PHP2Shell: two critical PHP flaws, an embargo that leaked, and what is actually known about exploitation

What this video covers

• Both flaws are rated 9.2 on CVSS v4.0 by the PHP team. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 7.4, 8.0 and 8.1 received source patches only. PHP says updating is the only complete mitigation.
• The first flaw comes from PHP leaving a request half built when it runs out of memory at the wrong moment. The second comes from a leftover pointer to one request's memory that a later request in the same worker can use. On Apache with mod_php the first path runs before application code.
• A PHP core developer found the first signs of the memory problem during a 2024 audit. The PHP Foundation says competing fixes had trade-offs and a consensus-based security team struggled to choose, which it calls a structural failure.
• The Foundation says the CVE IDs leaked on October 20, Calif mistakenly published a proof-of-concept video, and Chainguard published built images with the fix more than six hours before the release. Chainguard's CEO says people were already being hit and that he found the bugs independently.
• Sources disagree on exploitation. Amazon logged an attempt on October 17 and later said PHP2Shell was broadly exploited. watchTowr reported exploitation in the wild. CISA had not observed exploitation at publication, and the PHP team found no functional exploit at release. Many public proof-of-concept scripts are reported not to work.
• Check every place PHP runs, including copies inside other software, update, restart workers and review logs back to October 17.

Transcript

Who tried PHP2Shell four days early?

0:00 A security embargo is supposed to keep a bug quiet until the patch ships. Amazon logged an attempt against PHP's critical bug four days early. In this video, who found it? How did the embargo leak? And how bad is it, really? And the company blamed for the leak has a defense I did not expect. I will get to it. It's Thursday, October twenty second, and this is The Daily Diff.

0:21 PHP is a scripting language that builds web pages on the server just before they reach you. It is over thirty years old and, by one estimate, runs about seventy percent of websites, including WordPress and the software behind Wikipedia. Developers love to mock it, usually from a page PHP is serving them. Its upkeep is a nonprofit with about thirteen engineers.

What are the two PHP2Shell bugs?

0:41 On Wednesday, PHP shipped emergency fixes for two critical flaws that let a stranger run code on a server with no login. Together they are called PHP2Shell, and they reach back to PHP five point four. Here is the first bug in plain words. PHP gives every request a memory budget. If a request hits that limit at exactly the wrong moment, PHP bails out in a hurry and leaves the request half built. Then the cleanup step trusts the half-built thing.

1:07 The second bug is a leftover. A fatal error can leave a note pointing at memory that belonged to the last request. The same worker handles the next request and follows the note. By then somebody else lives at that address. On Apache with mod PHP, the damage happens before your own code runs, so your login page never gets a vote. Wiz says even a hello world script is exposed. The fix removes PHP's emergency exit for running out of memory.

1:32 Instead of bailing out mid-request, PHP now stops politely at the next safe point. The odd part is how old the first clue is.

Why did a known bug wait two years?

1:39 In 2024, an outside security audit led a PHP core developer to the first signs of the memory problem. No exploit was known, and every fix broke something. A team that decides by consensus could not choose, so the bug waited. Then in August, finders arrived within days.

Who found PHP2Shell, and how?

1:56 Calif researcher Ryan Austin found it on August first, working through OpenAI's Patch the Planet program. OpenAI reported the same root cause independently. Wiz found variants a few weeks later with Gemini and GPT models. Austin says he used models anyone can get, plus a theory about where PHP's old bugs hide. OpenAI says frontier AI was the key. The bug had hidden for more than a decade. The release was planned for Thursday.

How did the PHP2Shell embargo leak?

2:21 On Tuesday, the two CVE numbers began circulating online, with a wrong release time and a wrong score of ten. PHP pulled the release forward a day. That evening, Calif accidentally published a video of its proof of concept working, and copies outlived the deletion. On Wednesday morning, more than six hours before the release, Chainguard published built images containing the fix. PHP says any attacker could study that fix while everyone else waited.

2:46 A patch is also a diff, and attackers read diffs.

Is PHP2Shell being exploited, and by whom?

