TL;DR

Pre-auth RCE in default PHP setups: PHP fixed php2shell on Oct. 21, 2026. It abuses how PHP handles out-of-memory fatal errors and works against Apache mod_php and PHP-FPM on common CMS, webmail, and e-commerce apps.

Every secret on the host is exposed: The RCE can potentially allow attackers to read config.php and .env files using the PHP worker's existing permissions. That gives them database, SMTP, cloud, and OAuth credentials to move into systems outside PHP.

What is php2shell and how does it work?

The root cause is how PHP handles a fatal error when a request exceeds memory_limit. The fatal error interrupts the operation in progress and leaves it half-finished: a hash table whose counters were incremented before the new bucket was initialized, or session globals still pointing into memory that request shutdown then frees.…