Which PHP versions fix PHP2Shell?

The PHP project fixed both PHP2Shell vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. PHP 8.1 and older no longer get official updates, but the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, and Linux distributions received the patches in advance.

Can PHP2Shell be mitigated without updating PHP?

The PHP advisory lists partial mitigations for PHP2Shell, such as setting memory_limit=-1, a low post_max_size, and session.upload_progress.enabled=0, then restarting every worker. The PHP security team says these only block specific attack paths and do not make an installation safe. Updating to a patched PHP release is the only complete fix.

How was AI used to find PHP2Shell?

Wiz Research says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the PHP2Shell research. According to Wiz, Gemini 4 Argon made an invaluable contribution to finding the vulnerability and also helped with exploit development, attack detection and patch validation. OpenAI and Calif worked with Wiz on discovery, coordination and patch verification.

Which PHP setups are most at risk from PHP2Shell?

The PHP project says all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk, because a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.

Wiz Research · 2026-10-21 · major

PHP2Shell — AI helps find two critical remote code bugs in PHP

PHP2Shell is a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow unauthenticated remote code execution. Wiz found them with Gemini 4 Argon. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Wiz Research header graphic for the PHP2Shell critical PHP remote code execution disclosure

Two memory bugs in PHP's core engine allow remote code execution without login; patched PHP releases shipped on October 21, 2026.

Quick facts

CVEs	CVE-2026-109618, CVE-2026-109619
Severity	Critical, CVSS v4 9.2
Fixed in	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Found by	Wiz Research, with Gemini 4 Argon
Reported to PHP	August 24, 2026
Disclosed	October 21, 2026

What is it?

Wiz Research disclosed PHP2Shell on October 21, 2026: two memory-safety flaws in PHP's core engine that can give an unauthenticated attacker remote code execution. Wiz says every PHP version released in the last decade, back to 5.4, is affected by at least one of them. Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas were used throughout the research, and Wiz says Gemini 4 Argon made an important contribution to finding the bug.

How does it work?

An attacker forces an out-of-memory fatal error, so a worker keeps broken or stale internal state after the request ends. A later request on the same worker reuses that state: first to leak process memory and learn where things live, then to corrupt memory and run code. The bugs sit in the engine, not in application code, and Wiz demonstrated the attack against WordPress, Drupal and Joomla.

Why does it matter?

PHP still serves a large share of the web, and the PHP project says every installation that serves web requests is at risk, with mod_php the highest. The case is also a public example of frontier models helping find, exploit, detect and verify fixes for a critical bug in core infrastructure, with OpenAI and Calif helping coordinate the disclosure.

Who is it for?

anyone running PHP web servers, hosting providers, security teams

Frequently asked questions

Which PHP versions fix PHP2Shell?: The PHP project fixed both PHP2Shell vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. PHP 8.1 and older no longer get official updates, but the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, and Linux distributions received the patches in advance.
Can PHP2Shell be mitigated without updating PHP?: The PHP advisory lists partial mitigations for PHP2Shell, such as setting memory_limit=-1, a low post_max_size, and session.upload_progress.enabled=0, then restarting every worker. The PHP security team says these only block specific attack paths and do not make an installation safe. Updating to a patched PHP release is the only complete fix.
How was AI used to find PHP2Shell?: Wiz Research says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the PHP2Shell research. According to Wiz, Gemini 4 Argon made an invaluable contribution to finding the vulnerability and also helped with exploit development, attack detection and patch validation. OpenAI and Calif worked with Wiz on discovery, coordination and patch verification.
Which PHP setups are most at risk from PHP2Shell?: The PHP project says all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk, because a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.

Try it

php -v, then upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package).