What is php2shell, and why are servers scrambling to patch it?

Discovered on August 1, 2026, by AI-assisted researchers from Calif, OpenAI, and Wiz, the existence of these flaws was initially kept under wraps until October 20. However, a leak of the CVE identifiers—CVE-2026-109618 and CVE-2026-109619—forced an accelerated public disclosure before the planned October 22 schedule. This phpvulnerability carries a severe CVSS 4.0 score of 9.2, signaling how easily it allows arbitrary code to run on a host system. Security honeypots quickly caught malicious actors actively exploiting the flaw in the wild, prompting CISA to add it directly to their Known Exploited Vulnerabilities catalog.

By October 21, the PHP development team rolled out emergency patches at exactly 14:00 UTC. The urgency was immediate. Major international services, including Wikimedia, DeviantArt, and Pokémon Home, along with various government agencies across the Netherlands, Finland, and Denmark, temporarily took their operations offline just to apply these vital fixes. The core issue lies in how a system handles memory allocation; attackers can bypass authentication entirely, resulting in total server compromise.

The crisis is further compounded by a related issue known as HTTP2Shell (CVE-2026-111497), an out-of-bounds write defect in Google's open-source Brotli compression library. When systems process specifically crafted malicious compressed streams, memory corruption occurs. This secondary flaw cascaded across multiple software ecosystems, hitting Node.js, Python, and eventually requiring Microsoft to issue emergency patches for .NET versions 8.0 through 11. Applications with automatic HTTP decompression enabled face the highest risk.

How does php2shell affect Windows environments?

PHP operating on Windows was not spared from the fallout, forcing the official development team to reissue Windows builds of PHP 8.2 through 8.5. These fixed versions are identifiable by a "-1" version suffix, completely replacing the vulnerable Brotli components. With advisory notices issued by the NSA, UK NCSC, CERT-EU, and the Cyber Security Agency of Singapore, the mandate for enterprise teams is uncompromising: inventory external systems and apply the patched versions—PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12—immediately.