PHP2Shell: Critical PHP Flaws — What to Do Right Now

Confirmed or well documented

• Two flaws in the PHP core itself, not in WordPress, Shopware or a plugin
• Both rated CVSS v4.0 9.2 (critical) by the PHP security team; the "10.0" circulating online did not come from the PHP team
• According to security researchers, both lead to remote code execution on the server
• Going by CERT-EU's reading of the CVSS vector, likely exploitable without authentication
• watchTowr says it has reproduced CVE-2026-109618
• As of the morning of October 21, neither Huntress nor watchTowr reports in-the-wild exploitation

Still open

• Exactly which versions are affected: reports range from "PHP 8 only" to "everything from PHP 5.4"
• Which component and attack path: one report mentions a use-after-free, unofficial reconstructions point at multipart uploads — both unconfirmed
• Whether specific setups (PHP-FPM, mod_php, CGI) are a precondition
• Whether the CVE IDs are final: they come from security vendors, not from the php.net announcement

The patch is the manual

Once the fix is published, comparing it with the old code shows where the flaw is. AI models read such diffs, explain the cause and write first exploits in a fraction of the time a human would need. That is why Sansec expects attacks after 15 minutes rather than weeks.

AI finds the flaws itself

Calif.IO, credited with the PHP2Shell tool, does AI-assisted vulnerability research and published a 21-year-old flaw in PHP in May 2026. Whether PHP2Shell was also found with AI is not known. But the direction is clear: code that humans overlooked for decades is now being searched systematically — by defenders and attackers alike.

Attackers already use it

In May 2026, Google's Threat Intelligence Group reported the first zero-day exploit in a criminal campaign that was very likely developed with AI. The Cloud Security Alliance documents a flaw in an AI agent framework that was exploited just under four hours after disclosure.

The patch drill

How long does it take you from the warning to the last patched system? We measure it against a realistic scenario: who hears about it, who decides, which systems get forgotten? For most companies the honest answer is days — attackers need minutes.

What happens after the shell?

An RCE flaw is only the way in. What matters is what an attacker can reach as the www-data user: database credentials in the configuration, the cloud metadata service, the internal network, the backups. An assumed-breach test answers exactly that — we start where a web shell would land.

The outside view

Which of your systems reveal their PHP version in the X-Powered-By header? Which staging instance has been running PHP 7 for years? Which subdomain has everyone forgotten? This is exactly how attackers pick targets for the first wave — automated, across the whole internet.

Outbound traffic

A reverse shell needs a connection out. If your web server can reach any destination on the internet, every RCE is immediately fully usable. A pentest checks whether egress filtering and network segmentation actually work.

See

Attack surface monitoring

Free initial check, then continuous monitoring from €249 per month. We report what has newly become reachable — not the same inventory every month.

Test

Penetration test

Manual testing of web applications, APIs and cloud from €3,500 — including how far an attacker gets after code execution on the web server.

Attack

Red Teaming Starter (external)

Fixed price €2,500. An expert attacks from the outside with AI assistance, just like the first automated attack wave after a leak. Optional retest €300.