PHP2Shell: AI-assisted researchers found a critical RCE in PHP

What is PHP2Shell?

PHP2Shell is a pair of PHP vulnerabilities in memory handling that turn a failed request into Remote Code Execution (RCE). RCE means that an attacker can run their own commands on the server. Both official advisories rate the bugs 9.2 on CVSS v4.0, the Common Vulnerability Scoring System that rates severity from 0 to 10.

Both flaws affect PHP 5.4 and later, a branch that reached end of life in September 2015, so they had been in PHP for more than a decade.

How AI-assisted researchers found PHP2Shell

The most striking part of this case is how it was found. Researchers first reported the flaws to PHP in August 2026, and they found them with AI-assisted research. The PHP Foundation notes that the growth of AI-assisted research now brings its security team far more reports than before.

At Fluid Attacks, we work the same way: the AI widens the search, and a person decides what is real. Our analysts reviewed 1,006 findings from our AI SAST, 41 became CVE candidates, and by June 2026, 12 had become public advisories.

Our AI SAST first splits a codebase into smaller units, so a deeper analysis can focus on fewer paths. We use it as a discovery tool, not as an autonomous disclosure system: an analyst checks each reported flow before it becomes a candidate.

Speed also helps the attacker. Cloudflare saw attack traffic against its customers after details leaked, and attackers changed payloads to get past its rules.

Findings like this will become more common, and the time to fix will matter more each time. As the PHP Foundation puts it, “Tools now find bugs faster than ever, for defenders and attackers alike.” We explain why that matters in our post on closing the exposure window.

How does PHP2Shell work?

Both PHP vulnerabilities start with a request that fails halfway, for example when it runs out of memory. PHP then leaves memory in a broken state, and an attacker who controls that moment can turn it into RCE. CVE-2026-109618 breaks memory inside the failed request. CVE-2026-109619 leaves pointers that a later request in the same PHP worker reads after the memory is gone.

Which PHP versions fix PHP2Shell?

The patched releases fix CVE-2026-109618 and CVE-2026-109619 in PHP 8.2 to 8.5. For older branches, the PHP project published no official release. 

End of life means that the PHP project no longer ships security updates for the branch. After you update, restart every PHP worker and rebuild your container images.

How to check if you are exposed to PHP2Shell

Check the PHP version on each host and container image. The command-line binary can differ from the one that the web server uses:

php -v                                            # host
docker run --rm --entrypoint php my-image:tag -v  # container image

At Fluid Attacks, we already added both PHP vulnerabilities to our detection, and our clients see them reported in our platform. In our vulnerability database, FLAT-3LKKV for CVE-2026-109618 and FLAT-QMKZU for CVE-2026-109619 list the affected version ranges and, where available, the patched versions. Each team can see which version to update to.

FAQ

Is WordPress affected by PHP2Shell?

A WordPress site is exposed if its PHP runtime is a vulnerable version. Cloudflare notes that updates to website code or plugins do not fix the bugs. Update PHP, or ask your host which version runs your site.

Is PHP2Shell the next Log4Shell?

Both are critical RCE bugs in software that runs under a large part of the web. PHP runs on 69.3% of websites whose server-side language W3Techs knows. Log4Shell needed several follow-up releases before its fix was complete, as our Log4Shell timeline shows. PHP shipped one fix per supported branch. The open risk is in the EOL branches.

Does a WAF protect against PHP2Shell?

A web application firewall (WAF) reduces the risk but does not remove it. Cloudflare calls its WAF rules a defense-in-depth layer and asks customers to patch these PHP vulnerabilities even with those protections in place.

Find PHP2Shell before an attacker does

Fluid Attacks already reports both CVEs to its clients, and you can check your own applications today with a 21-day free trial. Contact us.