PHP2Shell: AI helped find a critical RCE in PHP

What is PHP2Shell?

PHP2Shell is a pair of PHP vulnerabilities in memory handling that turn a failed request into remote code execution (RCE). RCE means that an attacker can run their own commands on the server. Both official advisories rate the bugs 9.2 on CVSS v4.0, the Common Vulnerability Scoring System that rates severity from 0 to 10.

AI helped find PHP2Shell

The most striking part of this case is how it was found. The researchers used an advanced AI model in their work, on a bug that had been in PHP for at least a decade. It shows how far AI now goes in vulnerability research.

At Fluid Attacks, we see AI as a way to support vulnerability research and cut the time to detect. Findings like PHP2Shell show what it can do, and we have seen it firsthand: our analysts reviewed 1,006 findings from our AI SAST, 41 became CVE candidates, and by June 2026, 12 had become public advisories.

Our AI SAST first splits a codebase into smaller units, so a deeper analysis can focus on fewer paths. We use it as a discovery tool, not as an autonomous disclosure system: an analyst checks each reported flow before it becomes a candidate.

Speed also helps the attacker. Cloudflare saw attack traffic against its customers after details leaked, and attackers changed payloads to get past its rules.

Findings like this will become more common, and the time to fix will matter more each time. We explain why the gap between disclosure and attack keeps shrinking in our post on closing the exposure window.

How does PHP2Shell work?

Both PHP vulnerabilities start with a request that fails halfway, for example when it runs out of memory. PHP then leaves memory in a broken state, and an attacker who controls that moment can turn it into RCE. CVE-2026-109618 breaks memory inside the failed request. CVE-2026-109619 leaves pointers that a later request in the same PHP worker reads after the memory is gone.

Which PHP versions fix PHP2Shell?

The patched releases fix CVE-2026-109618 and CVE-2026-109619 in PHP 8.2 to 8.5. For older branches, the PHP project published no official release. 

End of life means that the PHP project no longer ships security updates for the branch. After you update, restart every PHP worker and rebuild your container images.

How to check if you are exposed to PHP2Shell

Check the PHP version on each host and container image. The command-line binary can differ from the one that the web server uses:

php -v                                            # host
docker run --rm --entrypoint php my-image:tag -v  # container image

At Fluid Attacks, we already added both PHP vulnerabilities to our detection, and our clients see them reported in our platform. In our vulnerability database, FLAT-3LKKV for CVE-2026-109618 and FLAT-QMKZU for CVE-2026-109619 list the affected version ranges and, where available, the patched versions. Each team can see which version to update to.

FAQ

Is WordPress affected by PHP2Shell?

A WordPress site is exposed if its PHP runtime is a vulnerable version. Cloudflare notes that updates to website code or plugins do not fix the bugs. Update PHP, or ask your host which version runs your site.

Is PHP2Shell the next Log4Shell?

Both are critical RCE bugs in software that runs under a large part of the web. PHP runs on 69.3% of websites whose server-side language W3Techs knows. Log4Shell needed several follow-up releases before its fix was complete, as our Log4Shell timeline shows. PHP shipped one fix per supported branch. The open risk is in the EOL branches.

Does a WAF protect against PHP2Shell?

A web application firewall (WAF) reduces the risk but does not remove it. Cloudflare calls its WAF rules a defense-in-depth layer and asks customers to patch these PHP vulnerabilities even with those protections in place.

Find PHP2Shell before an attacker does

Fluid Attacks already reports both CVEs to its clients, and you can check your own applications today with a 21-day free trial. Contact us