The PHP2Shell vulnerabilities: critical flaws exploited before their fix

Two critical vulnerabilities, CVE-2026-109618 (memory corruption via OOM error handling) and CVE-2026-109619 (reuse of an obsolete global state), were urgently patched by the PHP Foundation on October 21, 2026. These flaws, discovered by Wiz, OpenAI, and Calif as early as August 2026, enable remote code execution (RCE) without authentication, with a CVSS score of 9.2 according to Palo Alto Unit 42.

The patches, integrated into PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, also include minimal backports for versions 7.4, 8.0, and 8.1. However, versions prior to PHP 8.1 will receive no fixes, as noted by Cisco Talos, since their support has ended. The flaws affect all PHP installations processing web requests, whether using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed.

The PHP Foundation expedited patch releases after a functional proof-of-concept (PoC) was accidentally disclosed before the scheduled date. WatchTowr detected exploitation attempts in the wild as early as October 21, though no successful attacks have yet been confirmed. These vulnerabilities affect 70% of global websites, regardless of their content management system (CMS), according to the PHP Foundation.

These vulnerabilities target core components of PHP that nearly every request interacts with: memory management and error handling, which are central to website security.

Flaw mechanisms: deep errors in PHP’s core

The CVE-2026-109618 exploits a flaw in memory error handling (OOM), where a control jump (longjmp()) interrupts HTTP request processing before internal data is fully initialized. The CVE-2026-109619, meanwhile, stems from a reused global state after its memory was freed, enabling arbitrary code execution, as explained by Unit 42.

These flaws are particularly dangerous because they are triggered before application code even runs, as noted by Cisco Talos. A single malicious HTTP request is enough to exploit these vulnerabilities, making them accessible even on sites using popular CMS platforms like WordPress, Drupal, Magento, or Shopware, provided they run an affected PHP version.

The PHP Foundation highlights that these vulnerabilities reside in critical components of PHP: memory management and error handling, parts traversed by almost all requests. Once exploited, they not only allow remote code execution but also enable reading the memory of sensitive server processes.

Reactions from security editors: immediate protections and mitigation

Several major cybersecurity players have reacted quickly to protect their clients. Cloudflare deployed WAF (Web Application Firewall) rules on October 21 to block attacks exploiting these vulnerabilities, using comprehensive HTTP transaction analysis to minimize false positives. These protections are enabled by default for all users, including free plans, with a specific rule identifier (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba).

Meanwhile, Palo Alto Networks identified over 22.6 million exposed PHP instances via its Cortex Xpanse tool. The company offers updates for its Cortex XDR, Cortex Cloud, and XSIAM products, as well as protection through Frontier Virtual Patching (Threat ID 543004) since October 20. Cisco Talos also released SNORT signatures (67359 and 67360) to detect attacks, available in the Community Ruleset.

Despite these protections, editors emphasize the need to urgently update PHP. Cloudflare recommends combining patches with WAF rules for a layered defense. Talos specifies that PHP versions 8.1 and earlier, already end-of-life, will receive no fixes, and strongly advises migrating to PHP 8.2 or a later version.

What this changes here: risks for businesses and administrations in West Africa

The PHP2Shell vulnerabilities pose a major risk to businesses and administrations in West Africa, where PHP is widely used to host websites, e-commerce platforms, and internal systems. Over 70% of Beninese or regional websites could be affected, particularly those based on CMS like WordPress, Drupal, or frameworks like Laravel, if their infrastructure runs on an unpatched PHP version.

The consequences of a successful exploitation would be severe:

• total takeover of web servers, allowing attackers to deploy malware or ransomware;
• the exfiltration of sensitive data (customer databases, financial information, personal data);
• the fraudulent use of the reputation of infected sites for phishing campaigns or the spread of malicious content, as highlighted by Shahak Shalev of Malwarebytes.

For administrations, the risks include compromised availability of online services (government portals, public payment platforms) and loss of citizen trust. Businesses, on the other hand, could face operational disruptions, intellectual property leaks, or regulatory sanctions in case of non-compliance with data security obligations.

Immediate measures are required:

• check the PHP version in use and apply official patches (8.5.12, 8.4.27, etc.);
• for unsupported versions (PHP 8.1 and earlier), consider migrating to a maintained version;
• enable additional protections such as WAF rules (Cloudflare, Palo Alto) or SNORT signatures;
• temporarily limit risks by adjusting PHP settings (memory_limit, post_max_size, disabling session.upload_progress.enabled) as suggested by Cisco Talos.

Organizations should also monitor security vendor alerts and consider external audits to identify any residual exposures, especially if they rely on custom configurations or third-party modules.