PHP2Shell blew up: CVSS 9.2, the day before the opening, and the two holes were in code for 10 years.

First, the conclusion is that:PHP produced an unauthorized remote code for CVSS 9.2, numbers CVE-2026-109618 and CVE-2026-109619, with a nickname PHP2Shell. On October 20, it was made public and on October 21st at 1400 UTC patches were released, while Amazon's honey canisters were recorded on October 17 — four days before the opening.

What's worse than that is the other thing: these two holes are the first to get to PHP 5.4, which means...They've been in code for over a decade.I don't know. And in 2024, when the PHP core developer audit discovered OOM's path, the team met to discuss how to fix it.We didn't agree and then we didn't fix it.I don't know. The reason is that no one thought it could really be used.

This phrase now looks particularly ironic. The reason for not being able to do so is not that the hole is insignificant, but that the chain is too complex to go beyond the physical capacity of human researchers. Then AI came and wrote it out.

First, get the word "multinational emergency response" out of the way. Look.

The title party's favorite word is "global alarm." It's not an exaggeration this time, but it's a clear score.

• PHP Official: An advance notice was issued on 20 October, stating that on 21 October at 14:00 UTC would be released in a secure version if the details were leaked or fielded. As a result, the CVE number was stabbed to Hacker News the same day, and the release scheduled for October 22 was forced to a day earlier.
• CERT-EU: release advisory 2026-018 and include both CVEs.
• CloudflareOn October 21st, CTO Dane Knecht directly said "the early attack has been seen to emerge", and the WAF rules were released in full, including free users. But he emphasized himself that it was just stopgap, and the real solution was patching.
• Amazon threat information: MadPot honey cans were caught trying on October 17, and another batch was caught on October 21, and the payload and infrastructure pointed to a number of different attackors. php2shell "is already widely used".
• Watch Towr: Both holes are re-emerged, while attempts to exploit both are observed.

So "the attack has been found" is not a rendering, but a fact. And the Multinational Emergency Response is not a blow -- it's just that the main subjects of the response are manufacturers, CDNs and emergency organizations, not any government in the country.

Two, two holes, two completely different ways of dying.

Many people think it's a hole with two numbers, no. These are two separate routes of attack, each CVSS 9.2.

CVE-2026-109618: Bomb when memory is depleted

The processing of a request is interrupted when the PHP memory distribution fails. The problem is:At this point, the internal request data may have been only half-initialized, and the subsequent clean-up logic would have used this unincorporated piece of bad data as valid data.

The trigger method is simple: construct a multipart request to implode the memory. The weird thing is,The size of the request seems to match your ceiling.It's not the post max size you set up, it's the decodement and the consumption of internal processing.

The worst is mod php. Mod php for Apache when requesting startup failedIt's still going to clean up., so this chain can be completed before any applicable code runs. Your PHP code is so clean, there's no loophole, there's no stopping it.

PHP-FPM will kill the worker when it fails to start, just to cut the chain, so officially, mod php is the highest risk. But pay attention -- this doesn't mean that the FPM is safe.After successful startupThere is still a possibility of exploitation.

CVE-2026-109619: Dirty state between requests

This one's worse. PHP will reuse the worker process to process multiple requests. The last request to release the memory, the pointer remains in the internal state; the next request comes in,Read the blank address before normal initialization.I don't know.

Fatal errors (depletion of memory, performance timeout) interrupt state clean-up. Even worse, some non-lethal diagnosis during the shutdown would have replaced the wrong state.Redo it.I don't know.

Officially confirmed pathways include: RCEs with fatal error when PHP 8.5 enabled Fatal error backtraces (default opening), and the session life cycle RCEs on motor php and FPM.session.upload_progress By default, you can act as an early consumer in a state of filth.And there's no need to apply call(s)I don't know.

This hole is still attached.Memory leakI don't know. What was leaking? is the password, token, API key, certificate for other requests in the process memory. Wiz directly compared to Heartbled, which is not too much.

Timeline, more than title Look.

Time	What happened?
Year 2024	PHP core developer audit found OOM, that bug, the team had no consensus on the law, put it on hold.
2026-08	Ryan Austin of Calif identifies loopholes with OpenAI GPT-5.6 Sol; Wiz Independent Discovery
2026-10-17	Amazon MadPot, the honey can record an attempt, four days before the opening.
2026-10-20	CVE number leaked in Hacker News and Social Media, PHP
2026-10-21	14:00 UTC Publication 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

October 17th must be singled out.The public day was the 20th, but the attack took place on the 17th.The Amazon proposal is straightforward: the starting point should not be on the disclosure date, but forward to at least 17 October.

As to how the attackers got the information in advance, the Amazon said "not clear." I can't go into this, but you have to accept a reality.The disclosure day was never the day of the attack, but the day you finally knew.

Four, this time it's really AI.

Wiz’s blog contains a sentence that I have read twice: “These underlying flaws have existed for decades, but to prove that they can be used, they need an exceptionally complex chain of steps, on the margins of the actual capabilities of human researchers.Frontline AI model significantly lowers this threshold.I don't know.

Specific: Ryan Austin, a researcher in Calif, was found in the OpenAI project "Patch the Planet" with GPT-5.6 Sol. Wiz found the same problem independently. In order to make use of it, we need a chain of faults and target each target.Memory layout repeatedly calibratedWiz says the front-line model allows them to develop usable applications for different applications within hours.

