Notes from the attacker's side of the network.

PHP2Shell: how an old PHP bug class came back, and how to catch it

Two memory-safety bugs in the PHP engine give attackers code execution on servers whose application code is perfectly fine. Timeline, exploitation, lab results and detection.

• PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two memory-safety flaws in the PHP interpreter, both rated CVSS 4.0 9.2 and fixed on 21 October 2026.
• Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Researchers say nearly every release back to 5.4.0 is affected; 7.4, 8.0 and 8.1 only have source backports upstream, and 5.x has no upstream fix.
• The attack forces an out-of-memory bailout while PHP parses a multipart request, then uses stale pointers on the same worker. It runs before application code, so the application does not need to be vulnerable.