PHP2Shell update: the patches are out, but patching is only half of the job.
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution. The details leaked before the fix did, and exploitation attempts followed fast.
What is amazing is how it was found. None of the building blocks were a secret. Out-of-memory weaknesses and longjmp() cleanup problems were known territory, and in a 2024 audit it had been flagged; And the weakness without proving it exploitable.
What AI added wasn’t any new knowledge, it was synthesis. It chained those known pieces into a working remote code execution path in hours, something human researchers couldn’t get there on for close to a decade.
This is the shift we live in today: the attacker’s advantage used to be the effort of connecting the dots. That effort is collapsing.
If you run PHP, or WordPress, Drupal or Joomla on top of it:
— Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
— Restart PHP-FPM or your web server, because updated packages don’t replace code already loaded in memory
— Watch for odd child processes spawned by PHP workers
In my last post I said a web shell inherits whatever the web server can reach. Patching closes this door, but the next bug will arrive faster than the last one. Containment is what decides how bad that day will become.
If PHP is compromised tonight, what can it touch?