It doesn't mean "AI won again".The point is that the moat of "complex" is failing.

Many old loopholes have not been beaten in the past two decades, not because they are not serious, but because the threshold of utilization is too high — a few weeks of investment by top researchers and a bit of luck. So you put them in the "theoretically risky" column. Now this fence is gone.

Those ten-year-old holes that lie in your system and are assessed as "difficult and unprocessed" have to be re-rated.

Five, which one should you go to?

Branch	Affected version	Disposal
PHP 8.5	< 8.5.12	Raise to 8.5.12.
PHP 8.4	< 8.4.27	Raise to 8.4.27.
PHP 8.3	< 8.3.36	Raise to 8.3.36.
PHP 8.2	< 8.2.35	Raise to 8.2.35.
PHP 7.4 / 8.0 / 8.1	All	Officially unpublished, source level only
PHP 5.4 – 7.3	All	EOL, the government doesn't fix it. Business

Several real-life reminders:

• Linux Release and LTS VendorGot a patch in advance.Check your manufacturer's advisory with a distribution package. Don't rush the source code.
• Use rpms.remirepo.net Note: PHP officially stated the source on October 21st.No updateSo you can switch to a distribution package or make it from the source code.
• The Windows binary of PHP 8.5 is also on the official download page.
• Don't think it's okay to run in the container -- the PHP version of the container mirror has to be checked.

Six, if you can't get a patch, make these four first.

First state:None of these below will make you safe.The official PHP phrase is "reduce exposure to specific attack paths, but do not make installations safer". Their value is to give you time to get patches.

Set memory limit to -1

Purpose: To take out the predictable PHP memory cap failed, i.e. CVE-2026-109618 has confirmed the trigger condition on which it depends.

The point is,How?: to be set in places where application is unaltered, such as the FPM Pool php_admin_value or Apache Configuration. You must check that there are no pops, directories, application settings to add the limit back.Then restart every worker.

The price is clear: you're off the PHP's own memory fence, and the bottom distribution failure may still be on that dangerous path. So it's got to be a container or a cgroup to limit the cover -- but it's only a strategy to "kill affected people."Never use RLIMIT AS or RLIMIT DATAThose two are precisely the kind of distribution failures that create the loopholes.

Reduce post max size

Sites without file 8M to file 32M and guaranteed upload_max_filesize Less than it. At the same time, limits are added to the web server or proxy layer - the volume of requests decoded, the number of fields, the number of multipart parts, the number of heads, the depth of nests.These restrictions must cover requests that are not valid Content-LengthOr we'll go around it.

3. Turning off session.upload process

session.upload_progress.enabled = 0

It is written in php.ini, FPM tool or server configuration.It has to be effective before the request.I don't know. Use ini_set() Or FPM. .user.ini It was too late -- it was dirty. Change is also to restart all workker.

PHP 8.5 One more single

fatal_error_backtraces = 0

This block only confirmed fatal error backtracks, with no other variants. Also require administrator level settings + restart workker.

In addition, the official mention that many will ignore:Fix the fatal errors that the attackers can trigger and execute time out., including back-up, upload, import processing, clean-up failures. And...Delete outdated or illegal configurations imposed on a request-by-request basis- They spit out diagnostic information before it's initialized and feed the leak.

This last sentence is most easily misunderstood:It doesn't work to hide the diagnosis with error reporting, display errors or @.It's not happening.

VII. REAL LESSONS OF THIS

I don't want to finish by writing "Close the patch." Of course it's a patch. It's today. But some judgements have to change.

1. The term "difficult to use" is no longer the same as "prescribed".PHP this hole's access chain is complicated enough to need the help of AI, which has already helped. The old holes in your asset list that mark "theory risk" should be re-rated.
2. Language runs at a single point.WordPress, Drupal, Joomla, Magento, MediaWiki all run on PHP, your application code audit is clean, and the PHP core is in trouble. Compensatory rhythm of infrastructure layers, with application layers separated.
3. "The application code is broken without running." WAF can only delay.Cloudflare himself said it was stopgap. Putting WAF as a solution equals giving life to rule coverage.
4. There are a lot of old sites in the country using PHP.Those stations that run on PHP 5.6/7.0, which were long ago unmaintained and hanged on a cloud mainframe, are in this exposure of 1.3 to 1.9 million. They will not receive any notice.

Data calibrations are recorded: W3Techs says PHPs account for 69.3 per cent of the languages known to the service, and Wiz 70 per cent; exposure hosts, the security researcher Silas Cutler estimate over 1.3 million, and Henk Poley ' s Shodan search is over 1.9 million. These numbers are of different calibres and do not use them as precise values, but the scale is the same -Millions, globally.

One more detail is worth remembering: when the CVE number was leaked, the CVSS points that came out were 10.0, PHP was officially confirmed.That score was wrong.It's actually 9.2. No one would know anything about this detail, but it will always be in circulation. Seeing 10.0, you know what wave it is.

A 10-year hole, two months of AI-assisted research, four days of early utilization, one-day patch window. This timescale is the normal of all the basic software that follows.

Check the version now.php -vOr look at your container mirrors at tag. Don't wait for tomorrow.