The PHP2Shell exploit is being developed by artificial intelligence and provides a tool that uncovers critical RCE vulnerabilities affecting 70% of the Internet.
The web security landscape is moving to a new level, in which artificial intelligence is enabling developers to develop software more quickly, but it’s also reshaping the way in which vulnerabilities are found and demonstrated by security researchers.
Recently, a security study has been released to highlight a major issue with PHP, one of the most popular programming languages on the Internet. The high vulnerabilities that are grouped under the name PHP2Shell, can be used to allow unauthenticated attackers to execute code remotely on vulnerable PHP servers, steal sensitive process memory, and even compromise websites.
Many websites, including WordPress, Drupal, Joomla, and MediaWiki, are written in PHP. The research reveals that there are about 70% of all websites in the world that are based on PHP and this is why taking care of PHP vulnerabilities is of great importance.
The news has implications for any businesses with PHP-based websites and applications that cannot be ignored: there is more to website security than the application layer. The stack of underlying technologies also needs to be monitored, updated, and secured constantly.
What Is PHP2Shell?
PHP2Shell is a set of PHP core engine vulnerabilities that are potentially exploitable to execute code remotely.
Several memory-safety issues were uncovered in the PHP fatal error handling, including out-of-memory issues. Sometimes these errors can cause the PHP state to be left in an uncorrupted or “stale” state from which it could be used again by another request or worker.
The research categorized all the vulnerabilities identified into two CVEs:
- CVE-2026-109618
- CVE-2026-109619
The reported severity reaches CVSS: 9.2 (Critical), placing these vulnerabilities in the critical category.
The PHP2Shell vulnerability is particularly alarming because it can be found in PHP itself and is not restricted to any specific website application or CMS.
This means an organisation may have secure application code, but still be at risk because of its underlying PHP version.
Why is PHP2Shell so serious?
PHP has become a crucial part of the current web environment.
It serves as the backbone of systems such as WordPress, Drupal, Joomla, and MediaWiki, which are used to power some of the largest web applications and content management systems around. A vulnerability in the PHP engine thus can have a much wider impact than a typical application-level vulnerability.
According to the research, almost all PHP versions over the past ten years have been vulnerable to one or more of the found vulnerabilities, and vulnerable releases go back as far as PHP 5.4.
Exploited effectively, an attacker could be able to:
- Perform malicious actions from a distance.
- Secure Control of Affected Servers
- Read the process memory of sensitive PHP processes
- Access credentials (password / authentication token)
- Expose API Keys and Certificates
Modify websites and applications to exploit users. Modify websites and applications to exploit users.
Move away from vulnerable web server to other systems (may be possible)
The researchers have shown pre-authentication remote code execution (RCE) on WordPress, Drupal, and Joomla deployments. Importantly, these applications were used as examples; these CMS platforms themselves are not vulnerable, but rather PHP.
How do the PHP Vulnerabilities work?
The weaknesses lie in the PHP memory management with complex behavior.
1. Upload-Progress Use-After-Free
The first is the vulnerability of PHP’s Session module and the processing of upload progress.
If certain conditions are met, a fatal memory allocation failure may interrupt request processing and cause internal state to refer to memory that has already been released.
A second request through the same PHP worker can then “play with” that stale state.
Researchers were able to use this behavior to create a memory-corruption primitive and weave it into memory-disclosure to show unauthenticated remote code execution.
2. Remote Process-Memory Disclosure
There is another potential problem that can cause memory exposure of the PHP worker.
This is a special vulnerability since an application does not explicitly need to begin a PHP session for an exploit to be triggered. The research showed that the attacker could request memory to be returned via PHP-related processing, enabling the retrieval of this memory.
This kind of information disclosure can be harmful as the process memory can hold sensitive data like:
- Passwords
- Authentication tokens
- API keys
- Certificates
- Application data
3. Fatal-Error Backtrace Use-After-Free
PHP also keeps data of fatal errors.
The study uncovered that it is possible for a global reference to point to memory that has been used in a previous request, if a fatal out-of-memory condition occurs. Another request might refer to that old pointer.
They showed that this technique can be taught to lead to controlled memory corruption and exploited to gain unauthenticated remote code execution against Drupal.
4. OPcache Type Confusion
Other vulnerability is OPcache that stores compiled PHP structures in shared memory.
If an allocation is made during the persistence process, there may be inconsistencies between the process-local state and the shared state. The next worker that uses affected memory slots may then use stale metadata that can point to an object of the wrong type.
This primitive was used by the researchers in an unauthenticated RCE chain against WordPress.
PHP2Shell and The Rise of AI-Assisted Exploitation
The vulnerabilities themselves may not be the most important part of this research, but the increased ease of exploiting them because of AI.
The PHP bugs were present for over 10 years. To turn these bugs into effective exploits, however, required a lot of knowledge of PHP memory management, PHP internal structure, application behavior, memory layouts, and repeated testing.
Traditionally, creating such an exploit would take a very specialized security research team and a considerable amount of time.
AI turns all that on its head.
The research shows that frontier AI Models assisted researchers in analyzing failures, adjusting their approach to the exploitation, testing various configurations, and navigating the complexity of PHP memory behavior.
It’s a significant change in cybersecurity.
AI can lower the Exploitation Barrier
Previously, a vulnerability may have been thought to be somewhat harder to exploit because exploiting it would need:
- Deep reverse-engineering expertise
- Manual debugging
- Extensive experimentation
- Understanding of the properties of complex memory.
- Significant development time
Thanks to some of the AI systems that are capable, some of that complexity can be reduced.
The research calls it an “AI inflection point” in which previously and seemingly impossible-to-exploit weaknesses can become more realistic targets.
This poses a problem for organizations: Security teams might have to expect that complex vulnerabilities can be exploited operationally much more quickly than before.
