PHP2Shell broke the embargo before package managers could build

The PHP Foundation released emergency security patches ahead of schedule after details of two remote code execution vulnerabilities codenamed PHP2Shell leaked onto public discussion boards. According to woshipm, early warnings surfaced on the night of October 20, when a Hacker News post claimed that two flaws carrying a CVSS score of 10.0 were about to be disclosed. The leak forced maintainers to pull a planned October 22 release forward to 10:00 PM Beijing Time on October 21.

The PHP Foundation identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, assigning them a severity score of 9.2 out of 10.

The fallout was immediate. Reporting from ifanr noted that Japanese online platforms and games-including Pixiv, Niconico, Sushiro's mini-program, Granblue Fantasy, Uma Musume: Pretty Derby, and Nintendo-related services-temporarily dropped offline to protect backend systems, while politician Sanae Takaichi urged administrators to patch. When engine-level exploits outrun repository builds, traditional package management leaves production fleets defenseless.

The six-hour window where binary diffs outran upstream packages

Coordinated disclosure collapsed on October 20 when details of two remote code execution flaws in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, leaked on Hacker News and BreachForums. The PHP Foundation had scheduled its security update for October 22. Instead, according to geekpark and woshipm, maintainers advanced the release by 24 hours to 14:00 UTC on October 21. That window disintegrated when security firm Calif published an exploit video demonstrating functional attacks against live targets before pulling it. The embargo was gone.

At 3:41 PM on October 21, a container provider released patched PHP images more than six hours before the coordinated embargo deadline. As ifanr reported, Chainguard breached its agreement. Binary diffing exposed the exact code changes immediately.

According to geekpark, Cloudflare CTO Dane Knecht reported that active attacks were emerging nearly six hours before the official patch arrived. While the PHP Foundation assigned both vulnerabilities an official CVSS v4.0 score of 9.2 out of 10, security firm watchTowr argued for a maximum 10.0 rating. That severity debate offered little comfort to engineers facing live exploits with zero downstream distribution packages built. The upstream pipeline was simply too slow.

Without distribution packages ready, infrastructure operators resorted to preemptive shutdowns. Government platforms in Finland, France, Germany, and Belgium went dark. In the Netherlands, administrators took down the national digital identity system and the parliamentary portal. Japanese politician Sanae Takaichi posted on X advising preventive take-downs before the 10:00 PM update rolled out, prompting services like Niconico, Pixiv, Granblue Fantasy, and Sushiro's mini-program to suspend access. Hosting entities faced the same choice. According to appinn, Wikimedia, Miraheze, WikiOasis, and Weird Gloop halted site access to await fixes.

PHP2Shell Defense Strategies: Upstream Patching vs. Reverse Proxy WAF vs. Infrastructure Kill-Switches

Machine speed against twenty years of known memory crash paths

In 2024, the PHP Foundation used funding from Germany's Sovereign Tech Agency to commission an audit by French firm Quarkslab through OSTIF, according to woshipm. During that review, a PHP core developer noted memory exhaustion handling risks, as ifanr reported. The issue was shelved because nobody could prove exploitability. The underlying crash path was already known to human engineers, but mapping the heap behavior remained stalled behind manual proof work.

The vulnerability sat dormant until models accelerated that layout work. Automated systems did not invent the crash path. They merely navigated it faster than human teams.

Wiz Research argued that the two flaws ranked among the most severe in software history, claiming their complexity nearly exceeded human capabilities, according to ifanr. Yet the process resembled automated execution rather than superhuman deduction. Calif began auditing on July 30 under OpenAI's Patch the Planet initiative, woshipm reported. Using GPT-5.6 Sol, researcher Ryan Austin identified an out-of-memory entry point on August 1 and reported it on August 11. Calif achieved remote code execution through the 2024 memory vulnerability in less than two months, according to ifanr.

Wiz independently found the issue on August 19 using Wiz Atlas alongside Gemini 4 Argon and GPT-5.6 Sol. According to geekpark, Wiz verified code execution against Drupal and WordPress within days, completing in one week what previously took months for a full team. As Nick Rogers argued via geekpark, AI has pushed the marginal cost of executing complex cyberattacks toward zero.

