What is PHP2Shell?

What PHP2Shell is

The bugs are in the PHP runtime, not in any particular application. When a request is cut short by a fatal error, for example by running out of its memory allowance, PHP could leave internal data half-built or pointing at memory that has already been freed. A carefully crafted request can then turn that leftover state into code execution or a leak of memory belonging to other requests.

Because the flaw sits below the application, a fully up-to-date WordPress, Drupal or other PHP application is still exposed if the PHP runtime underneath is unpatched. The researchers report that even a minimal "Hello World" PHP page on an affected version can be attacked.

The two vulnerabilities

Descriptions follow the official PHP advisory.

Both are rated CVSS 9.2. PHP considers Apache with mod_php the highest-risk setup: there, with a demonstrated exploit, an unauthenticated request can trigger the attack before any application code runs.

Who is affected

• Any PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
• Versions: affected releases date back to PHP 5.4, and nearly every version before the fix has at least one of the bugs. Exposure depends on the version, the configuration and how PHP is run.
• Products that bundle PHP: appliances, control panels, hosting platforms and other software that ship their own PHP runtime need an update from their vendor. The PHP2List software list tracks known products.
• Demonstrated targets: the researchers showed pre-authentication code execution against widely used applications including WordPress, Drupal and Joomla.

What to do

1. Update the PHP runtime everywhere it runs, using your operating system's packages, your hosting provider, or the fixed releases. Updating an application or CMS does not update PHP.
2. Restart Apache, PHP-FPM and any long-running PHP workers, so the fixed code is actually loaded.
3. Check products that bundle PHP (appliances, panels, container images) and apply vendor updates. Use the software list to see what's known.
4. If you can't patch straight away, CERT-EU advises isolating internet-facing applications from public networks until the fix is applied and verified. PHP's advisory lists temporary configuration changes (such as disabling session.upload_progress and adjusting memory limits) that block some attack paths. These are partial and don't make an installation safe, and some have side effects, so follow the exact guidance in the PHP advisory rather than a summary.
5. After patching, review any temporary settings you changed. The fix introduces a new hard memory limit (described in PHP's advisory and summarised on php2shell.com), so check that memory_limit and post_max_size fit your application.

Signs to look for

Because the bugs act below the application, application logs may show little. Wiz Research suggests watching for:

• unusual multipart (file-upload style) requests followed by memory-limit errors;
• bursts of HTTP 500 responses;
• unusually large or malformed PHPSESSID cookies;
• PHP workers crashing or restarting without explanation.

Several security vendors have published detections and protections; see the sources below. Proof-of-concept material circulated after an early leak. The PHP security team said it had not identified any functional exploits among it at the time of release, but CERT-EU warns that attackers may already be exploiting the flaws.

Timeline

• 2024: while fixing an issue found in an external security audit, a PHP developer spots the first signs of the out-of-memory problem. An exploit is theorised, but no concrete attack is found.
• August–September 2026: Calif and OpenAI independently report the same root cause on 11 August. Wiz Research reports further attack vectors on 24 August, and OpenAI on 18 September.
• 20 October 2026: the CVE identifiers leak early, without technical details. PHP publishes a pre-announcement and moves the release forward by a day.
• 21 October 2026: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and publishes its advisory; the researchers publish their write-ups.

Dates are from the PHP Foundation's account of the release. The people who found the bugs are credited on our acknowledgements page.

Official sources

This page is PHP2List's own summary. For anything you act on, rely on the official sources below; if they differ from this page, they are right.

• php2shell.comThe official PHP2Shell site, published by Wiz, crediting all the research teams: overview, affected versions, mitigations and links to every write-up.
• PHP security advisory (php.net)The authoritative advisory with fixed versions and exact temporary mitigations.
• GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rpPHP's GitHub security advisories for each CVE.
• The PHP Foundation blogHow the bugs were found and fixed, the full timeline, and what's changing.
• Wiz ResearchTechnical write-up and detection guidance.
• CalifTechnical write-up of the attack paths and demonstrated targets.
• OpenAIHow the disclosure was coordinated.
• CERT-EU Security Advisory 2026-018Affected versions and recommendations for organisations.
• NCSC-NL php2shell repositoryOperational information and the software list this site displays.
• EU CSIRTs Network advisory listAdvisories from national CSIRTs across the EU.

Summary written by PHP2List from the sources above. Last checked: 22 October 2026.