PHP developers have rolled out urgent security updates to address two extremely severe security vulnerabilities known as PHP2Shell, which grant attackers the ability to execute malicious code remotely (Remote Code Execution) without requiring prior authentication, amidst the recording of actual attacks attempting to exploit them on the internet.
Vulnerability Details and Risk Areas in the PHP Engine
The two vulnerabilities were registered under the numbers CVE-2026-109618, resulting from memory corruption upon exhaustion (Out-of-Memory Corruption), and CVE-2026-109619, related to an old and asynchronous general state (Stale Global State), and received a severity rating of 9.2 on the CVSS scale. The PHP Foundation confirmed that the two vulnerabilities lie in sensitive mechanisms through which almost every request passes within the engine, namely memory management and error handling, making their impact wide-ranging and their remediation extremely complex.
The foundation explained that every PHP server handling web requests is at risk, including Apache servers via mod_php, PHP-FPM environments, php-cgi, FrankenPHP, and LiteSpeed. The problem also extends to reading the private memory space of processes, which may expose API Keys, passwords, and cached sensitive data.
Early Leak and Exploitation Attempts Preceding the Patch
Coordinated disclosure of the vulnerabilities was scheduled for October 22, but an accidental leak of details and proof-of-concept (PoC) code snippets on the internet prompted the team to bring forward the release date. During the hours preceding the public update, security entities including WatchTowr, Patchstack, Cloudflare, and Hadrian detected widespread exploitation attempts targeting primarily the session upload-progress tracking path in PHP.
The updates accompanied by solutions included versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, in addition to limited backported patches from the source code of older versions such as PHP 7.4, 8.0, and 8.1, as the root of the flaw historically extends back to versions dating back to PHP 5.4.
The Role of Artificial Intelligence Models in Discovery
Cloud security company Wiz, in collaboration with OpenAI and Calif Labs, discovered the vulnerabilities in August. Although the initial memory exhaustion-related flaw was first detected in 2020 and rediscovered in 2024, it was not classified as an imminent threat because its exploitability was not proven at the time. However, utilizing advanced artificial intelligence models enabled researchers to assemble highly complex exploitation chains that transformed the memory weakness into remote command execution.
Why This Development Matters and Its Impact
PHP powers approximately 70% of websites worldwide and is relied upon by popular content management platforms such as WordPress, Drupal, and MediaWiki (which powers Wikipedia). The presence of a flaw in the language's core engine means that millions of websites have become vulnerable to hacking even if the software applications installed on top of them are fully secured and bug-free, forcing system administrators and operations teams to apply updates immediately and check server logs to ensure they have not been subjected to preemptive intrusion.