PHP2Shell: code execution in default PHP
Nine point two out of ten. On 21 October 2026, the PHP project fixed two flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619, that can let someone on the Internet run code on a web server without logging in. Researchers named the pair PHP2Shell.
The feature involved, session upload progress, is on by default, and the affected range goes back to PHP 5.4.
The official record
CVE-2026-109618 and CVE-2026-109619, both rated 9.2, critical, under CVSS 4.0. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Branches 8.1 and older are end of life and get no official fix.
Read the PHP project's own advisories rather than the first write-ups: the early public analyses got the root cause wrong.
How easy is it?
The server only has to run an affected PHP and accept requests from the attacker. No account, no click from anyone.
Public proof of concept code circulated within days, and Cloudflare added emergency rules to its web application firewall.
How it works, in principle
A request reaches PHP before any application code runs. The flaws sit in the way PHP's core parses that request and tracks upload progress for sessions, so the application itself does not need a bug for the server to be exposed.
The attacker's code then runs with the rights of the PHP process, usually the web server's user.
The impact
Code execution on the web server. From there, the application's database credentials and API keys, its data, and a foothold inside every network the web server can reach.
How to close it
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and move anything on 8.1 or older to a supported branch: those get no fix.
Turning session.upload_progress.enabled off blocks the confirmed session paths, but the PHP project says it does not block other variants. It buys time; it does not replace the upgrade.
And an upgrade fixes PHP, not the application: a file inclusion flaw in your own code stays exploitable on a patched PHP.
Read also
On 29 October 2026, Palo Alto Networks confirmed PHP2Shell being exploited against PAN-OS management interfaces exposed to the Internet: PHP2Shell on PAN-OS.
Sources
Sources: PHP project security advisories and the 8.2.35, 8.3.36, 8.4.27 and 8.5.12 release notes (21 October 2026).
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.
Know where your network is exposed
NacTrack reads versions and configurations off your devices, and checks them against published advisories.