PHP2Shell is a media label for two critical memory-corruption vulnerabilities in the PHP engine disclosed in October 2026. They allow unauthenticated remote code execution on vulnerable servers through crafted HTTP requests that exploit flawed cleanup after fatal errors.

Which PHP versions are affected by PHP2Shell?

Affected versions go back more than a decade according to the disclosure reporting, so any long-lived branch deserves checking. Compare your installed interpreter against the fixed releases listed in the PHP project's security announcements rather than assuming a modern-sounding version is safe.

Were millions of servers actually compromised by PHP2Shell?

No such figure has been established. The widely repeated millions refer to exploitation attempts, which include scans and probes, and confirmed successful compromises remained far lower and unclear in the days after disclosure.

Does patching WordPress or Drupal fix PHP2Shell?

No. The flaws sit in the PHP runtime, not in the application framework, so an application update alone leaves the vulnerable engine in place. Update the PHP packages on the host or in the container image as well.

Did AI help create PHP2Shell exploits?

Researchers reportedly credited AI tools with a significant role in turning these memory-corruption bugs into working exploits. That claim is attributed to the researchers and has not been independently quantified.

PHP2Shell RCE: what PHP admins must patch now

Two memory-safety bugs in the PHP engine turned a routine fatal error into a path to unauthenticated remote code execution, and PHP2Shell patches shipped on 21 October 2026. Millions of exploitation attempts followed within hours, but confirmed compromises stayed far below that volume.

What is the PHP2Shell vulnerability in the PHP engine?

PHP2Shell is the name given to two critical memory-corruption vulnerabilities in the PHP runtime that can let an unauthenticated attacker execute code on a vulnerable server. Both sit in the engine's request and error handling: one leaves partially initialised internal state that PHP later trusts, and the other is a use-after-free in which PHP keeps a reference to memory it has already released.

The location matters more than the label. PHP, the server-side scripting language that generates pages for a large share of the web, normally allocates memory per HTTP request and frees it when the request ends. The flaws appear when certain fatal errors, out-of-memory conditions in particular, interrupt that cleanup, so crafted requests can reach a state the engine was never designed to expose.

Treat the PHP2Shell name as a media label rather than a CVE identifier. The authoritative record is the set of PHP release announcements and security advisories published by the PHP project.

The practical consequence is that the vulnerable component is the interpreter that runs every script on the host. A framework patch or a Web Application Firewall rule does not change the engine's memory behaviour, so only a runtime update closes the underlying defect.

PHP2Shell: two vulnerabilities, one memory model

Both PHP2Shell vulnerabilities come from the same weakness in how the engine unwinds a request after a fatal error, which is why a single patch set addresses them together. The first leaves partially initialised data in internal structures; when PHP later reads that memory as if it were valid, an attacker can steer the outcome. The second releases memory while references remain, so the engine can read or execute data that has been freed and possibly reused.

Memory-safety defects of this shape are exploitable through ordinary HTTP requests, which is what raises severity. An attacker does not need a login, a plugin, or a misconfigured upload directory, only a deployment whose engine version is still vulnerable and request paths that trigger the faulty error handling.

Not every PHP host is equally exposed. The researchers behind the disclosure demonstrated code execution against WordPress and Drupal installations without authentication, and reported that even a minimal hello-world application could be vulnerable under particular deployment conditions. Applications with unusual request handling or exposed debug paths deserve the earliest check.

FAQ

What is PHP2Shell? PHP2Shell is a media label for two critical memory-corruption vulnerabilities in the PHP engine disclosed in October 2026. They allow unauthenticated remote code execution on vulnerable servers through crafted HTTP requests that exploit flawed cleanup after fatal errors.

Which PHP versions are affected by PHP2Shell? Affected versions go back more than a decade according to the disclosure reporting, so any long-lived branch deserves checking. Compare your installed interpreter against the fixed releases listed in the PHP project's security announcements rather than assuming a modern-sounding version is safe.

Were millions of servers actually compromised by PHP2Shell? No such figure has been established. The widely repeated millions refer to exploitation attempts, which include scans and probes, and confirmed successful compromises remained far lower and unclear in the days after disclosure.

Does patching WordPress or Drupal fix PHP2Shell? No. The flaws sit in the PHP runtime, not in the application framework, so an application update alone leaves the vulnerable engine in place. Update the PHP packages on the host or in the container image as well.

Did AI help create PHP2Shell exploits? Researchers reportedly credited AI tools with a significant role in turning these memory-corruption bugs into working exploits. That claim is attributed to the researchers and has not been independently quantified.

Why did the PHP2Shell fixes arrive a day early? Details circulated online and a security company published an exploit demonstration before the planned date, so the PHP project moved the release forward from 22 October to 21 October 2026 to shorten the window between leak and fix.

Source video