Two critical vulnerabilities in PHP's core runtime, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, allow unauthenticated attackers to execute arbitrary code and potentially extract sensitive information from server memory.

Discovered by Wiz Research, the vulnerabilities affect PHP versions dating back to 5.4, with vulnerable code present for over a decade. Given that PHP powers approximately 70% of websites, the potential impact is enormous.

Unlike application-level vulnerabilities, PHP2Shell targets the underlying PHP runtime. Even fully updated WordPress, Drupal, Joomla, and other PHP applications can remain vulnerable, regardless of the security of their application code.

TL;DR

• Two critical vulnerabilities (CVSS 9.2) enable unauthenticated remote code execution (RCE) and process-memory disclosure.
• Wiz demonstrated successful exploitation against WordPress, Drupal, and Joomla, without relying on application-level vulnerabilities.
• WAF rules and PHP configuration changes provide only partial protection. Patching is the only complete mitigation.
• Runtime visibility is critical for detecting suspicious exploitation activity and identifying post-compromise behavior.

How PHP2Shell Works

The vulnerabilities stem from memory-management flaws in PHP, particularly how the runtime handles out-of-memory (OOM) errors and maintains internal state between HTTP requests.

CVE-2026-109618: Out-of-Memory Corruption

PHP uses longjmp() to abort request processing when memory allocation fails. Under certain conditions, this interrupts initialization before internal data structures are ready, leaving PHP in an inconsistent state.

Subsequent cleanup operations may access invalid memory, leading to memory corruption and potentially arbitrary code execution.

Wiz also demonstrated an information disclosure technique that allows attackers to extract PHP worker memory, potentially exposing passwords, session tokens, and API keys.

CVE-2026-109619: Use-After-Free Across Requests

PHP workers retain certain global variables between requests. When a request terminates unexpectedly, these variables may reference memory that has already been freed.

A subsequent request handled by the same worker can access these dangling pointers, leading to memory corruption and potentially arbitrary code execution.

Wiz demonstrated several exploitation techniques involving session upload handling, fatal-error backtraces, and OPcache state corruption across the two vulnerabilities.

Most concerning, some attacks execute before application code runs, bypassing application-level validation and potentially leaving little evidence in application logs.

Why Traditional Defenses Aren't Enough

Because PHP2Shell exploits the underlying runtime, updating application code or dependencies does not resolve the vulnerability.

WAF protections can block known malicious request patterns but cannot guarantee coverage against alternative exploitation techniques. Similarly, disabling session.upload_progress.enabled, adjusting memory limits, or restricting multipart requests may reduce exposure to specific attack paths but do not eliminate the vulnerabilities.

The PHP security team explicitly states that updating to patched releases is the only complete mitigation.

The emergency security updates released on October 21, 2026, are:

‍

Older installations require migration or verified vendor-provided security backports.

Detecting PHP2Shell: Indicators of Compromise

Because exploitation occurs inside the PHP runtime, traditional application logs may provide limited visibility into the attack.

According to Wiz's research, potential indicators of exploitation include:

• Suspicious HTTP requests: Unusual multipart submissions, repeated HTTP 500 responses, and memory-exhaustion errors.
• Abnormal session cookies: Unexpectedly large or malformed PHPSESSID response cookies, potentially indicating memory disclosure.
• PHP worker instability: Unexpected crashes, restarts, or unusual worker churn.
• Suspicious runtime behavior: PHP workers spawning shells, downloading executables, establishing unexpected outbound connections, or modifying application files.

These indicators should be correlated with workload context, as individual signals do not necessarily indicate successful exploitation.

What Security Teams Should Do

Organizations should immediately identify PHP runtimes across their infrastructure, prioritize internet-facing workloads, and deploy patched versions.

Where immediate patching is impossible, restricting external access and applying temporary WAF mitigations can help reduce exposure.

Beyond patching, security teams should investigate historical activity for signs of exploitation. Patching prevents future exploitation of the fixed vulnerabilities, but it cannot undo an existing compromise.

How Sweet Security Helps

PHP2Shell highlights a critical gap in traditional vulnerability management: knowing a server is vulnerable doesn't tell you whether attackers have exploited it.

Sweet Security helps organizations address this challenge through:

• Exposure assessment: Identify affected PHP workloads across cloud and Kubernetes environments and prioritize remediation based on runtime context.
• Runtime exploit detection: Sweet's eBPF-based sensors monitor process execution, filesystem activity, and network connections to detect suspicious behavior following exploitation, including unexpected shell execution, payload downloads, unauthorized file modifications, and suspicious outbound connections.
• Threat hunting and IoCs: Sweet Investigator enables security teams to investigate historical activity and hunt for suspicious runtime behaviors. Emerging PHP2Shell-specific IoCs, including malicious IPs, domains, and file hashes, can be incorporated into custom detection rules.
• Automated response: Sweet Defend can terminate malicious processes and contain compromised workloads, helping prevent attackers from expanding their foothold.

While purely in-process memory exploitation may not generate observable operating-system events, runtime monitoring provides a critical additional detection layer when attacks bypass perimeter and application-level defenses.

Sweet Security is continuously monitoring PHP2Shell and keeping customers updated with emerging threat intelligence, detection guidance, and relevant IoCs as the event unfolds.

Final Thoughts

PHP2Shell demonstrates how vulnerabilities buried deep inside widely deployed runtimes can expose otherwise secure applications to critical threats. The use of AI in discovering and exploiting these decade-old flaws also highlights how quickly the economics of vulnerability research are changing. While patching remains the immediate priority, organizations must be prepared to detect and respond to exploitation during the window between disclosure and remediation.

Runtime visibility helps bridge that gap, enabling security teams to understand not just where they're vulnerable, but what attackers are actually doing inside their environments.