PHP2Shell Explained: Critical PHP RCE Vulnerabilities, Impact & Mitigation

Understanding PHP2Shell

PHP2Shell is the name used by Wiz for its research and exploit chain demonstrating the impact of the disclosed PHP vulnerabilities.

The research describes several memory-safety problems associated with fatal errors, especially out-of-memory (OOM) conditions. Under certain circumstances, PHP can terminate request processing without correctly clearing internal state. That state may retain pointers to memory that has already been released.

This creates a dangerous lifecycle:

PHP begins processing an incoming request.

Internal state is only partially initialized.

A fatal error interrupts normal execution and cleanup.

Request-owned memory is released, but a global or shared reference remains stale.

A later execution path encounters the stale reference.

Depending on the affected code path, this may cause memory disclosure, memory corruption, or a route toward remote code execution.

The critical issue is not simply that PHP runs out of memory. Robust software must handle allocation failures safely. The problem is what happens after the failure, when internal state no longer accurately describes the memory that remains valid.

Wiz reports severity reaching CVSS 9.2 and demonstrated unauthenticated RCE against selected CMS deployments.

2. CVE Breakdown: What Happens Internally?

The research describes four exploitable bug patterns grouped under two CVE identifiers.

Vulnerability

Technical mechanism

Demonstrated impact

CVE-2026-109618

Upload-progress unserializer use-after-free

Pre-authentication RCE on WordPress, Drupal, and Joomla

CVE-2026-109618

Stale session-related state during cleanup

Unauthenticated disclosure of PHP worker memory

CVE-2026-109619

Fatal-error backtrace use-after-free

Pre-authentication RCE on Drupal

CVE-2026-109619

OPcache type confusion

Pre-authentication RCE on WordPress

These are the demonstrated outcomes reported by Wiz; the applications are examples of impact, not the only potentially affected software.

CVE-2026-109618: Upload-progress handling and use-after-free

PHP supports upload-progress tracking for multipart file-upload requests. During request startup, PHP can process upload-related data before normal application execution and module initialization have fully completed.

The upload-progress implementation maintains internal bookkeeping, including unserialization-related state. If a fatal allocation failure interrupts processing at an unfortunate point, normal cleanup may not complete as expected.

A use-after-free occurs when software continues to access memory after that memory has been released. In this case, the risk comes from the interaction between request-scoped allocations, persistent internal state, and subsequent request processing.

The practical significance is that an attacker may influence how a vulnerable worker reaches the faulty code path. If the worker later treats reused memory as valid internal data, the result can extend beyond a simple request failure.

Related impact: Cross-request memory disclosure

Wiz also describes a memory-disclosure path involving PHP session upload-progress handling.

During early multipart processing, PHP can publish session-related state before the request finishes initializing. If an OOM error interrupts the sequence, cleanup may leave a pointer referring to memory that is no longer valid.

A subsequent request handled by the same worker can reach cleanup logic before normal initialization resets the stale state. PHP may then interpret reclaimed memory as a valid string and encode its contents into a PHPSESSID response cookie.

The security implications are serious: process memory can contain information that belongs to other requests, such as portions of application data or other sensitive values.

Importantly, the reported scenario does not necessarily depend on the application explicitly calling session_start(). The vulnerable behavior exists in PHP's request-processing path.

CVE-2026-109619: Fatal-error backtrace use-after-free

PHP maintains executor state that can include a backtrace associated with a previous fatal error. According to Wiz's research, an OOM condition can destroy request-owned memory while leaving a global reference to the old backtrace.

If the same worker encounters a diagnostic path before that state is properly reinitialized, PHP can access the dangling pointer. If the memory has been reused, the contents may no longer represent the original backtrace.

This creates a use-after-free condition that can be developed into controlled memory corruption under the demonstrated circumstances.

The lesson is broader than PHP: error-handling code is part of the attack surface. Fatal errors, cleanup paths, and diagnostic routines must preserve the same memory-safety guarantees as normal execution.

OPcache type confusion

OPcache stores compiled PHP structures in shared memory to improve performance. It also uses process-local runtime pointer mappings and shared bookkeeping to coordinate allocations.

Wiz describes a failure scenario in which the process-local mapping frontier advances before the corresponding shared frontier is published. If an allocation failure interrupts persistence between those operations, partially persisted objects and allocation metadata can become inconsistent.

Another worker may subsequently reuse a slot that the shared state considers available. Stale metadata can then resolve to an object of an unexpected type.

This is known as type confusion: code interprets a memory object according to an incorrect type or structure. When shared runtime metadata is corrupted, the consequences may extend across workers instead of remaining isolated to one request.

Wiz reported using this primitive in an unauthenticated RCE demonstration against WordPress.

3. Step-by-Step Technical Demonstration

The following walkthrough explains the vulnerability lifecycle and demonstrates the defensive verification workflow. It is not a live exploit or a reproduction of the memory-corruption chain.

Step 1: Identify the PHP execution environment

Start by identifying which PHP runtime actually handles production traffic.

On a Linux host, use:

php -v php --ini

For a PHP-FPM deployment, inspect the running service and its package version using commands appropriate to the distribution:

systemctl status php-fpm

On systems with versioned service names, use the relevant service—for example, php8.4-fpm.

For a containerized deployment, check the runtime inside the application container:

docker exec <container_name> php -v

Important: the command-line PHP installation may differ from the PHP-FPM or Apache module handling web requests. Verify the actual web-serving runtime, its package version, and its deployment method.

