Two Critical Vulnerabilities in PHP Expose Millions of Servers to Data Exfiltration and Remote Code Execution

The vulnerabilities CVE-2026-109618 and CVE-2026-109619, jointly identified by Calif and Wiz Research, represent an unprecedented threat to the PHP ecosystem. These are two flaws in the core engine that allow an unauthenticated attacker to read the memory of the PHP worker - containing passwords, tokens, and API keys - and, in some cases, execute arbitrary code on the server.

Quick Response

  • The vulnerabilities affect all PHP versions from 5.4 onwards
  • Official patches are only available for versions 8.2 and above
  • The exploit can be executed before any application code is run
  • No authentication is required to exploit the vulnerabilities
  • Official patches were released on October 21, 2026

An Attack That Bypasses All Application Defenses

What makes these vulnerabilities particularly dangerous is their location in the PHP runtime. The vulnerabilities reside in the PHP engine itself, which means that even the most secure applications - such as a perfectly configured WordPress installation or a Drupal site with all patches - remain exposed until the underlying PHP is updated.

Immediate Impact: Millions of Exposed Servers

PHP powers approximately 70% of websites in the world, which means the potential impact of these vulnerabilities is enormous. Affected versions include PHP-FPM, Apache modphp, php-cgi, FrankenPHP, and LiteSpeed, with modphp representing the greatest risk. The vulnerability has been successfully demonstrated against the latest containers of WordPress, Drupal, and Joomla, and can also affect extremely simple PHP applications.

The Race to Updates: Official Patches and Limitations

Official patches were released on October 21, 2026, for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, versions prior to 8.2 will not receive official updates, leaving millions of legacy installations exposed. This creates a significant problem for organizations using older versions of PHP for internal applications or forgotten tools.

The New Reality of Exploits: Artificial Intelligence and Lowering the Access Threshold

One of the most concerning aspects of this discovery is the use of AI models to accelerate exploit development. Researchers have reported that what once required months of specialized work can now be achieved in a few days. This dramatically lowers the access threshold for attackers, making vulnerabilities once considered impractical now easily exploitable.

The Challenge of Discovery: Attack Signals to Monitor

For organizations that have yet to apply the patches, it is crucial to monitor signs of a potential attack. These include malformed multipart upload requests, memory limit errors, or bursts of HTTP 500 responses. Another key indicator is the presence of oversized or malformed PHPSESSID cookies in responses, which can indicate a memory leak back to the client.

The PHP2Shell Vulnerability Chain: An In-Depth Technical Analysis

The vulnerability is composed of four distinct bugs, classified as two CVEs. The first phase of the attack exploits a use-after-free (UAF) condition during session upload handling, which occurs before the application code is executed. This condition leaves the PHP engine pointers in an uninitialized state, which can be exploited to achieve both memory disclosure and remote code execution.

Bug 1: Remote Process Memory Disclosure

After the preparation phase, another multipart request on the same worker will continue to trust the free allocation of PS(id). PHP will read the bytes claimed by the attacker as an active session ID and encode them in URL in the PHPSESSID response cookie. This allows the attacker to read the cookie to obtain the lost worker memory, bypassing the address uncertainty that is fundamental for the next step towards RCE.

Bug 2: Unserializer Use-After-Free

In this scenario, the free allocation of BG (unserialize) is exploited to achieve memory corruption. PHP will continue to "unserialize" using the memory claimed by the attacker as if it were still valid, becoming a memory corruption primitive. Combined with the memory disclosure of Bug 1, this bug has been exploited to achieve unauthenticated RCE, successfully demonstrated on WordPress, Drupal, and Joomla.

Bug 3: Fatal-Error Backtrace Use-After-Free

Another abuse of the pointer EG(lastfatalerrorbacktrace). If the same worker sends a diagnostic event (any subsequent error or warning) after the cleanup failure, it can access the free pointer before the state reinitialization. PHP will update or destroy the backtrace pointer and follow the memory claimed by the attacker. This use-after-free could be developed into memory corruption that can lead to RCE.

Bug 4: OPcache Type Confusion

The fourth bug follows a separate flow involving multiple workers. The basic mechanism exploits a type confusion condition in the shared cache of OPcache's compiled code. Two trackers - one local to the process (CG(mapptrlast)) and one shared (ZCSG(mapptr_last)) - track how much shared memory has been filled. A failure of allocation during an update can lead to an inconsistent state that can be exploited to achieve arbitrary code execution.

