Critical PHP2Shell Vulnerability Gets Public PoC Exploit

Key Takeaways

• Two critical vulnerabilities, dubbed “php2shell” (CVE-2026-109618 and CVE-2026-109619), have been identified in PHP’s session handling.
• These flaws, rated 9.2 on CVSS v4.0, could lead to remote code execution under specific conditions.
• A public proof-of-concept (PoC) exploit has been released, detailing various attack paths and lab setups for testing.
• PHP versions 5.4.0 through 8.5.11 are reportedly affected, with emergency security updates for supported branches anticipated on October 21st at 14:00 UTC.
• Approximately 59% of internet-facing PHP installations are running end-of-life versions (PHP 8.1 or older) and will not receive official patches.

Critical PHP2Shell Vulnerability Gets Public PoC Exploit

A pair of critical vulnerabilities, collectively referred to as “php2shell,” have emerged in PHP, potentially allowing for remote code execution. Researchers have assigned these flaws the identifiers CVE-2026-109618 and CVE-2026-109619, highlighting their connection to PHP’s session.upload_progress feature. The severity of these issues is underscored by a CVSS v4.0 rating of 9.2.

Adding urgency to the situation, a public proof-of-concept (PoC) repository has been made available, offering detailed verification tools and a laboratory environment for testing these vulnerabilities. This release provides crucial technical insights into a rapidly developing security concern.

PHP’s security team has acknowledged the gravity of the situation, announcing an emergency release scheduled for October 21st at 14:00 UTC to address these critical flaws. Users are strongly advised to prepare for immediate upgrades upon the official patch availability.

As of this writing, the official PHP release has not yet occurred, meaning the specific technical details, precise affected versions, and confirmed fixed builds outlined in the research repository are awaiting official validation from the PHP project’s advisory. However, the advance notice from the PHP project confirms both the critical severity and the planned release schedule.

The PoC repository indicates that PHP versions spanning from 5.4.0 to 8.5.11 are vulnerable. It tentatively lists PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as the planned patched versions. Administrators should, however, cross-reference these against the official PHP team’s release advisory before proceeding with any updates.

PHP Branch Support Status

It is important to note that only the branches listed above are eligible for official security updates. Older PHP versions, including PHP 8.1, 8.0, 7.x, and 5.x, have reached their end-of-life (EOL) and will not receive official fixes from the PHP project. Organizations relying on these outdated versions face significant unpatched risks.

PHP2Shell Vulnerability Details and Attack Paths

The researcher’s documentation details multiple avenues for achieving code execution, rather than a singular, universally applicable exploit. One identified attack chain involves the combination of session-file injection with an existing local file inclusion (LFI) vulnerability within an application.

This particular path, according to the repository, hinges on both the upload_progress feature being active and the presence of an application-level LFI flaw. An LFI vulnerability permits an attacker to manipulate an application into loading files from the server in an unintended manner.

The repository further claims that PHP’s upload-progress handler stores an attacker-supplied filename within session data without proper validation. Additionally, it reports that a session identifier sent within a POST request body can circumvent the session.use_only_cookies setting, which is designed to restrict how session IDs are accepted. These findings suggest a potential weakness in PHP’s session handling that could be leveraged when combined with other application vulnerabilities, though it does not imply every PHP site is immediately exploitable via this route.

A second reported vulnerability involves a use-after-free condition, a common memory error where software attempts to access or use memory that has already been deallocated. The researcher states that re-entry into a var_destroy destructor can trigger this condition, a finding confirmed using AddressSanitizer, a tool specifically designed for detecting memory errors.

Other potential attack vectors described in the repository include a PHP-FPM serializer state that might persist across requests, and a handler mismatch that could cause a destructor to execute after a deserialization failure. The researchers caution that some of these paths necessitate additional prerequisites, such as an application “gadget” or access to a local file.

These technical assertions remain the findings of an independent research project until corroborated by PHP’s official advisory and subsequent patches. Security teams should exercise caution and avoid assuming every listed attack path is independently confirmed for all PHP versions or configurations. The project’s verification repository provides a comprehensive research overview and lab files. Its explicit purpose is controlled testing, not unauthorized exploitation of systems.

Given PHP’s pervasive use across a vast array of websites and applications, a fundamental flaw in its core session handling could have widespread implications across various deployment types. The risk level escalates significantly when an application already harbors a local file inclusion vulnerability or exhibits unsafe deserialization behavior.

A report from Mallory underscores the extensive scale of outdated PHP deployments as administrators brace for the php2shell security updates. Utilizing Shodan data gathered on October 20th, Mallory identified 883,717 internet-accessible hosts running PHP 8.1 or older. This figure represents approximately 59% of the roughly 1.5 million hosts that publicly disclose their PHP version. Since these branches no longer receive official PHP project security fixes, migrating to a supported release is a paramount concern for affected organizations.

Prior PHP security incidents have demonstrated that memory errors in PHP components can lead to severe consequences, even if the underlying technical causes differ. This current situation further highlights the ongoing application-level risks.

The assigned CVSS score of 9.2 signals a critical vulnerability, but it does not automatically indicate whether a specific server is exposed. This depends on factors such as the PHP version, server configuration, application behavior, and whether the necessary conditions for a particular attack chain are met. The public repository includes a lab setup featuring PHP-FPM and Nginx for testing purposes. Organizations must use such environments solely for authorized validation and refrain from executing proof-of-concept code against production systems.

What You Should Do

• Inventory PHP Installations: Identify all PHP installations across web servers, containers, and managed hosting environments.
• Monitor for Official Advisory: Closely watch for the official PHP security release on October 21st (14:00 UTC) for confirmed affected and fixed versions.
• Apply Patches Promptly: Once the official security update is available, apply it immediately to all supported PHP installations. Remember to restart PHP-FPM or the relevant web service for the new binaries to take effect.
• Address End-of-Life Versions: Systems running EOL PHP branches (PHP 8.1 and older) will not receive official fixes. Plan for urgent migration to a currently supported PHP version.
• Implement Temporary Mitigations: As interim safeguards, consider disabling session.upload_progress and setting session.use_only_cookies to On. Be aware that these settings may reduce exposure to some reported attack paths but do not address all of them and are not a substitute for official security updates.
• Audit Applications: Review applications for existing local file inclusion (LFI) and unsafe deserialization vulnerabilities that could exacerbate the php2shell flaws.
• Monitor Logs: Scrutinize server logs for any unusual requests related to PHP session handling while awaiting and applying official patches.
• Test in Isolated Environments: Utilize the provided public proof-of-concept and lab setups for controlled testing and validation in isolated environments only. Never run PoC code on production systems without explicit authorization and careful risk assessment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.