2:50 So who is actually being hit? Amazon's honeypot logged an attempt on October seventeenth and later said PHP2Shell is broadly exploited. watchTowr reports exploitation in the wild. Cisa said it had not observed any when it published, and PHP's team saw no working exploit at release. Cloudflare's CEO said it saw thousands of attempts in the ten hours before the announcement, and millions by Thursday morning.

3:13 Amazon is careful on one point. It does not know whether its earliest attempts would have worked on a real system. An attempt is only a knock on the door. So how bad is it, really? watchTowr says the public exploits flying around mostly crash or do nothing. VulnCheck says code execution works in some setups, and none of the public ones beat memory randomization on standard x86 servers. Researcher Elias Taylor says it is nowhere near as easy as Log4Shell.

3:40 Everyone still says patch. Governments did not wait for the verdict.

What did governments take offline?

3:44 The NSA told organizations that could not patch to take PHP systems offline, and the UK's National Cyber Security Centre gave similar advice. Dutch sites, including the national digital identity service, went dark, along with a Paris police site. Wikimedia took several systems down as a precaution. Palo Alto Networks counted more than twenty two million exposed instances. And an Australian professor made the sharpest point. The sites to worry about are the ones not down today.

Which PHP versions get a fix?

4:11 Fixes exist for PHP eight point two through eight point five. For seven point four, eight point oh and eight point one, PHP published source patches only. Older versions get nothing from the PHP project, so ask your distribution. Workarounds shrink the odds, but PHP says updating is the only complete fix. It is the same lesson as yesterday's eMudhra episode,

What do you do about PHP2Shell tonight?

4:32 because a fix existing is not the same as the running process having it. Find every PHP in your stack, even the copies hiding inside other software. Update, restart the workers, and check logs back to October seventeenth. The same day, GitLab shipped a critical patch release,

What else shipped a critical RCE patch today?

4:47 nineteen point five point one. An integer overflow in its regular expression compiler lets an unauthenticated user run code on the server, and it scores ten out of ten. GitLab dot com is already patched. Self-managed installs need the update.

Why was Meta ordered to pay $25 billion?

5:01 Meanwhile in New Mexico, a judge ordered Meta to pay twenty five billion dollars in penalties over Cambridge Analytica. The jury counted more than forty three million violations at up to five thousand dollars each, which came to about two hundred twenty billion before the judge cut it. Meta says it will win on appeal. Now the defense I promised.

What is Chainguard's defense for the early fix?

5:19 Chainguard's CEO told The Register he found the same bugs himself on a Friday night, after learning something was coming in PHP, with a basic prompt to find bad vulnerabilities. He says he shipped early because people were already getting hit. If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below. So today's verdict is SHIP IT.

What gets the SHIP IT stamp?

5:39 Ship the PHP update tonight, because the new version number is the only complete fix. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. Today's PHP Security Release, and How We're Strengthening PHP SecurityThe PHP Foundation
2. RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)PHP security advisory
3. RCE via stale global state (GHSA-6wmf-4rv5-p3rp)PHP security advisory
4. Upcoming Critical PHP Security Releasephp.net
5. php2shellCalif
6. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the InternetWiz Research
7. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPotAWS Security Blog
8. Critical Vulnerabilities in PHP Require Immediate PatchingCISA
9. Flaw in PHP computer language leads to shutdown of websites around worldThe Guardian
10. What is PHP, and how bad is the computer language flaw causing website shutdowns globally?The Guardian
11. PHP2Shell Exploitation Started Days Before PatchesSecurityWeek
12. PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619Tanium
13. There isn't an easy exploit for this PHP vulnerabilityElias Taylor
14. PHP blames supply chain security biz Chainguard for putting entire web at riskThe Register
15. PHP2Shell: 22M exposed servers at risk as emergency patches releasedTechTarget
16. PHP ships emergency patches for critical PHP2Shell flawsBleepingComputer
17. GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab
18. Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica caseCNBC
19. Tell HN: 2x PHP RCE CVEs with CVSS 10.0 IncomingHacker News