PHP2Shell is the informal name for two critical pre-authentication remote code execution vulnerabilities in the PHP engine itself. Both were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are rated CVSS 9.2 (v4.0) / 9.8 (v3.1) and affect every PHP version from 5.4 through 8.5.11 that has session.upload_progress.enabled turned on (the default).

The bugs sit in core request handling, so they work before any application code runs. WordPress, Drupal, Magento, Laravel, Joomla and plain PHP scripts are all in scope.

The two root causes

CVE-2026-109618 – RCE via OOM corruption

When PHP hits its memory limit during multipart form parsing it used longjmp() to abort. That left partially initialised request data (especially HashTable buckets and session globals) still reachable. Request shutdown then treated the half-built structures as valid, opening a use-after-free window.…