PHP2Shell refers to two memory-safety vulnerabilities in PHP, the server-side scripting language, disclosed and patched in October 2026. One flaw needs a single crafted request to exhaust the default 128 MB memory limit and can end in remote code execution. The other needs two requests and can also leak secrets from server memory.
What is PHP2Shell and which PHP versions are affected?
PHP2Shell is the name given to two memory-safety vulnerabilities in PHP, the server-side language that builds pages on a large share of the web, disclosed and patched in October 2026. Both flaws stem from how PHP handles a request that exceeds its memory limit. One bug needs a single request to reach remote code execution; the second needs two requests and can also leak secrets from server memory.
The transcript dates the public disclosure and the fix to 21 October 2026, a day ahead of the scheduled release. Patch status depends on which PHP branch your host runs, so the version number in your dashboard is the fact that matters, not the CMS you publish with. The PHP project publishes its security releases on php.net, and the release notes for the patched builds are the source to reconcile against your host's installed version.
Two caveats belong in the first paragraph. The claim that this affects roughly 70% of websites rests on the transcript's framing of PHP's share of sites with a server-side language; treat it as context, not a measurement of exploitable hosts. And a crash reported in 2024 did not become a vulnerability until someone proved full exploitation, so version checking matters more than alarm.
The publicly named reporter of the early leak was an anonymous Hacker News post that cited no verifiable source. The transcript is blunt about how that landed: the post's justification was effectively "trust me, bro", and it turned out to be right because the CVE identifiers were genuine.
How the attack works: workers, the memory limit and longjmp
PHP serves requests through a worker that takes a request, builds the page, and moves to the next visitor without restarting from scratch, because starting fresh each time would be slow. Each request gets its own block of memory, and the default limit for that block is 128 MB so one bad request cannot consume the whole server.
When a request crosses that limit, PHP stops mid-task and jumps out of the request using C's longjmp. Under normal traffic the abandoned request is discarded and nothing is harmed. The exposure begins when the jump interrupts a multi-step job: state is left half written, and later PHP code reads that state as if the job had completed.
The transcript describes the AI-assisted discovery as deliberately forcing PHP out of memory and then shaping what remained. Three teams are named as having built working proofs of concept: Califf, OpenAI and Whiz. Whiz, the security vendor credited with naming PHP2Shell, said its team did in a week what would normally take a world-class team more than ten months, a first-party claim rather than an independent measurement.
Bug one: a single request over the 128 MB limit
The first bug starts when an attacker makes a request exceed the memory limit on purpose, and a request that is small to send can be enormous for PHP to unpack. The transcript's example is a multipart upload stuffed with empty file fields: each field costs a few bytes on the wire, but PHP builds a small record for every one, so an upload under 8 MB can fill the full 128 MB.
The limit is reached at the worst possible moment. PHP is appending records to a list and has already incremented the count to say one more slot exists, but has not filled that slot yet. The longjmp fires, the slot keeps whatever junk was there, and cleanup iterates over every slot the count promises, including the junk.
That is the flaw: the cleanup pass trusts a counter that no longer matches the data. With the right heap shaping, the transcript says the attacker's code ends up running, which is remote code execution. In the mod_php setup, where PHP runs inside a web server such as Apache, that cleanup runs before site code even starts, so a page that only prints "Hello World" is still exposed.
Bug two: use-after-free and the early upload progress read
The second bug requires two requests that land on the same worker, and it relies on notes a worker keeps between requests, such as the session ID and pointers into the current request's memory. If a request crashes mid-flight, the longjmp skips resetting those notes. The memory is freed, but the note still points at it.
That dangling pointer is a use-after-free. The attacker's first request crashes deliberately and leaves the note behind. The second request lands on the same worker, fills the freed memory with attacker-controlled data, and PHP reads the stale note before resetting anything. One feature that reads it that early is upload progress, which the transcript says is on by default.
Whiz also showed the flaw leaking memory. PHP trusts the old session ID and sends whatever sits in that memory back in a cookie, which can include passwords and API keys from other visitors' requests. Combined with the first bug, the leak tells an attacker where things sit in memory so the broken cleanup can act on them.
