{
  "id": 16519191,
  "title": "Your app was patched. Your PHP was not: PHP2Shell explained",
  "url": "https://urgent.news/2026/10/25/your-app-was-patched-your-php-was-not-php2shell-explained",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T20:57:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kashif_manzer/your-app-was-patched-your-php-was-not-php2shell-explained-3de7"
  },
  "original_language": "en",
  "account": "On October 20, 2026, the PHP security community received early warning of two critical vulnerabilities. Rather than waiting for the planned disclosure, PHP released patches on October 21, sparking the term \"PHP2Shell\" to describe the incident. These flaws, CVE-2026-109618 and CVE-2026-109619, are fundamentally different from vulnerabilities in WordPress themes or plugins. Instead, they affect the underlying PHP runtime that powers websites.\n\nThe vulnerabilities allow attackers to execute arbitrary code on vulnerable web servers without authentication. This is possible because the bugs in PHP's handling of memory during request processing can be exploited. One flaw occurs when PHP encounters an out-of-memory condition during the creation of request data. Another flaw occurs when request-specific state is not properly reset after memory is freed.\n\nWhat sets PHP2Shell apart from many other vulnerabilities is that updating the application code (like WordPress) does not fix the issue. The application code remains unchanged, but the underlying PHP runtime has a known vulnerability. This is why many security advisories emphasize that \"updating your app does not update PHP.\"\n\nFinding affected PHP installations can be challenging because PHP is often embedded within other software and may not be immediately apparent. It's common to find PHP hidden within Docker images, vendor software, or shared hosting accounts. To locate these installations, a comprehensive inventory of all systems and servers must be created. Each system must be checked for the PHP version it uses, as multiple PHP versions can coexist on a single server.\n\nThe recommended fixes are to install the patched versions of PHP corresponding to the branch you are currently running. However, it's crucial not to jump branches hastily, as this might introduce new issues. Restarting all PHP workers is essential after applying the patch, as the old, vulnerable code remains in memory until the worker restarts.\n\nFor those running PHP 8.1 or earlier, there are no official patches available. These versions have reached end-of-life, and the only viable solution is to upgrade to a supported branch or take the system offline until a patch can be applied. This stark reality underscores the importance of maintaining up-to-date PHP installations, as failing to do so can leave websites and applications exposed to significant security risks.",
  "summary": "On Monday, October 20, 2026, the secret got out early. Details of two critical PHP flaws leaked before the planned disclosure. The PHP team moved its security release up a day and shipped the fixes on Wednesday, October 21. That rushed week has a name now: PHP2Shell. It is not a WordPress plugin bug. It is not a theme bug. It is a flaw in PHP itself, the runtime underneath all of those things. If…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "ZDNet",
        "title": "PHP2Shell: Haven’t patched yet? Take these steps now to mitigate",
        "url": "https://urgent.news/2026/10/23/php2shell-havent-patched-yet-take-these-steps-now-to-mitigate",
        "published": "2026-10-23T15:09:47.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}