PHP2Shell: Inside the Critical Zero-Day RCE That Threatens Every PHP-Powered Website
In October 2026, two critical unauthenticated remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — were disclosed prematurely via a Hacker News leak before the PHP security team could coordinate a patched release. Dubbed PHP2Shell, the associated exploit targets a use-after-free and memory corruption flaw in PHP's multipart/form-data handling combined with the session upload progress mechanism, affecting PHP versions 5 through 8. Widely used platforms including WordPress, Drupal, Joomla, Magento, and Laravel were demonstrated as vulnerable, with exploitation requiring no authentication. The PHP team expedited patches on October 21, 2026, but security researchers estimated mass exploitation could begin within 15 minutes of public disclosure. This incident underscores the compounding risk when vulnerability embargoes fail — turning a managed patch cycle into a zero-day race. With PHP powering an estimated 77% of server-side web applications, the blast radius of supply-chain and infrastructure exposure is extraordinary, and organizations relying on end-of-life PHP branches face unpatched risk.
Kill Chain
