PHP2Shell is a family of critical vulnerabilities recently fixed in core PHP, with severity reaching CVSS 9.2. They can allow unauthenticated attackers to execute code or expose sensitive process memory. PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki.
Researchers at Wiz Research, including Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, worked with Open AI Codex Security (Amy Burnett) and others on responsible disclosure. The vulnerabilities sit in PHP itself, so websites can be affected even when their application code is secure. A simple "Hello World" application running on an affected PHP version is enough to be exposed. Sites running the latest patched PHP releases are protected. The PHP team responded quickly and worked closely with researchers on comprehensive fixes.
The flaws fall into two classes, tracked as CVE-2026-109618 and CVE-2026-109619. The first involves out-of-memory corruption that can allow code execution without authentication as the PHP web worker. The second involves stale global state across requests, which can enable a use-after-free that discloses worker memory or runs code. Researchers demonstrated pre-authentication remote code execution against WordPress, Drupal and Joomla using their latest container images at the time of testing, and showed application-agnostic memory disclosure.
Attackers could take control of servers, access sensitive data, or read passwords, authentication tokens, API keys and certificates from other requests. Memory disclosure can also steal data without first achieving code execution, making the activity harder to detect. The only complete fix is to install a fixed PHP release on every runtime and restart Apache, PHP-FPM and any long-running PHP workers. Updating an application does not update the PHP runtime beneath it.
Source: Hacker News · Summarized by HeadlinesBriefing