Why the patch slipped: coordinated disclosure and a leak
PHP's plan was to release the fix quietly on 22 October 2026, with large companies briefed slightly early so attackers would not get a head start. The plan did not survive an anonymous Hacker News post claiming two CVE identifiers and a severity rating of 10 out of 10 with no real sourcing, roughly a day before the fix existed publicly.
The identifiers turned out to be real. PHP responded by announcing a release the next day at 2 p.m., with an earlier ship if possible. A video of the attack working against a WordPress site circulated and was taken down, which by then changed little: the technique was public and the patch was not.
Cloudflare turned on blocking rules for every plan, including free ones, and said it was already seeing attack traffic; the transcript quotes the CTO urging customers to patch the moment PHP shipped. The transcript also reports that France, Germany and Canada pulled government web pages during the window. Those details are the speaker's account and are not verified here against primary records.
PHP shipped the fix on the Wednesday afternoon after the leak, a day early as promised. The transcript's account of the mechanism is that requests exceeding the limit now stop at a safe point, so nothing is left half done, and the per-request notes are reset properly. The fix added 237 tests that deliberately run out of memory.
PHP2Shell compared with typical PHP security work
PHP2Shell differs from ordinary PHP security work because the fix belongs to the runtime, not to any site's code. The comparison below is scoped to what the transcript establishes, and it is not a benchmark of any kind.
| Dimension | PHP2Shell bug one | PHP2Shell bug two | Ordinary plugin or theme flaw |
|---|---|---|---|
| Where the fault sits | PHP runtime | PHP runtime | Site or plugin code |
| Requests needed | One | Two, same worker | Depends on the flaw |
| Primary outcome | Remote code execution | Memory leak plus code execution | Varies |
| Fix path | Update PHP itself | Update PHP itself | Update plugin or theme |
| CMS update helps | No | No | Usually yes |
| Default-setting role | 128 MB memory limit | Upload progress enabled | Not applicable |
The practical consequence of that table: patching the CMS and its plugins leaves both PHP2Shell bugs untouched. Version checking has to target the PHP build.
What to do on a PHP server: version, patch, then hunt
Three steps cover the response, in order: find the PHP version, update PHP itself, then look for artifacts left behind during the exposure window. The order matters because removing suspicious files before patching leaves the server reachable again.
- Identify the installed PHP version. Hosting dashboards usually show it. In WordPress, the transcript points to Tools, then Site Health. Match that number against the PHP project's patched releases.
2. Update PHP to a patched release. Either do it yourself or ask the host to upgrade the runtime. Updating WordPress, a theme or a plugin will not close the gap because the flaw is compiled into PHP.
3. Inspect for persistence. Check for administrator accounts and files that should not exist. A patch closes the hole; it does not delete what an attacker already placed.
Cloudflare's blanket blocking rules bought time during the window, and the transcript quotes its CTO recommending patching as soon as PHP shipped. Blocking rules are a stopgap; they are not a substitute for a patched runtime.
The transcript's own project suggestion is a safe local lab built with containers, in which one server stays unpatched and one is updated, so the difference can be demonstrated without touching a live host.
FAQ about PHP2Shell
- Does updating WordPress fix PHP2Shell? No. The bugs are in the PHP runtime, so a WordPress core or plugin update leaves the vulnerable code in place. Only a patched PHP build closes it. Check the version your host runs, then upgrade PHP itself.
- How serious is PHP2Shell? Bug one reaches remote code execution from a single request, which is the strongest impact class in a server-side language. The pair also enables memory leakage that can expose session identifiers, passwords and API keys. The transcript reports a published severity rating of 10 out of 10.
- Why did the patch ship a day early? A pre-disclosure leak on Hacker News exposed the bug before PHP's planned 22 October release. PHP moved the fix up to the next afternoon at 2 p.m. and shipped it on Wednesday, roughly a day ahead of schedule.
- What does the 128 MB memory limit have to do with it? Both bugs depend on a request crossing the default memory limit, which triggers the longjmp that leaves work half finished. The limit is normal protection against one request consuming a server; the flaw is in how PHP unwinds state when that limit is hit.
- How was it found so quickly? The transcript credits AI-assisted research by three teams with building full working proofs of concept, work it describes as normally taking a world-class team more than ten months. That comparison is a vendor estimate from Whiz, not an independent measurement.
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits