentication cannot block this attack.
Affected Versions and the Versions That Fix It
The PHP project only ships security patches for supported branches. This is what has been available since October 21:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
What Happens With PHP 8.1 and Older
There is no official patch and there will not be one. Sansec, which published the reference analysis, argues the affected range reaches back to PHP 5.4. On top of that, security support for the 8.2 branch ends in late 2026: updating now is also the last comfortable window to move branches.
How to Check Your Real Version, the One Serving Requests
This is where people get it wrong: the version command in the shell can report a different number from the one the process serving visitors uses. What counts is the real SAPI: the PHP-FPM pool, the Apache module or the container that is listening. A temporary info file, your hosting panel header or the command run inside the container are reliable ways to see it.
The Race Against the Clock: Leak on the 20th, Patch on the 21st
The Details Circulated Before the Official Notice
Identifiers and technical details leaked on October 20 and spread through forums and social feeds before any public fix existed. The patch landed the following afternoon: the window between hearing about it and updating was hours.
In-the-Wild Exploitation: What Was Seen and Since When
According to AWS, exploitation attempts were observed from October 17, days before a fixed version existed. Other vendors report active exploitation. There is no reliable count of compromised servers, and any number quoted deserves suspicion.
What Vendors Did: Distribution Patches and WAF Rules
Linux distributions published fixed packages the same day and WAF providers deployed rules for the known vectors, including Cloudflare's free plan. Configurations to block multipart POST requests to PHP also circulated. All of it buys time; none of it replaces the patch, as the people publishing those rules pointed out.
What to Do Now, in Order
- Patch and restart the processes serving PHP. Install the fixed build for your branch and restart PHP-FPM or the web server: copying files without a restart leaves old workers answering with the previous binary.
- If you cannot patch today: turn off upload progress and cap the body. Disable the option in the real SAPI configuration file, or in the pool, then restart; setting it at runtime from the application does not help. Add a low request size limit if your site receives no files: 8 MB is sensible, 32 MB if it accepts uploads.
- Filter at the edge. Updated WAF rules and, if your application needs no uploads, blocking multipart POST requests to PHP. A bridge, not a destination.
- Check afterwards. File integrity, new files in upload directories, logins and processes you do not recognize. A flaw this severe warrants looking backwards even if you are already patched.
What This Means for the PHP and Laravel Ecosystem
Your PHP Version Stopped Being a Hosting Detail
For years it was a line in a panel nobody read. With two 9.2 flaws in the core and exploitation that predates the patch, that line becomes attack surface: if you run servers, pinning and updating that version is your job.
The Managed Hosting and Stale Container Image Problem
The two blind spots are shared hosting that takes weeks to move its PHP and container images nobody rebuilds. In the second case, smaller Docker images for PHP in production get updated with a rebuild: if the pipeline does not rebuild, the image keeps the old interpreter. On Forge the version is set per server and per site, so change it site by site and verify afterwards. For the review that follows, the guide to hardening Linux systems covers the basics of integrity and access checks.
Conclusion
Updating the interpreter is the only complete mitigation; everything else only buys days. If you run PHP anywhere, check today which version is serving requests and confirm the process was restarted after the change. The blog has more security and web development analysis, with technical context and no alarmism.
