PHP2Shell: Critical PHP RCE Threatens WordPress, Moodle & PHP Platforms

PHP2Shell is the name used for two critical vulnerabilities disclosed by the PHP Project on October 21, 2026. The flaws sit in PHP core, below the application layer. A successful attack can let an unauthenticated remote attacker execute code with the web worker's privileges, potentially read secrets, alter data, plant persistence, or pivot deeper into the server.

This reaches far beyond custom PHP websites. WordPress, Moodle, Drupal, Magento, Laravel apps, PHP-based CRMs, ERPs, LMS platforms, hosting panels, containers, and appliances can all depend on PHP. They are potentially exposed when the underlying runtime is affected, even if the CMS and every plugin are current.

1. What Is PHP2Shell?

PHP2Shell is not a flaw in one CMS, theme, plugin, or route. It combines two memory-safety and request-lifecycle failures:

• CVE-2026-109618: an out-of-memory interruption can leave partially initialized request data for cleanup code to misuse.
• CVE-2026-109619: request-owned global state can survive after its memory is released and be consumed by a later request on the same worker.

Both require exploitation conditions and careful heap manipulation, but neither requires an account or victim interaction. PHP confirms remote code execution, not merely denial of service.

2. How the Two CVEs Work

CVE-2026-109618: out-of-memory corruption

PHP historically abandons processing when it reaches its memory limit. If that interruption lands while request structures are only partly initialized, shutdown logic may treat invalid memory as legitimate. Crafted multipart requests and application-driven allocation paths can create the required pressure. PHP confirms a complete HTTP exploit against ordinary Apache mod_php configurations.

PHP-FPM exits a child when startup fails, blocking that exact early-startup sequence. It is not immune: application-stage paths remain, and PHP lists FPM among installations at risk.

CVE-2026-109619: stale state across requests

Long-running workers retain process state between requests. A fatal error, timeout, or diagnostic can interrupt cleanup and leave a dangling reference. A later request handled by that worker can use the stale state before normal initialization, causing a use-after-free and possible code execution.

Confirmed paths include PHP 8.5 fatal-error backtraces and session upload progress. On October 23, PHP also advised disabling session upload progress until the next regular bug-fix release for an additional unlikely RCE vector, CVE-2026-115560.

3. Who Is at Risk?

The official scope includes affected PHP installations serving web requests through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed. Practical risk varies by SAPI, configuration, extensions, application behavior, and vendor build.

• WordPress/WooCommerce: potentially affected through PHP. A WordPress update alone cannot patch the runtime.
• Moodle and other LMS platforms: potentially affected when their Apache, Nginx/PHP-FPM, or other stack runs a vulnerable package.
• CMS, CRM, and ERP: Drupal, Joomla, Magento, PHP portals, and bespoke back offices can be in scope.
• Containers: rebuild and redeploy from a fixed base image. Restarting an old image is not an update.
• Appliances: obtain firmware or product updates when PHP is bundled and not administrator-controlled.

4. Affected and Fixed PHP Versions

Do not compare only php -v. Linux vendors often backport fixes without matching the upstream version. Validate the installed package against Ubuntu, Debian, Red Hat, hosting, or appliance advisories.

5. Immediate Response Plan

1. Inventory exposure: find public and internal PHP HTTP services, containers, secondary virtual hosts, admin panels, and appliances.
2. Prioritize public mod_php: PHP calls it highest risk because confirmed exploitation can occur before application code runs.
3. Patch through the correct channel: use an upstream fixed release or the security package from your Linux, hosting, image, or appliance vendor.
4. Restart every worker: restart FPM pools, Apache, LiteSpeed, FrankenPHP, and affected containers.
5. Verify the web runtime: CLI PHP can differ from the HTTP runtime. Verify both, then remove any temporary version page.
6. Hunt for compromise: inspect child processes, outbound connections, new PHP files, scheduled tasks, accounts, and config changes.
7. Rotate secrets when warranted: after containment, rotate database credentials, API keys, sessions, and deployment tokens if compromise is suspected.

6. Temporary Mitigations

These PHP and CERT-EU controls reduce specific paths but do not make a vulnerable runtime safe:

• Administratively enforce memory_limit=-1; an underlying allocator failure can still reach the vulnerable path.
• Keep post_max_size low and upload_max_filesize lower. PHP suggests 8 MB without uploads and 32 MB where uploads are necessary.
• Limit decoded request size, fields, multipart parts, headers, uploads, and nesting at the proxy or web server.
• Set session.upload_progress.enabled=0 in startup-level configuration and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart workers.
• Remove invalid per-request PHP settings and fix attacker-reachable fatal errors and timeouts.
• If patching is delayed, isolate the service from public networks until the fix is installed and verified.

7. Detection and Investigation

There may not be one reliable request signature. Combine web logs, PHP errors, endpoint telemetry, file integrity, and network activity. A strong post-exploitation signal is a web process unexpectedly launching a shell, interpreter, downloader, or system utility.

• Alert when Apache, PHP-FPM, LiteSpeed, FrankenPHP, or php-cgi spawns sh, bash, PowerShell, Python, Perl, curl, wget, or an unfamiliar binary.
• Review multipart request bursts, abnormal header/field counts, worker crashes, OOM events, fatal errors, and upload-progress activity.
• Search document roots and writable upload/cache paths for new or modified executable PHP files.
• Correlate suspicious requests with worker PIDs, child processes, outbound DNS/HTTP, and authentication events.
• Preserve logs and volatile evidence before rebuilding. Patching does not remove existing persistence.

8. Researchers Credited by PHP

PHP credits lcfr-hax, Sagi Tzadik of Wiz, Tomáš Hoger of Areion, and Amy Burnett of OpenAI as reporters across the two advisories. Remediation credits include Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka, and Niels Dossche.

9. Top 10 Credible Sources

This article prioritizes maintainer advisories, government CERT guidance, operating-system vendor trackers, and established security research.

1. PHP Project security advisory: Official scope, fixed releases, and mitigations.
2. PHP GHSA: OOM corruption: Primary advisory for CVE-2026-109618.
3. PHP GHSA: stale global state: Primary advisory for CVE-2026-109619.
4. CERT-EU Advisory 2026-018: Government response guidance and patch priority.
5. NCSC-NL PHP2Shell repository: Live product inventory, detection, and mitigation material.
6. Red Hat assessment: Vendor-specific severity and deployment analysis.
7. Ubuntu tracker: Fixed Ubuntu and ESM package versions.
8. Debian tracker: Debian package status and fixed builds.
9. Elastic Security Labs: Detection and post-exploitation analysis.
10. Tenable TNS-2026-29: Independent severity and embedded-product impact.

Frequently Asked Questions