PHP2Shell Exploit: What Changed Since the Patch (2026)

Table of Contents

The Wednesday panic, briefly recapped

On 21 October 2026, the PHP project shipped an emergency security release for two critical flaws in the PHP interpreter itself — the PHP2Shell exploit, as researchers nicknamed it. The flaws are CVE-2026-109618 (RCE via out-of-memory corruption, advisory GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (RCE via stale global state, advisory GHSA-6wmf-4rv5-p3rp), both rated CVSS v4.0 9.2 Critical. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

We covered the panic itself on Wednesday in PHP2Shell: What the Critical PHP RCE Means for Your WordPress Site. This post is the follow-up: the CVEs are now named, the exploit story has moved fast since Wednesday, a researcher has demonstrated the first exploit that bypasses ASLR on production-configured x86-64 systems, some of the web’s biggest sites went dark rather than risk it — and today, PHP warned of a third unpatched RCE. Here is what the dust looks like, and what you still need to do.

The CVEs are named — and the fix window was never real

Wednesday’s coordinated release was always a fiction of sorts. PHP had planned to disclose on 22 October, but details leaked on 20 October — including the CVE IDs and mitigation advice given to some critical-infrastructure providers — forcing the release forward to 21 October at 14:00 UTC.

Worse, the attackers had a head start of their own. Amazon’s MadPot honeypot network caught an exploitation attempt on 17 October, four days before the disclosure, arriving via a commercial anonymization network. How the attacker obtained exploit details is still unknown. Cloudflare went further: it turned on emergency WAF rules for PHP2Shell at 3:02 a.m. UTC on 21 October — roughly nine hours before the disclosure — because it was already seeing attack traffic. CEO Matthew Prince later described “thousands” of attempts in the ten hours before the announcement, tens of thousands within 45 minutes, and “millions now”. AWS says PHP2Shell is now “broadly exploited in the wild” — though it is worth the honesty note that honeypot attempts may not have worked against real systems.

Two corrections to Wednesday’s post, while we’re here:

There are no official release builds for PHP 8.1 and older — but the PHP team did publish source-only backports for 7.4, 8.0, and 8.1, which you can compile yourself. It’s a road you have to build by hand, but it exists.
The “no in-the-wild exploitation” line is stale. Wednesday’s post was written pre-release; Cloudflare’s observed attack traffic, the AWS honeypot hits, and the watchTowr reports of active exploitation attempts mean you should treat exposed servers as probed, not just theoretically vulnerable.

The honest bottom line from every scanner vendor, though: as of this week, no confirmed real-world compromise has been publicly reported. Broadly exploited attempts, yes. Confirmed breaches, no — not yet. That distinction matters, and it may not survive the weekend.

The PHP2Shell exploit that bypasses ASLR — reported, not public

The most sobering development since Wednesday came on 22 October: VulnCheck announced it had built an exploit for CVE-2026-109618 that it believes is the first known exploit to achieve remote code execution on ASLR-enabled x86-64 systems running PHP’s recommended production configuration.

Address Space Layout Randomization is one of the standard mitigations that’s supposed to make memory-corruption bugs hard to weaponize. An exploit that works through it, on a hardened production config, is a meaningful escalation — and VulnCheck’s director of exploit development, Spencer McIntyre, put it bluntly: “Adversaries are clearly spending time (and tokens) on this bug.”

Two caveats to keep this honest. The exploit is not public — it’s available only to VulnCheck’s Initial Access Intelligence customers. And it is researcher-reported, not independently confirmed in the wild. Censys noted as of 22 October that no public exploit bypassed ASLR on amd64. So treat this as a forecast, not a fire: the ceiling of what’s possible against this bug just rose, and it’s a matter of time before the technique is replicated.

How the AI found it — the discovery story that changed security

PHP2Shell would not exist as a story without the discovery story. The bugs were discovered in August 2026 by teams at OpenAI, Google-owned Wiz, and security firm Calif — and in every case, frontier AI models did the finding.

Wiz’s account is the quotable one, verified verbatim from its blog: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” Wiz used its Atlas tooling with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol; its timeline has discovery on 19 August, confirmed RCE on Drupal on 20 August and WordPress on 21 August, and a report to PHP on 24 August.

Calif researcher Ryan Austin found the first flaw independently in August while auditing PHP under OpenAI’s “Patch the Planet” initiative, using GPT-5.6 Sol — and reported to PHP on 11 August, the same day OpenAI independently reported the same root cause. OpenAI, for its part, called PHP2Shell “one of the most impactful vulnerabilities in recent memory.”

The flaw had been sitting in PHP since 2012 — over a decade, at the edge of what human researchers could practically achieve. The Heartbleed comparison going around is real, but attribute it correctly: it was PHP Foundation security engineer Volker Dusch who called this the project’s most serious security problem in over a decade and compared it to Heartbleed, not OpenAI.

The lesson for everyone running servers: AI didn’t just find this bug — it’s shrinking the clock between “a fix exists” and “your server runs it.” Patching within the week is no longer adequate for internet-scale engine bugs. Patching within hours is the new target, and that mostly means automated security updates and an inventory of everything that runs PHP.

