Wiz, OpenAI and Calif Disclose Critical PHP2Shell Flaws in PHP Runtime
Both PHP2Shell vulnerabilities are rated Critical at 9.2 on CVSS v4.0 and allow unauthenticated remote code execution, according to dailysecu.com.
Wiz, OpenAI and Calif have jointly disclosed two memory-safety vulnerabilities in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and grouped under the name PHP2Shell, according to dailysecu.com. Both flaws can lead to remote code execution without authentication or user interaction.
The two PHP2Shell issues are classified as CWE-824, uninitialized pointer access, with a CVSS v4.0 score of 9.2, rated Critical. Attack complexity is rated High for both: exploitation requires bypassing built-in mitigations and precise heap shaping on the same Apache worker.
CVE-2026-109618 stems from PHP's handling of out-of-memory bailouts via longjmp(), and was reported by Calif, Wiz, OpenAI and Quarkslab. CVE-2026-109619 stems from fatal-error bailouts that leave global state pointing at freed memory, and was reported by Wiz, Calif and OpenAI.
PHP2Shell is estimated to affect PHP versions from 5.4.0 onward, though not every release was individually tested. Three of the five demonstrated attack techniques use PHP's session upload-progress feature as a remote trigger that runs before application code.
More than 69% of websites with a confirmed server-side language use PHP, according to the article.
Quick answers
What are the PHP2Shell vulnerabilities?
They are two memory-safety flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, classified as CWE-824 with a CVSS v4.0 score of 9.2 (Critical) and capable of unauthenticated remote code execution.
Which PHP versions are affected by PHP2Shell?
PHP2Shell is estimated to affect PHP versions from 5.4.0 onward, though not every release was individually tested.
Who disclosed the PHP2Shell flaws?
Wiz, OpenAI and Calif jointly disclosed them, with Quarkslab also credited on CVE-2026-109618.