Definition
PHP2Shell is the collective name for critical unauthenticated remote code execution flaws CVE-2026-109618 (OOM-path corruption) and CVE-2026-109619 (stale global state) in web-serving php installations (CVSS 9.2).
Key Points
- 2026-10-21: Emergency patches in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; mod_php considered highest risk (2026-10-21-php-net-security-advisory-oct-2026)
- 2026-10-17: AWS reported in-the-wild exploitation attempts before public disclosure (2026-10-21-php2shell-datadog-labs)
- Discovered by Calif, OpenAI, and Wiz researchers per PHP advisory (2026-10-21-php-critical-cve-emergency-patches)
Configuration mitigations (e.g.
session.upload_progress.enabled=0) are partial only; patching is required.