The fallout: when Wikipedia goes offline, pay attention

The precautionary shutdowns were the week’s most visible symptom. European government, hospital and school websites went dark. Wikipedia took a number of systems down until safely patched, and the Internet Archive was briefly taken offline. Overheid.nl, Denmark’s national school communication platform, all Finnish government public-facing web services, and all French Interior Ministry websites went offline. In the UK, 32 government services went offline; the NCSC sent 50,000 alerts and called the scale “unprecedented” — while reporting no successful hacks. Japan’s National Cyber Office said temporarily stopping websites is an effective way to reduce risk if patching quickly is difficult, and Japan’s Prime Minister repeated it publicly.

Uptime monitor Oh Dear recorded 18.8% of the sites it watches going offline at the peak, against 0.9% a week earlier — operators pulling their own sites down rather than wait to get hit. The NSA’s Cybersecurity account and the UK NCSC both advised taking systems offline if “an immediate update is not feasible.” CERT-In rated the flaws “critical.”

It sounds theatrical until you remember the alternative: an unauthenticated RCE in the language interpreter, reachable before your application code even runs, with attackers already probing. Pulling the site down is the only complete mitigation when you can’t patch — and PHP’s own advisory says exactly that: there are no complete mitigations; updating is the only safe choice.

The disclosure fight: PHP vs Chainguard

The ugly subplot: the PHP Foundation blamed supply-chain security business Chainguard for putting large chunks of the web at risk. Chainguard published container images containing the fix at 07:41 UTC on 21 October — about six hours before the coordinated 14:00 UTC release. PHP alleged this disregarded weeks of coordination work by many parties.

Chainguard CEO Dan Lorenc doesn’t dispute the timeline but says he “didn’t leak” — he shipped because people were already getting hit. And there’s a case that he was right to: the details had already leaked on 20 October, and exploitation attempts had been observed since 17 October. The coordinated-disclosure model assumes the secret holds; PHP2Shell is now the case study for what happens when it doesn’t. Expect this fight to be referenced in every disclosure debate for years.

New today: a third unpatched PHP RCE

Just as the dust was settling, PHP warned on 23 October of another unpatched RCE, CVE-2026-115560. It affects applications with an unusual configuration — switching session.serialize_handler via ini_set with upload progress enabled — and PHP recommends setting session.upload_progress.enabled=0 until the next routine release. No emergency fix is planned.

That stopgap setting is worth applying anyway: upload progress was one of the two confirmed entry points for CVE-2026-109619, so disabling it reduces exposure to both the old bug on any unpatched edge and the new one.

What you still need to do this week

If you patched on Wednesday, breathe — then do the verification steps. If you didn’t, this list is your weekend plan.

1. Confirm the patch actually landed

Checking a dashboard isn’t enough — the fix is in the PHP binary, not in WordPress. Verify the running version directly:

php -v

You need 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+ depending on your branch. Note that php -v reports the CLI binary — if your web server uses a separate PHP-FPM build, check it separately (your host’s panel or a phpinfo() page behind authentication will tell you).

2. Restart every PHP worker

Patching the package doesn’t patch the running process. Old workers stay vulnerable until they’re restarted:

sudo systemctl restart php8.3-fpm
# or, on shared hosting: ask your host to confirm the restart happened

If you run your own VPS, make sure unattended-upgrades (or your distro’s equivalent) is actually enabled — the next engine-level bug will not wait for your schedule.

3. Harden the stopgaps you can apply today

In php.ini, disable upload progress — it trims exposure to both CVE-2026-109619 and today’s new CVE-2026-115560:

session.upload_progress.enabled = 0

If you’re behind Cloudflare, its WAF rules for PHP2Shell went live at 3:02 UTC on 21 October and are on by default — but attackers are already mutating payloads to evade them. WAF is a speed bump, not a fix.

4. On shared hosting? Ask in writing.

This is the step that matters most for small businesses — the Nigerian SME audience included. Your WordPress dashboard cannot update the PHP version for you. Email or ticket your host with one question: “Is the PHP runtime on my account patched against CVE-2026-109618 and CVE-2026-109619, and when were the workers last restarted?” If the answer is vague, that’s an answer.

5. Look for signs someone got in first

Attack attempts go back to at least 17 October. Check your logs back that far for:

Bursts of "Allowed memory size exhausted" errors in the PHP-FPM error log — the signature of CVE-2026-109618 probing
Oversized multipart/form-data POST requests from unfamiliar IPs in your access logs
New files in wp-content/uploads or unexpected admin users — run the full DIY cleanup walkthrough if anything looks off: How to Remove Malware From Your WordPress Site Yourself

If anything looks compromised, assume the worst: rotate database credentials, API keys, and admin passwords, because an RCE gives the attacker the keys to everything the web server can touch.

PHP2Shell Exploit: The Aftermath — What We Learned After the Emergency Patch (2026)