Why Is Php2 Shell Important for Businesses?
For businesses that have PHP Websites, this incident highlights why it is important to uphold the entire technology stack, and not just the website’s source code.
A website may use:
- WordPress
- Drupal
- Joomla
- Laravel
- Symfony
- Custom PHP applications
- PHP-based APIs
- E-commerce platforms
However, the security of each of these systems relies on the underlying server settings and runtime.
Even if the application is running a secure version, if the underlying PHP version is vulnerable, there may be infrastructure-level vulnerabilities.
That’s why organizations need to have a security-first development and maintenance approach.
How Businesses Can Protect Their PHP Application
1. Update PHP Immediately
On October 21, 2026, the PHP team announced security patches that resolve vulnerabilities in PHP’s memory safety, as announced by the PHP Security Advisory Team. It is advisable for organizations to check their PHP environments and install the necessary PHP security patches as soon as possible.
If an application still works with an outdated PHP version, then this could cause unnecessary security exposure.
2. Audit All PHP-Based Applications
Each environment that contains PHP needs to be identified in businesses.
This is not just the main website; it’s all of the other websites.
Check:
- Production servers
- Staging environments
- Development environments
- Legacy websites
- Internal applications
- APIs
- E-commerce systems
- WordPress installations
- Third-party hosted applications
Older systems are especially significant because they may not be updated when it comes to regular security updates.
3. Review Server and Application Logs
The research indicates that defenders should monitor unusual behaviour that might be a sign of an exploitation attempt.
Examples include:
- Unusual multipart HTTP requests
- Memory-limit errors
- Repeated HTTP 500 responses
- Unexpectedly large or malformed PHP session cookies
- Unexpected PHP worker restarts or churns
These signals are not a definitive sign of exploitation, but they could be used in conjunction with other information to investigate and flag suspicious activity by security teams.
4. Maintain a Regular Patch Management Process
Security updates should not be reliant on people remembering to check for them.
Every organization should have a well-defined patch management process with elements such as:
- Vulnerability discovery
- Asset identification
- Risk assessment
- Testing
- Patch deployment
- Verification
- Continuous monitoring
As AI becomes a catalyst for vulnerability discovery and exploitation, this becomes even more critical.
5. Consider Professional Security Testing
It is recommended to periodically conduct:
- Vulnerability assessments
- Security audits
- Penetration testing
- Code reviews
- Dependency audits
- Infrastructure assessments
- Tests for performance and security
A professional development and security team can work together to identify weaknesses that may not be apparent until it becomes an incident.
Why Secure PHP Development Matters?
Here at Delimp Technology, we’re aware that a website today is not only a website that works.
In addition to the above, a digital product should be:
Secure. Scalable. Performant. Maintainable.
Delimp Technology offers Web development and bespoke software solutions, specializing in developing applications that meet the needs of the business. The company operates in the areas of web development, Mobile Applications, UI/UX, eCommerce, AI, Payments Integration, and other technology services.
We also provide some PHP development services and emphasize security, performance, technology assessment, and maintenance services in our approach to development.
Applicants are advised to think about security as a process for businesses that are using outdated PHP applications, as a one-time development job is not sufficient.
PHP2Shell is a warning for the AI Era
PHP2Shell is more than a collection of vulnerabilities.
It demonstrates how AI can change the economics of cybersecurity.
Complex vulnerabilities could for years lie practically untouchable, as the knowledge and effort to make reliable attack chains were considerable.
Some of that friction can be mitigated with AI.
Defensive applications of this technology are also possible.
AI can assist security teams in the following ways:
- Analyze large codebases
- Identify suspicious patterns
- Discover vulnerabilities
- Automate security testing
- Prioritize risks
- Analyze logs
- Detect anomalous behavior
- Validate security patches
- Accelerate incident response
Thus, offensive and defensive AI’s will compete against one another to become more and more capable in the future of cybersecurity.
Final Thoughts
There is one big lesson to learn from PHP2Shell: The security of software is not complete until after it’s deployed. By exploiting vulnerabilities in PHP’s core runtime, thousands of applications could be open to remote code execution and sensitive data leakage even if the application code is secure. With the rapid advancement of AI in vulnerability detection, businesses need to focus on timely patching, ongoing monitoring, and regular security assessments. For organizations running PHP, it is recommended to upgrade to patched versions and enhance their security measures. Delimp Technology equips businesses with cutting-edge digital solutions, such as web and mobile apps, AI Applications, eCommerce platforms, and custom software, to help them build, upgrade, and maintain their digital solutions.
Frequently Asked Questions
1. What is PHP2Shell?
Ans: A series of critical PHP core flaws have been discovered and dubbed PHP2Shell (CVE-2013-2911, CVE-2013-2912, and CVE-2013-2913) that could allow for a remote code execution attack against PHP systems and memory disclosure on systems vulnerable to the flaw.
2. Which PHP versions do we need to take care of?
Ans: The study reveals that each PHP version since the past decade has been discovered with at least one of the vulnerabilities listed, including versions as far back as PHP 5.4.
3. Does PHP2Shell only affect WordPress?
Ans: No. The demonstration targets were WordPress, Drupal, and Joomla. Vulnerabilities are in PHP and aren’t related to a specific CMS.
4. How can sensitive data be leaked from PHP2Shell?
Ans: Yes. The study showed that some of the vulnerable PHP processes can reveal sensitive memory that might hold passwords, tokens, API keys, or certificates, among other things.
5. What should businesses do now?
Ans: Businesses should determine if any PHP installations are vulnerable, install the PHP team’s security updates, check the relevant logs and monitoring data, and investigate any suspicious activity. The research also indicates that complete remediation is to apply the PHP security update.