How engine-level payloads execute before user code touches memory

According to woshipm, the two vulnerabilities designated CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell, permit unauthenticated attackers to execute remote code before user-written application files ever run. Reporting from ifanr notes both flaws carry a CVSS score of 9.2 out of 10 and permit remote code execution without authentication. Under PHP's standard deployment on Apache, ifanr explains that attacks exploiting CVE-2026-109618 trigger before target website scripts begin execution. Application firewalls inside a framework cannot see the payload. The interpreter crashes immediately.

That crash occurs deep inside the core interpreter. As woshipm outlines, CVE-2026-109618 stems from PHP processing uninitialized memory during an out-of-memory emergency abort. A malformed request forces an out-of-memory condition. During this emergency abort, the engine attempts cleanup by reading pointers from uninitialized memory blocks. Execution control redirects before the server completes worker initialization.

Application frameworks never receive the request because memory corrupts before routing logic loads.

CVE-2026-109619 opens an equally early path. According to ifanr, this use-after-free vulnerability triggers through PHP's default-enabled session.upload_progress feature without calling session_start(). Incoming multipart uploads prompt PHP to record transfer status automatically. The routine corrupts memory during initial body parsing. Research firm watchTowr reported the vulnerabilities as potential remote code execution flaws, according to appinn. Because parser hooks activate before scripts touch memory, geekpark reported that Volker Dusch of the PHP Foundation called PHP2Shell the most severe PHP security issue in over a decade, comparing the event to 2014 Heartbleed.

Abandoned runtimes and the failure of OS package managers

Standard distribution workflows assume upstream maintainers ship code that downstream operating system repositories can package and distribute. When vulnerabilities cross major generational boundaries, that mechanism collapses. Official security patches for PHP2Shell applied only to PHP versions 8.2 through 8.5, as geekpark reported. Yet Cloudflare observed that the underlying defects reach back over ten years to PHP 5.4, which originally arrived in 2012. Upstream developers never backport fixes across abandoned development branches.

Package managers cannot distribute patches that do not exist, and for unmaintained runtimes, the downstream pipeline goes dark.

That gap covers a massive footprint across the public web. W3Techs metrics cited by ifanr show that 27.0% of identifiable server-side installations run PHP 7.x, while 7.7% still run PHP 5.x. On the day before upstream release, security firm Mallory recorded approximately 880,000 publicly accessible internet servers operating on PHP 8.1 or older. None will receive operating system updates. Content systems including WordPress, Drupal, Joomla, and MediaWiki remain stuck on engines that cannot receive vendor fixes.

Upstream engineering resources explain the boundary. In 2025, the PHP Foundation operated on $730,000 in total donations and employed 11 full-time and part-time contracted developers, who contributed roughly 42% of core commits that year. With global PHP backend usage standing at approximately 69.4% according to ifanr, 11 developers cannot backport fixes across a decade of abandoned branches. An ifanr author argues that the true security threat stems from aging and neglected computing infrastructure rather than from AI itself. Servers running abandoned runtimes cannot be saved by package maintainers.

Mitigation and Response Matrix for Engine-Level PHP Vulnerabilities

• Managing live applications running supported release series (PHP versions 8.2 through 8.5) Deploy emergency security versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately to remediate CVE-2026-109618 and CVE-2026-109619. Under standard Apache deployments, exploit attempts trigger before user application code executes, making code-level defenses ineffective.
• Operating legacy installations running PHP 8.1 or older, PHP 7.x, or PHP 5.x Route traffic through edge reverse-proxy filtering such as Cloudflare's full-transaction inspection WAF rules, or execute an emergency infrastructure shutdown. Official security patches were provided only for PHP versions 8.2 through 8.5, leaving older engines without upstream fixes.
• Facing active exploit activity during the embargo window prior to downstream package distribution Trigger preventive infrastructure shutdowns or maintenance cut-offs until patches can be compiled or deployed, mirroring actions taken by Wikimedia, Miraheze, and government websites across Finland, France, Germany, Belgium, and the Netherlands.
• Verifying infrastructure exposure across web properties to PHP2Shell attack vectors Deploy OpenAI's open-sourced php2shell-checker skill to run the phpcheck-server and phpcheck-url diagnostic utilities against outward-facing endpoints.

