Critical PHP2Shell Vulnerabilities Allow Remote Code Execution

Worn piano keys with a soft, out-of-focus background — Lolita Ruckert / Unsplash

A set of critical vulnerabilities known as PHP2Shell has been disclosed affecting the PHP programming language. These flaws may allow unauthenticated third parties to execute programs on servers under specific conditions.

PHP2Shell consists of two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Because these issues exist within the core PHP software rather than specific plugins or websites, the potential impact is extensive. The PHP development team assigned a CVSS v4.0 score of 9.2, categorizing the severity as critical.

To address these risks, the PHP development team released updated versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. The Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to apply these fixes immediately. Similarly, the Information-technology Promotion Agency (IPA) and JPCERT/CC issued warnings in Japan.

Technical analysis indicates that attacks can occur before application-level login functions are processed. For CVE-2026-109618, a path was demonstrated using Apache mod_php that reaches the system before application code begins. Remote code execution via application code paths was also confirmed in PHP-FPM. Consequently, the presence of login features does not guarantee security. Furthermore, some attack paths may leave insufficient evidence in website operation logs.

Researchers report that even if program execution is not achieved, attackers may be able to read passwords, authentication tokens, and API keys from memory held by PHP during processing. While some public demonstration codes are reported to be non-functional, experts warn that sophisticated attackers capable of adjusting techniques to their environment can still exploit the flaws. The Tanium threat hunting team confirmed code execution via HTTP requests for CVE-2026-109619 in a lab environment using PHP 8.5.11 with Apache mod_php.

CISA stated on October 23 that it had not observed successful exploitation in real environments. However, on October 26, CISA added both CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities Catalog. This indicates reliable evidence of exploitation attempts or successes, including attacks on honeypots. US federal agencies were given a deadline of October 29 to respond.

In Japan, several organizations took preventive measures by temporarily suspending services to verify safety. These included regional bank websites and applications, municipal public document search systems, and certain functions of hosting providers and web production services. These entities stated that the suspensions were preventive and not the result of actual attacks.