Step 2: Understand the vulnerable request lifecycle

At a conceptual level, the reported memory-safety failure can be represented as follows:

Incoming multipart request | v PHP request startup and upload-progress handling | v Internal state is partially initialized | v Fatal allocation failure interrupts processing | v Request-owned memory is released | v A stale reference may survive cleanup | v Later execution path encounters stale state | +----> Memory disclosure | +----> Memory corruption | v Potential remote code execution

This illustrates the root-cause pattern described by Wiz. It does not mean every OOM error is exploitable, nor that every request follows the same path. Exploitability depends on the specific code path, runtime configuration, worker behavior, and memory state.

Step 3: Check against the official security releases

HP published patched releases on October 21, 2026. The official release archive identifies these versions:

PHP branch

Security-fixed release

PHP 8.2 → 8.2.35

PHP 8.3 → 8.3.36

PHP 8.4 → 8.4.27

PHP 8.5 → 8.5.12

Check the official PHP security announcement before making changes, especially if the deployment uses a vendor-maintained package or a container image with backported patches.

The version table is a starting point, not a substitute for checking the exact package and its vendor advisory. Versions outside the listed supported branches need an appropriate supported upgrade path.

Step 4: Upgrade and verify

After reviewing application compatibility and your change-management process, upgrade PHP through the operating system vendor, managed hosting provider, or official container source.

For Debian/Ubuntu, an administrator might first inspect installed PHP packages with:

dpkg -l 'php*'

For RPM-based systems:

rpm -qa 'php*'

Apply the approved security updates and restart or reload the appropriate PHP-serving services according to the deployment architecture. For containerized applications, rebuild and redeploy using an updated base image rather than assuming that upgrading the host also updates PHP inside the container.

Then verify the actual web runtime, not only the CLI version. Test application health, upload functionality, session handling, and error handling, and confirm that the expected fixed package is deployed across all replicas.

Step 5: Review logs and telemetry

Investigate the following signals around the disclosure and patching window:

• Repeated HTTP 500 errors or worker restarts associated with unusual multipart requests.
• PHP memory-limit or allocation failures followed by additional unexpected errors.
• Abnormally large, malformed, or unexplained PHPSESSID response cookies.
• Unexpected child processes launched by web-server or PHP worker accounts.
• Unexplained file changes, outbound connections, credential use, or unusual access to secrets.

No single signal proves exploitation. Conversely, an absence of obvious log entries does not establish that the system was safe. Correlate web-server access logs, PHP-FPM logs, operating-system telemetry, EDR events, and application audit logs.

Do not intentionally trigger the vulnerable memory-management paths against a production system to test these indicators.

4. Practical Defensive Checklist

For a real environment, prioritize the following actions:

Inventory: Identify every PHP-serving workload, including virtual machines, containers, managed hosting, development systems, and forgotten staging environments.

Prioritize: Treat internet-facing PHP applications as urgent, especially where the web-serving runtime is vulnerable and publicly reachable.

Patch: Deploy the relevant official security update or vendor-confirmed fix. PHP's advisory states that updating is the only safe remediation; configuration changes and hiding diagnostics are not substitutes.

Harden: Run PHP workers with least privilege, restrict unnecessary outbound network access, protect application secrets, and separate web workloads from sensitive systems. These measures reduce potential impact but do not fix the underlying vulnerability.

Investigate: Look for indicators of post-exploitation, including new processes, changed files, unusual network activity, and possible credential exposure.

Recover where necessary: If there is credible evidence of compromise, preserve logs and forensic artifacts, rotate potentially exposed credentials, and rebuild affected systems from trusted images following incident-response procedures.

5. Why AI-Assisted Research Matters

Wiz reports using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during the research, with Gemini 4 Argon making a particularly significant contribution.

The important takeaway is not that AI automatically finds every vulnerability. Rather, AI-assisted analysis can help researchers reason across complex code paths, explore memory-safety hypotheses, adapt technical analyses to different environments, and validate potential findings more efficiently.

The same development changes the economics of vulnerability research. Bugs that were difficult to understand or exploit can become more practical to investigate. Defenders can use similar analytical capabilities for code review, patch validation, attack-surface assessment, and detection engineering.

However, AI-generated hypotheses still require human review, controlled testing, and evidence. A plausible explanation is not the same as a confirmed vulnerability.

Conclusion

PHP2Shell demonstrates how seemingly exceptional runtime conditions—especially failures during memory allocation and cleanup—can become security-critical when stale state survives across execution boundaries.

The reported issues affect PHP's underlying runtime, meaning application-level security controls alone may not protect a deployment. A well-written WordPress, Drupal, Joomla, or custom PHP application can still depend on a vulnerable interpreter.

For defenders, the priorities are straightforward: identify the actual PHP runtime, deploy the appropriate fixed release, investigate suspicious activity, and verify the result across every workload.

The deeper lesson is that memory safety includes more than preventing invalid access during normal execution. Software must also maintain consistent state when allocations fail, requests terminate unexpectedly, and resources are reclaimed.

As AI expands the ability to discover and analyze these weaknesses, timely patching and disciplined security engineering become even more important.

References

Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

PHP — Official 2026 release archive and security announcement

PHP Security Advisory — CVE-2026-109618

PHP Security Advisory — CVE-2026-109619

Strengthen Your Security with Comply Strike

At Comply Strike, we help organizations identify security weaknesses and improve their resilience through practical cybersecurity services.

Our capabilities include penetration testing, red team operations, application security assessments, compliance programs, managed security, and incident response.

Whether you're securing web applications, validating remediation, or assessing your attack surface, our focus is on identifying meaningful risks and helping organizations address them.

Explore our cybersecurity services: www.complystrike.com