PHP2Shell Exploit & PoC Released: Critical PHP RCE (CVE-2026-109618 & CVE-2026-109619)

PHP has a serious problem this week. Two bugs in the core language, now called PHP2Shell, let an attacker run code on a vulnerable server without logging in. They’re tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2. The details leaked a day early, the patches arrived on October 21, and working proof-of-concepts started circulating almost immediately.

These are not the usual application-level issues. The flaws live inside PHP itself, so any site or service running an affected version is exposed — WordPress, Drupal, Joomla, Magento, Laravel, custom code, even a minimal script. The risk is highest on Apache with mod_php, where a single unauthenticated request can trigger the problem before any of your own code executes. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are also affected.

What the two bugs actually do

CVE-2026-109618 is tied to how PHP handles running out of memory while it’s still setting up a request. Under the right conditions the cleanup path can treat invalid data as valid and turn that into code execution. CVE-2026-109619 comes from internal state that can survive after the memory it pointed to has been freed; a later request on the same worker can then use that stale state. Both can be used for remote code execution. Researchers have also demonstrated memory disclosure paths that can pull passwords, tokens, or API keys out of the PHP process.

Because the bugs are in the engine rather than in any particular application, a clean WordPress install on an old PHP version is still vulnerable. The same applies to other common platforms.

Which versions are affected

The underlying code paths go back roughly fourteen years. PHP 8.1 and older no longer receive official releases, so those systems stay exposed unless a distribution or vendor backports the fixes or someone builds from the source patches PHP released for 7.4, 8.0, and 8.1.

How the disclosure played out

The issues were found in August 2026 by researchers at Wiz, OpenAI’s Codex Security work, and Calif. A coordinated release had been planned for October 22. On the 20th the details leaked (including on Hacker News), and PHP moved the patches forward a day. By the time the official advisories and fixed builds appeared on October 21, screenshots and videos of an exploit tool were already moving around, and multiple companies reported seeing attempts against their honeypots.

Public PoCs followed quickly. Some are limited to lab setups, others claim working chains against real targets (especially mod_php). As usual, a portion of what’s floating around is incomplete, broken, or outright fake. Still, enough functional material is out that unpatched systems are already being probed.

The current public PoCs and related notes are being collected in one place here:
https://t.me/spyhackerz

WordPress and other platforms

WordPress powers a large share of the web and almost all of it runs on PHP. If the underlying PHP version is vulnerable, the site is exposed even when every plugin and theme is up to date. The same logic applies to Drupal, Joomla, Magento, and most other PHP-based software. Shared-hosting users will need their provider to update the PHP package; people who manage their own servers need to do it themselves.

What to do now

Update PHP if you can. The fixed releases are the ones listed above. After the update, restart the PHP workers or the web server so the new binaries are actually loaded. If you rely on distribution packages or a hosting control panel, check those channels — many vendors received the patches ahead of the public release.

If you cannot patch immediately, the partial steps people are using include:

• Setting session.upload_progress.enabled = Off (and restarting workers)
• Removing the controllable memory limit (memory_limit = -1 in a way applications cannot override)
• Tightening post_max_size and related request limits
• Recycling PHP-FPM workers more aggressively (pm.max_requests)

None of these are a complete fix. They only close some of the known paths. The only reliable solution is the updated PHP version.

On the monitoring side, watch for unusual multipart requests, odd or oversized PHPSESSID values, sudden worker crashes, and memory-related errors. Early activity has been relatively noisy; that will change as better PoCs spread.

PHP2Shell is one of those rare core-runtime problems that can hit a large percentage of the web at the same time. The patches are available, the PoCs are public, and the window for unpatched systems is already open. If you run anything on PHP and have not checked the version yet, do it now.

Public exploit and PoC material: https://t.me/spyhackerz