Palo Alto Networks Unit 42 disclosed two critical remote code execution flaws in the PHP core interpreter on October 29, 2026. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and grouped under the name PHP2Shell, each carry a CVSS 4.0 score of 9.2. According to Unit 42 telemetry, more than 22.6 million exposed instances could be vulnerable.
The flaws live in PHP's error-handling path. CVE-2026-109618 stems from out-of-memory handling via longjmp() that leaves request memory only partially initialized, giving attackers a reliable route to remote code execution through crafted OOM triggers. CVE-2026-109619 is the nastier twin: the same longjmp() fatal-error path leaves a global pointer referencing freed memory, and that dangling reference can be read or branched on during a later request, letting an attacker run arbitrary code.
PHP powers a large share of the web, from small WordPress sites to enterprise content management systems. That ubiquity is the real problem here. A bug in the interpreter itself cannot be fixed by patching an application or a plugin; every site running an affected PHP build inherits the risk until the host upgrades.
What PHP2Shell Actually Does
Both flaws abuse the way PHP recovers from fatal errors. When memory allocation fails, the engine uses longjmp() to jump out of the failing path. The jump skips cleanup steps that the code assumed would run. In CVE-2026-109618, that skipped cleanup leaves request-scoped memory half-initialized, so an attacker who can force an OOM condition controls what gets read next. In CVE-2026-109619, the jump leaves a global pointer aimed at memory that has already been freed, and a subsequent request can reuse that memory with attacker-controlled data.
The practical result is unauthenticated remote code execution on a vulnerable server. No login is required, and the attack can be chained with other bugs. Dream Research reported a campaign that combined PHP2Shell with a Linux kernel privilege-escalation flaw to gain root access on Palo Alto Networks PAN-OS management interfaces exposed to the internet.
Unit 42 initially reported post-compromise activity at a European government agency that it believed was PHP2Shell exploitation, then retracted that claim on October 25. The retraction matters. It means defenders should not assume every PHP-related intrusion traces back to these two CVEs, and it shows how quickly attribution can shift during an active incident.
Who Is Exposed and How Bad It Is
Cortex Xpanse identified over 22.6 million exposed instances potentially vulnerable to the two CVEs. That number reflects exposed services seen in Palo Alto Networks telemetry, not confirmed compromises, and it is almost certainly an undercount of total PHP deployments behind firewalls. The PHP Group released emergency security updates on October 21, 2026 for supported PHP 8.x branches, and CISA urged immediate patching the same day.
Palo Alto Networks said only about 0.02 percent of its global installed base had internet-facing management interfaces configured and were affected. Each of those customers was contacted directly. That is a small slice, but it is the slice that matters most, because exposed management interfaces are exactly what an unauthenticated RCE bug needs to become a breach.
The broader risk sits with shared hosting and unmanaged servers. Those environments often run outdated PHP branches and cannot apply emergency patches quickly. A single vulnerable host on a shared node can become a foothold for an entire tenant pool. Hosting providers who run multi-tenant PHP pools face a compounding problem: one unpatched node can expose every customer site on it.
What Defenders Should Do Now
Patch first. Apply the PHP Group's October 21 updates on every supported 8.x branch, and verify the running version with php -v after restarting the web server or PHP-FPM pool. Restarting is not optional; a loaded interpreter keeps the old code in memory. Many administrators patch the package but forget to restart the worker pool, leaving the vulnerable binary resident.
Then reduce exposure. Remove public internet access to management interfaces, restrict them to trusted internal IP addresses, and audit which servers actually need to be reachable from outside. Cortex Xpanse and similar asset-discovery tools can find forgotten instances that no one remembers deploying. Inventory is the boring step that determines whether patching actually covers the estate.
Detection should focus on the consequence, not the exploit. Unit 42 published Cortex XDR hunting queries that look for shells spawned under PHP worker processes, web service accounts running recon commands, and payload downloads initiated by web server processes. Those signals are generic enough to catch other web application exploits too, which is a feature, not a limitation.
The Bigger Pattern
Two interpreter-level RCEs in one month, both rated 9.2, is not a normal cadence. It suggests the memory-management code in PHP's error path had not been fuzzed or reviewed against adversarial input in a long time. The PHP Group's emergency release cycle worked, but the fix arrived after public disclosure and active exploitation had already begun.
For teams running PHP in production, the lesson is boring and durable: keep the interpreter on a supported branch, automate patching, and treat the web server as a hostile execution environment. The PHP2Shell details are in Unit 42's threat brief and CISA's alert. CISA also maintains a Known Exploited Vulnerabilities Catalog worth checking against your own asset inventory. See also our desk coverage and archive.
The numbers alone do not capture the operational pain. Shared hosting providers have to coordinate restarts across thousands of customers, and many still run end-of-life PHP branches that will never receive this patch. For those operators the only real fix is migration, which takes months, not days. That gap between disclosure and remediation is where PHP2Shell will do its damage.
What remains unclear is how many of the 22.6 million exposed instances have actually been patched. Telemetry cannot answer that, and internet-facing PHP servers are notoriously slow to update. If even a small percentage remain unpatched through the next quarter, PHP2Shell will keep showing up in incident reports long after the headlines fade. The practical advice has not changed since the October disclosure: patch, restart, reduce exposure, and hunt for the shells that follow.