PHP Foundation Releases Emergency Patches for Critical Remote Code Execution Flaws

The PHP development team released emergency security patches on Wednesday to address two critical vulnerabilities that allow unauthorized remote code execution on web servers. The PHP Foundation urged all organizations and individuals running the programming language to prepare for immediate updates.

Both flaws received a Common Vulnerability Scoring System rating of 9.2 out of 10, according to the advisory accompanying the patches. The first vulnerability involves incorrect handling of memory exhaustion, leading to the processing of incomplete data. The second flaw involves the use of outdated information from previous requests after memory release. Together, researchers refer to this combination as PHP2Shell.

Context and Background

Security experts had warned of imminent exploitation even before the patches were distributed. Cybersecurity firm Sansec stated in a blog post that mass attacks were expected to start within 15 minutes of the release. Hackers are likely to analyze the updates quickly to develop automated tools targeting unpatched websites.

Cloudflare reported on Wednesday that the company observed early attack activity related to the vulnerabilities. The firm noted that attackers were developing new methods to bypass existing security protections, prompting Cloudflare to update its own defenses. This rapid response aligns with trends noted in Rapid7’s Q3 2026 report, which found attackers exploit high-severity flaws within days of disclosure.

The PHP Foundation disclosed in a Wednesday blog post that developers had identified signs of an underlying problem in one of the vulnerabilities nearly two years ago, in 2024. The team struggled to agree on a fix that would not create new issues, causing a significant delay in resolution.

Who Is Affected

Security researcher Silas Cutler estimated that roughly 1.3 million internet hosts could be affected by the PHP2Shell vulnerabilities. PHP is widely used by popular website platforms, including WordPress, making the potential impact broad across the internet. Any server running the affected versions of PHP is considered at risk until the emergency patches are applied.

What should you do?

Organizations should verify their current PHP versions against the advisory to determine if they are vulnerable. System administrators should prioritize applying the emergency patches immediately, as automated attacks are expected to begin shortly after release. Monitoring server logs for unusual activity can help detect early exploitation attempts.

What to do and how to stay safe: PHP

• Inventory all servers and web applications to identify which are running vulnerable versions of PHP.
• Apply the emergency patches provided by the PHP development team as soon as they are available.
• Monitor network traffic and server logs for signs of unauthorized access or automated scanning activity.
• Ensure that web application firewalls are updated to block known exploit patterns associated with PHP2Shell.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in PHP that allow remote code execution, involving memory handling and outdated data usage.

How severe are these vulnerabilities?

The PHP team rated both vulnerabilities 9.2 out of 10 on the Common Vulnerability Scoring System, indicating critical severity.

When did developers discover these issues?

Developers identified signs of an underlying problem in one of the vulnerabilities in 2024, but patches were only released on Wednesday.