PHP2Shell and React2Shell: critical remote code execution vulnerabilities
What we know about PHP2Shell (CVE-2026-109618 and CVE-2026-109619): the timeline, what to look for in your logs and which temporary mitigations exist. Plus the parallels with React2Shell and what actually helps you stay protected.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
On 20–21 October 2026, the PHP Foundation officially disclosed two vulnerabilities and released security fixes. Both vulnerabilities were rated 9.2 out of 10.
- CVE-2026-109618: An attacker exhausts memory with a crafted request, which causes its processing to be aborted. While cleaning up memory, the system mistakenly treats the incomplete data as valid. This is the point at which malicious code can be injected.
- CVE-2026-109619: Use-after-free. PHP frees a region of memory but keeps accessing it. When the same region is reused by a subsequent request, old data may be exposed. An attacker could potentially extract keys and other secrets from memory and, most importantly, achieve execution of malicious code.
Timeline
| Date | Event |
|---|---|
| August | PHP receives a vulnerability report |
| 17 October | Amazon records the first exploitation attempt |
| 20 October | The news appears on Hacker News. PHP moves the fix release from 22 to 21 October |
| Night of 20–21 October | The first working exploits appear while the information is still under embargo. Videos demonstrating an exploit go public |
| 21 October, 14:00 UTC | The PHP Foundation releases security updates |
| 21 October | Mass attack attempts begin |
Cloudflare reports thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly disclosed. The number later reaches millions.
Major hosting providers such as Hetzner and DigitalOcean have notified their customers about the vulnerabilities and the need to install security updates.
In Germany, the BSI issued a cybersecurity warning (Cybersicherheitswarnung) urging everyone to install the updates as soon as possible. Around the world, dozens of public authorities and thousands of companies preemptively took their services offline until the vulnerabilities were fixed.
What to do now?
First of all, check whether PHP is used in your services and whether the installed version is affected. If it is, install the security updates as soon as possible. If you're not sure, temporarily restrict internet access to the potentially vulnerable service until the fixes are in place. Check your server logs from 17 October onwards, not just from the 21st:
- POST requests with
PHP_SESSION_UPLOAD_PROGRESS sh,curlorwgetchild processes ofapache2orphp-fpm- new
.phpfiles
If you find signs of a compromise, change all database passwords, API keys and session secret keys. Under Art. 33 GDPR, a personal data breach must be reported to the supervisory authority (Datenschutzaufsichtsbehörde) within 72 hours of becoming aware of it.
If you can't update yet, there are temporary mitigations: memory_limit=-1 and session.upload_progress.enabled=0, followed by a restart of the PHP processes. PHP points out that these measures do not fix the vulnerability and do not make the system secure.
Why all the fuss?
PHP is everywhere. Information about the vulnerabilities leaked before the patch was released, and attack attempts started even before the official security updates came out.
In 2026 we audited hundreds of websites of small and medium-sized businesses. 62% of them run on WordPress, TYPO3 or Joomla — CMSs built on PHP.
Besides websites, companies run internal systems that are reachable from the internet: CRMs, accounting and customer portals. That is why Wiz's estimate that up to 70% of websites may have been at risk looks plausible.
Something similar happened less than a year ago: React2Shell (CVE-2025-55182)
On 3 December 2025, the React team disclosed a critical remote code execution (RCE) vulnerability. It received the maximum CVSS score of 10.0 out of 10.
Websites and web applications using vulnerable versions of React Server Components were at risk, including Next.js with the App Router on React 19.0–19.2.0. Attackers could execute arbitrary code on the server remotely and without authentication, which potentially gave them direct access to it.
That time, attacks began just a few hours after the vulnerability was disclosed.
Will it happen again?
PHP2Shell is not the first, and far from the last, threat of this scale. As technology and automation advance, attacks become ever more accessible. Vulnerabilities are being found faster and faster, and the time between disclosure and the first attacks keeps shrinking.
What actually helps you stay protected?
- Regular updates. We recommend installing security patches within the first hours of their release, without waiting for scheduled maintenance.
- Monitoring and alerts. Suspicious activity needs to be detected right away, not after an incident.
- Someone responsible for security. At Seed Factory we take on all of these tasks: we track vulnerabilities, install updates promptly and, most importantly, keep an eye on the state of your systems to reduce the risks to your data.