Intercepting multipart bodies before the backend interpreter boots

When upstream engine patches lag behind active weaponization, edge filtering stops malformed payloads before backend interpreters boot. Cloudflare observed active attacks targeting PHP websites more than six hours before the official patch was released, according to woshipm. Exploits spread fast. Security teams from Cisco, WatchTowr, and 360 reproduced the PHP2Shell attack method using public information, while Cloudflare detected small-scale attack activities, ifanr reported. Cloudflare responded by enabling WAF protection rules across all customer tiers, including free users, deploying full-transaction inspection to correlate requests with origin server responses. That stopped raw payloads cold.

Halting traffic remains the bluntest defense. Japanese Prime Minister Sanae Takaichi posted on X advising website operators to check if their websites run PHP and immediately patch upon release or temporarily shut down, according to woshipm.

Operators who cannot sever connectivity rely on diagnostic tooling and perimeter hardening. OpenAI open-sourced a Codex skill named php2shell-checker that provides phpcheck-server and phpcheck-url utilities to detect vulnerable websites, according to ifanr. That tool targeted rapid triage. As woshipm reported, OpenAI launched an emergency skill designed to help website operators determine if their infrastructure is vulnerable to the PHP exploits. Upstream proxies require scrutiny too. Prior to the PHP and Node.js vulnerability disclosures, Nginx patched five vulnerabilities and Linux patched a virtual machine escape vulnerability, woshipm noted. Pre-runtime inspection buys time until clean packages arrive.

According to woshipm, Cloudflare recorded active exploit traffic hitting PHP installations more than six hours before any official fix appeared. Relying on downstream package updates collapses when automated diffing outpaces distribution. Defenses belong at the ingress tier. Reverse proxies must enforce tight request-body constraints to drop payloads before the backend interpreter initializes.

Ready-to-deploy static failover pages remain the only safe backstop during coordinated disclosure windows. Cutting runtime execution outright eliminates exposure while package repositories rebuild.

Operating systems will not shield unpatched engines in time. When Node.js addressed 10 vulnerabilities across releases 22.23.4 and 24.22.1 as well as 26.12.1, Node.js 20 was excluded because it reached end-of-life. Perimeter filtering at Nginx or Cloudflare is the primary barrier when code cannot be patched immediately.

For readers outside China

• Availability: PHP is globally available open-source software powering approximately 70% of identifiable web backends worldwide. The emergency releases (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) and diagnostic tools such as OpenAI's php2shell-checker were published internationally across public repositories and distribution channels without regional gating.
• Pricing: PHP is free and open-source software, supported in part by charitable contributions ($730,000 in total donations received by the PHP Foundation in 2025). Cloudflare deployed default protective WAF rules to all service tiers, including free users. Commercial pricing for proprietary scanning suites or enterprise support contracts is not disclosed in sources.
• Closest Western equivalents: Node.js
• Data residency: The source material does not cover data-residency regulations, hosting compliance boundaries, or regional data-handling policies regarding these vulnerabilities or their patches.

Sources

• woshipm AI挖出藏了十几年的底层PHP漏洞，网络安全也回不去那个旧时代了。 https://woshipm.com/ai/6482529.html
• geekpark AI 到处挖漏洞一整年，终于给人类爆了个大的 https://geekpark.net/news/372731
• appinn PHP 官方罕见提前预警：两项 9.2 分严重漏洞，今晚 10 点发布修复｜请加班 https://appinn.com/php-critical-rce-vulnerability-2026
• ifanr PHP爆雷引发全球紧急「拔网线」，别指望 AI 拯救互联网 https://ifanr.com/1685446
• woshipm 安全大逃杀：https 证书、PHP、Node.js 三连爆 https://woshipm.com/ai/6482517.html
• ifanr OpenAI 发现 PHP「世纪漏洞」，全球 70% 网站都危险了 https://ifanr.com/1685507