PHP2Shell Explained: What the Leaked PHP Remote Code Execution Flaws Mean and How to Patch

PHP2Shell is the name for an exploit chain built on two memory-safety bugs in the PHP interpreter itself, not in a plugin or framework. It surfaced in a demonstration video posted by researcher Kirill Firsov, who credited the exploit to the researcher LCFR and to Calif.io, according to Tenable.

Both bugs sit in the code PHP runs to set up and clean up each web request, before your application loads. Updating a CMS or plugin does nothing; the PHP runtime itself has to change.

Sources: the PHP security advisory and Huntress.

PHP rates the risk highest for Apache with mod_php, where it has a working exploit that fires from a single unauthenticated request before any application code runs. Huntress reports PHP achieved full code execution there with default memory and input limits, so a stock setup is enough.

The fix was due on Thursday, 22 October, under a coordinated embargo that gives distributions and hosts time to prepare. It came out a day early because word of the bugs got out first.

Sources: Huntress, Tenable, Patchstack and the PHP news archive. Times are as each source reported them.

No public account yet says who leaked the details. What matters is the order of events: attackers knew a critical PHP bug existed before the patch did, and distributions had less time to package it.

Treat any server that uses PHP to answer web requests as vulnerable until it is patched. PHP’s advisory covers every common setup:

• PHP-FPM, the usual setup behind Nginx and most modern hosting.
• Apache with mod_php, where PHP says the risk is highest.
• php-cgi, still common on Windows and older shared hosting.
• FrankenPHP and LiteSpeed, used by newer stacks and many WordPress hosts.

CERT-EU says every release from PHP 5 onward may be affected. PHP fixed only the four branches it still supports, 8.2 to 8.5.

Patchstack lists WordPress, Drupal, Joomla, Magento and Laravel among the exposed software, since the bug triggers before their code loads.

PHP also hides in vendor appliances, Windows software that bundles it, and control panels such as cPanel and Plesk, Huntress notes. On shared or managed hosting, your host controls the PHP binary: the patch is theirs to apply and yours to confirm.

Researcher Silas Cutler estimates more than 1.3 million internet-exposed hosts are potentially vulnerable, according to Tenable. That is an estimate, not a confirmed count, but it shows how wide the window is while patches roll out.

Find the branch you run and move to the fixed release or later. Check with php -v on the command line, and also check what your web server loads, since PHP-FPM, Apache and the CLI can use different binaries.

Source: PHP news archive, 21 October 2026.

Distributions and long-term support vendors got the patches early, so Debian, Ubuntu and Red Hat systems may receive backported fixes under their own package version numbers. Check your vendor’s advisory rather than the version string alone. If you run 8.2, patch now and plan the move to 8.3 or later before it loses security support.

Day-one reports disagree. Here is what each source said on 21 October:

• Patchstack posted at 07:34 UTC that multiple incidents of active exploitation were confirmed, without giving a count.
• Cloudflare‘s CTO said the company was seeing early attacks and had deployed WAF rules for the known exploit routes. Cloudflare itself describes those rules as a stopgap.
• watchTowr told BleepingComputer it believed it had reproduced CVE-2026-109618.
• Huntress had seen no confirmed exploitation among its customers as of 10:00 ET.
• Tenable said public exploit code was circulating but unverified, and could carry malware.

Neither CVE was in CISA’s Known Exploited Vulnerabilities catalogue when Tenable published, but earlier PHP bugs are. CVE-2024-4577 (php-cgi) and CVE-2019-11043 (PHP-FPM) are both marked as used in ransomware, and in March 2025 The Hacker News reported CVE-2024-4577 being used to install the Quasar remote access tool and XMRig cryptominers. A flaw that needs no login and runs before the application starts gets scanned for at scale, so assume your servers will be probed within days.

Patching is the only fix. PHP’s release notes say there are no complete mitigations, and PHP core developer Gina Peter Banyard has said the same. Work through these steps in order:

1. List every PHP install. Include web servers, staging boxes, control panels, appliances and Windows software that ships its own PHP.
2. Patch internet-facing servers first. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution’s backported package.
3. Restart every PHP process. Reload PHP-FPM pools and Apache so that no worker keeps running the old binary.
4. Confirm with your host. On shared or managed hosting, get the patched version number in writing.
5. Deal with end-of-life PHP. Upgrade servers on 8.1 or older, build from PHP’s backports, or move them behind a VPN.

PHP lists measures that reduce exposure but, in its words, do not make an installation safe. Use them for hours, not weeks.

E-commerce security firm Sansec also suggests blocking multipart/form-data requests at the web server, or making a store read-only or offline until it is patched.

Until indicators are published, Huntress suggests alerting when PHP workers (php-fpm, php-cgi, httpd, apache2) launch shells, Python, Perl, curl, wget or nc, or run commands containing /dev/tcp/, mkfifo, whoami or uname -a.

If you suspect a breach, isolate the server, keep the web server and PHP logs, and look for web shells, new files in the web root, new cron jobs or scheduled tasks, and new user accounts. Patching closes the hole; it does not remove anything an attacker left behind.

• PHP news archive: advance notice, security advisory and release announcements, 20 and 21 October 2026
• Huntress: Rapid Response, php2shell, 21 October 2026
• Tenable: php2shell FAQ, 21 October 2026
• Patchstack: Major security alert, PHP vulnerable to critical RCE, 21 October 2026
• Sansec: PHP2Shell, 21 October 2026
• The Hacker News: attackers exploit CVE-2024-4577, 19 March 2025