PHP2Shell: Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution

On 21 October 2026, twocritical vulnerabilities affecting PHP were publicly disclosed, raising seriousconcerns for organisations running PHP-based websites and applications,including well-known CMS such as WordPress, Drupal and Joomla.

Collectively known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 carry a CVSS v4.0 scoreof 9.2 (Critical) and could allow unauthenticated attackers to executemalicious code on vulnerable servers.

With PHP powering widelyused applications, organisations should assess their exposure immediately.

‍What Is PHP2Shell?

PHP2Shell refers to twomemory-safety vulnerabilities within PHP's core runtime. Unlike traditionalapplication vulnerabilities, these weaknesses exist within PHP itself, meaningapplications with secure code may still be affected.

The vulnerabilities include:

• CVE-2026-109618 – Out-of-Memory  Corruption: Improper memory handling during request processing and cleanup can allow attackers to corrupt memory and potentially execute arbitrary code.
• CVE-2026-109619 – Stale Global  State: Previously freed request memory may remain referenced by PHP processes, creating use-after-free conditions that attackers can exploit.

Both vulnerabilities may betriggered through specially crafted HTTP requests without requiringauthentication. Successful exploitation can result in remote code execution,sensitive information disclosure or service disruption.

‍Which PHP Versions Are Affected?

Affected PHP installationsshould be upgraded to the following patched releases or later:

‍

Older PHP versions are alsoaffected. Organisations using unsupported releases should migrate to supportedversions or apply verified vendor-maintained security patches.‍

Why Should Businesses Be Concerned?

PHP2Shell presentssignificant risks beyond technical infrastructure.

An attacker exploitingthese vulnerabilities could gain access to sensitive customer information,compromise business applications, deploy malicious software or disrupt criticalonline services.

For businesses, this couldtranslate into operational downtime, financial losses, regulatory consequencesand reputational damage.

Internet-facingapplications are particularly exposed, making early detection and remediationessential.

How Can Organisations Protect Themselves?

‍For IT and security teams:

1. Identify all PHP-based applications, including development and staging environments.
2. Update vulnerable PHP installations to patched releases.
3. Enable available WAF protections as temporary defence-in-depth measures.
4. Review application and server logs for suspicious activity.
5. Rescan affected systems after patching to verify remediation.

‍For business leaders

1. Request confirmation of PHP2Shell exposure across business-critical applications.
2. Prioritise remediation of internet-facing systems.
3. Ensure security teams have resources to implement emergency patches.
4. Maintain continuous vulnerability monitoring to identify emerging threats.

Blacklock PHP2Shell Scanner

‍Within 24 hours of thePHP2Shell vulnerability disclosure, our security engineering team developed adedicated PHP2Shell scanner and deployed it to production.

Customers can now use theBlacklock platform to assess their applications for potential PHP2Shellexposure, identify affected systems and prioritise remediation.

This rapid deploymentdemonstrates the value of continuous vulnerability assessment compared withrelying solely on periodic security testing.

‍Don't leave critical vulnerabilities undetected.

Explore Blacklock or start a free trial to assess yourapplications for emerging security threats.

‍