Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
On October 21, 2026, PHP disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could enable remote code execution, though no successful exploits have been observed in the wild.
The vulnerabilities, dubbed PHP2Shell, potentially allow unauthenticated threat actors to achieve remote code execution (RCE) under specific conditions. CrowdStrike Counter Adversary Operations has not observed successful exploitation in the wild or within honeypot environments, nor have they identified any fully weaponized exploit capable of widespread exploitation.
Affected Versions
The vulnerabilities impact PHP versions earlier than 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Preliminary analysis suggests many older versions, including end-of-life PHP versions, are also affected and may receive limited patches.
Technical Barriers
Exploiting these vulnerabilities requires adapting proof-of-concept code for specific PHP versions and applications like WordPress. This adaptation presents a meaningful barrier as exploit developers must use identical versions of Docker containers, packages, and other elements used by targeted applications.
Many of the ones CrowdStrike Counter Adversary Operations has analyzed are crash POCs that only prove a vulnerability exists; converting them to a reliable POC exploit capable of reliably achieving RCE is not trivial or guaranteed.
Vulnerability Details
CrowdStrike identified three distinct flaws: CVE-2026-109618 (partial hashTable insertion), and CVE-2026-109619 (persistent serialization-context use-after-free and session-global use-after-free). These vulnerabilities relate to how PHP handles memory during request processing, particularly when fatal errors interrupt normal operations.
Current Threat Landscape
Threat actors have several alternative vulnerabilities capable of achieving unauthenticated RCE against many PHP applications. Many opportunistic actors may currently favor proven effective exploits rather than attempting to leverage PHP2Shell, which requires overcoming significant technical challenges.
The widespread attention surrounding PHP2Shell will likely incentivize both threat actors and security researchers to discover additional PHP vulnerabilities in the near future. However, advanced threat actors may attempt to exploit these vulnerabilities against high-value targets where alternative methods are less feasible.
Related