The Hidden Cost of Vulnerability: Impact on Compliance and Cyber Insurance

For organizations that must comply with standards such as the NIS2 Directive or the DORA Regulation, this vulnerability represents a significant compliance risk. A successful attack could violate the requirements for digital operational resilience and personal data security, with potential sanctions and impacts on cyber insurance costs.

The Challenge of Discovery: How to Identify Hidden PHP Installations

One of the biggest challenges in mitigating this vulnerability is identifying all PHP installations within an organization. This includes not only public websites but also software bundles, appliances, and forgotten internal tools. A complete inventory is essential to ensure that all PHP instances are updated promptly.

The Emergency Response: Patching Priorities and Credential Rotation

For organizations with exposed systems, the immediate priority should be updating systems in contact with the Internet. Subsequently, it is essential to apply patches to all other PHP installations. Additionally, it is crucial to consider rotating all credentials, tokens, and API keys on exposed servers, as this information may have been compromised before the patch was applied.

The Market Context: PHP and the Challenge of Legacy Security

PHP remains one of the most widely used languages for web development, despite its age. According to W3Techs data, 77.1% of all websites that use a server-side language use PHP, a percentage that shows no significant signs of decline. This creates a security paradox: while new technologies emerge, the installed base of PHP continues to grow, maintaining vulnerabilities that might be considered obsolete.

Impact on Cyber Insurance: A Systemic Risk

The PHP2Shell vulnerabilities represent a systemic risk for the cyber insurance sector. According to a report by S&P Global Ratings, vulnerabilities in open-source software like PHP are among the main factors driving increases in cyber insurance premiums. Insurance companies are already reporting a 15-20% increase in claims related to vulnerabilities in unpatched PHP applications, a trend that could accelerate with the discovery of PHP2Shell.

The Challenge of Mitigation: Beyond Patching

For organizations that cannot update immediately, there are temporary solutions. Implementing a Web Application Firewall (WAF) with specific rules to block malformed multipart requests can reduce the risk. However, this is a temporary solution and does not replace the critical update. Additionally, adopting an MDR service can provide a faster response to ongoing attacks.

Impact on Compliance: NIS2 and DORA

Organizations subject to the NIS2 Directive must be aware that this vulnerability could be considered a violation of security requirements. Similarly, the DORA Regulation requires robust digital operational resilience, which includes timely management of vulnerabilities. A security audit could reveal non-compliance related to these vulnerabilities, with potential sanctions.

The Industry Response: Updates and Alternatives

The PHP development team has already begun working on further security improvements for future versions. However, for organizations using versions prior to 8.2, the situation is more complex. Some hosting providers are already offering automatic updates, but for local installations, the responsibility falls entirely on the organizations.

The Future of PHP Security: Towards a Proactive Approach

This discovery underscores the importance of a proactive approach to security. Adopting an advanced SIEM can help identify and quickly respond to such vulnerabilities. Additionally, integrating a managed SOC can provide continuous surveillance and more effective incident response.

The Lesson Learned: The Need for a Complete Inventory

One of the most critical aspects highlighted by this vulnerability is the need for a complete inventory of IT resources. Many organizations may not be aware of all PHP instances in use, especially those in legacy or internal environments. An accurate inventory is the first step for effective risk management.

Future Forecasts: The Evolution of Exploits

With the increasing adoption of artificial intelligence tools for exploit development, we are likely to see an increase in similar attacks in the future. Organizations must prepare for this new reality, investing in more robust incident response and ransomware recovery. The ability to quickly respond to these threats will be crucial to mitigating impact.

Frequently Asked Questions

How long will it take to apply patches to all PHP installations?

The time required depends on the complexity of the organization's IT infrastructure. For simple environments, it might take a few hours. For complex environments with multiple PHP instances, a gradual update plan that spans several weeks may be necessary.

Are there specific tools to identify vulnerable PHP installations?

Yes, there are specific vulnerability scanning tools for PHP that can help identify vulnerable installations. Some of these tools can be integrated with SIEM systems for centralized management.

What are the alternatives to PHP for organizations seeking to reduce risk?

Organizations can consider adopting alternative languages such as Python, Node.js, or Ruby, which offer similar functionality but with a different security profile. However, migration requires careful planning and thorough testing.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not engage in real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.

In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves autonomously before making any decision.