On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core, which means any web application running on top of PHP is likely vulnerable. Estimates suggest that this is over two-thirds (2/3) of the web.
Affected Versions
|
PHP branch
|
Vulnerable releases
|
First fixed release
|
|
8.2
|
< 8.2.35
|
8.2.35
|
|
8.3
|
< 8.3.36
|
8.3.36
|
|
8.4
|
< 8.4.27
|
8.4.27
|
|
8.5
|
< 8.5.12
|
8.5.12
|
Patches are available here.
The Vulnerabilities
The vulnerabilities rest in how PHP handles fatal errors. Stale state data associated with the fatal error remains, allowing a future session to reuse it, leading to memory manipulation, unauthenticated remote code execution, and information leakage.
These vulnerabilities have been hiding in the PHP code for over a decade. They were discovered now because of the use of AI during vulnerability research. The team used a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol models, noting that Gemini 4 Argon was specifically useful in uncovering the vulnerability and exploit development.
The CVEs assigned to these vulnerabilities are in the table below:
|
CVE
|
CVSS
|
Vulnerability
|
What an attacker can achieve
|
What we demonstrated
|
|
CVE-2026-109618
|
9.2
|
Out-of-memory (OOM) corruption
|
Execute code without authentication as the PHP web worker
|
Pre-authentication remote code execution (RCE) on WordPress, Drupal, and Joomla
|
|
CVE-2026-109619
|
9.2
|
Stale global state across requests
|
Trigger a use-after-free to disclose worker memory or execute code
|
Pre-authentication RCE on WordPress and Drupal; application-agnostic remote memory disclosure
|
Remediation
If you are running a vulnerable PHP system, it’s essential to patch as soon as you can. It’s the only complete remediation for these vulnerabilities.
If you are unable to apply the patch, there are some workarounds that can limit the effect of exploitation.
In your configuration
-
Disable session upload progress tracking entirely with: session.upload_progress.enabled = 0
-
On PHP 8.5.x, turn off error backtraces with: fatal_error_backtraces = 0
-
Force individual workers to respawn after a single request with: pm.max_requests = 1
-
Enforce a server-level global absolute memory cap with: memory_limit = -1
Conclusion
Adding AI to vulnerability research will undoubtedly uncover more consequential bugs over time, especially in open-source code. While this will make our services and software more secure than ever, expect more disclosures like these in the meantime.
Additional Resources
As a trusted security partner, LevelBlue is on heightened alert for our clients and partners and is monitoring for any suspicious activity. Should new information arise that alters this assessment, we will provide an update directly.
