PHP2Shell: unauthenticated RCE hits ~70% of the web — patch now
Memory-safety bugs let anyone run code on almost any PHP version. Patches shipped, attacks are live, a third RCE has no fix — and AI dug them up.
Copy markdown
One request, no login, code on your server
CVE-2026-109618 and CVE-2026-109619 are memory-safety bugs in how PHP handles fatal errors — an unauthenticated attacker can run code or read live process memory. Every PHP release back to 5.4 is affected (PHP powers ~70% of all websites), and Wiz demonstrated working RCE against the latest WordPress, Drupal, and Joomla. CVSS reaches 9.2.
Patch matrix — and attacks are already live
PHP shipped emergency fixes on Oct 21: upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Exploit attempts in the wild began the same day, so treat any unpatched host as compromise-pending. If you run WordPress or Laravel, bumping your base PHP image is tonight's job.
Update: a third RCE surfaced Oct 23, still unpatched
CVE-2026-115560 is a separate code-execution path PHP disclosed two days after the emergency release, with no fix yet — it ships in the next routine bugfix. It only bites a narrow config (session.serialize_handler switched to php at runtime with upload progress enabled); set session.upload_progress.enabled=0 to shut it now.
AI compressed months of exploit work into a week
Wiz credits the find to Wiz Atlas plus Gemini 4 Argon and GPT-5.6 Sol, which helped discover the bugs, build exploits, and port them across PHP versions and memory layouts — one researcher doing in about a week what the team says would once have taken a world-class crew months. The same speedup runs for the other side.