Skip to content
xplainio
All films

Web security

php2shell: what the two flaws were, and how they got fixed

On 20 October 2026 two CVE numbers started circulating before PHP was ready to publish them. What the two flaws were, where each came from, who was at risk, and what the PHP core team published about itself afterwards.

Runtime
8:01
Claims checked
13
Sources
14
  1. 0:00The numbers get out, and what went dark
  2. 1:09Update now, and which release is yours
  3. 1:42What a CVE number is
  4. 2:31Where each of the two flaws comes from
  5. 4:14Who is at risk, in PHP's own words
  6. 5:08The gap, and what the core team published
  7. 7:35Credits and sources
Runtime
8:01
Severity score of both flaws
9.2
Files changed by the fix
402
Fact-check findings, all fixed
27

The story in brief

The fix already existed. For about a day, the numbers were public and the patch was not.

From the audit to the release
  1. 12024: an external audit turns up the first signs
  2. 217 Oct: an exploit attempt in Amazon's honeypots
  3. 320 Oct: the CVE numbers get out
  4. 4PHP pulls the release forward a day
  5. 5Chainguard ships fixed images 6 hours early
  6. 621 Oct: 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Flaws, both unauthenticated remote code execution
2
CVSS v4.0 score of each
9.2
Internet-facing instances potentially vulnerable, by Palo Alto's count
22.6M+
Days between the first exploit attempt and disclosure
4

Sites whose server-side language is known

  • PHP70%
  • Every other language30%
Source: About 70% run PHP, by W3Techs. The denominator is sites with a known server language, not the whole web.

Two bugs, one ending

Both let a request that never logged in reach memory it was never meant to touch.

CVE-2026-109618: running out of memory
  1. 1A request hits its memory limit
  2. 2PHP bails out mid-build
  3. 3PHP's own bookkeeping is left half built
  4. 4Cleanup treats it as finished
  5. 5A pointer that was never filled in is followed
CVE-2026-109619: memory already handed back
  1. 1A worker takes a request
  2. 2A fatal error leaves state pointing at freed memory
  3. 3The same worker takes the next request
  4. 4That request reaches the freed memory first

What we verified

Every claim the film makes, where it comes from, and how far the source lets it go.

Claim in the filmSourceHow far it goes
Two flaws, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2 and unauthenticated remote code executionGitHub security advisories; NVDThe 10.0 that circulated before release was wrong
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 Octoberphp.net release notesA distribution's fixed build can keep an old version number
109618: an out-of-memory bailout can leave request data half built, and cleanup then treats it as validGHSA-w8hw-w9fx-j79w; the fix commitThe bug class and the fix only; no exploit steps
109619: state left pointing at freed memory can be reached by a later request on the same workerGHSA-6wmf-4rv5-p3rpNeeds two requests on the same worker
Every PHP installation serving web requests should check; Apache with mod_php is highest risk, with a demonstrated exploit before any application code runsphp.net security advisory, 21 Oct 2026On the list is not the same as equally exploitable
Over 22.6 million internet-facing PHP instances potentially vulnerableUnit 42, Palo Alto NetworksTheir telemetry, not a census
An exploit attempt in Amazon's honeypots dated 17 October, four days before disclosureAmazon Threat IntelligenceAn attempt, not a confirmed compromise
Chainguard published fixed images about 6 hours before the release; the Foundation said that disregarded weeks of workThe PHP Foundation, 21 Oct 2026Chainguard's reason, reported exploitation, is kept beside it
The class was seen during a 2024 audit; competing fixes stalled, and the core team called the delay "a structural failure"The PHP Foundation, 21 Oct 2026Their own words, quoted
PHP runs about 70% of sites whose server-side language is knownW3TechsKnown server languages only, not the whole web
Wikimedia's tool servers went offline, and government sites in the Netherlands, Finland and France went downWikipedia's running account, citing Reuters, BBC News, The Brussels Times and the NCSCThe thinnest-sourced part of the film
The NCSC, the NSA and CERT-EU said patch now, or consider going offline until you canNCSC; CERT-EU 2026-018; Nextgov for the NSAThe NSA guidance is as reported
The fix is one commit changing 402 filesphp/php-src commit 506e87fa7dPrimary

What we left out, and why

  • How to exploit either flaw

    No exploit steps and no proof of concept. The film explains the bug class and the fix, never how to build the attack.

  • Who found the flaws, and that both teams used AI models

    Held for a later film. This one stays on the leak, the flaws and the gap.

  • Configuration mitigations

    They narrow the exposure but do not close it. Only the patch is complete, so the film says update.

  • A shutdown on the cover

    The Dutch, Finnish and French outages rest on one aggregated account, so no thumbnail puts them up front.

How it was made

Research
Primary sources, then an outside checkEvery claim comes from PHP's advisory, the Foundation's post, the two advisories or the fix commit. An external fact-check raised 27 findings; every source was re-fetched and all 27 were fixed.
Story
Seven beats, one chainWhat got out, what to do now, what the numbers are, where each flaw comes from, who is at risk, the gap, and the credits.
Voice
One stitched performanceElevenLabs eleven_v4, voice Alex, recorded as one continuous take. It replaced a voice that drifted from Australian to American inside a single read.
Build
Real surfaces, drawn in codeBrowser windows, terminals and a server chassis on a dark stage. The Foundation post and the GitHub commit are screenshots of the live pages, not recreations.
Review
Cut by cut, to the tenthEach cut's notes were fixed and re-rendered, and the spoken ending went from 140 words to 25.
Packaging
Three angles, tested against the field29 videos on the story were studied for outliers. The thumbnail leads with the php2shell name, so it reads as this story in a feed.

Sources

  1. 1.PHP security advisory, 21 Oct 2026 · php.net
  2. 2.Pre-announcement, 20 Oct 2026 · php.net
  3. 3.Supported versions · php.net
  4. 4.Today's PHP security release, and how we're strengthening PHP security · The PHP Foundation
  5. 5.GHSA-w8hw-w9fx-j79w, CVE-2026-109618 · php-src on GitHub
  6. 6.GHSA-6wmf-4rv5-p3rp, CVE-2026-109619 · php-src on GitHub
  7. 7.Avoid state corruption via bailout · php-src on GitHub
  8. 8.Critical security issue affecting PHP · NCSC
  9. 9.Security advisory 2026-018 · CERT-EU
  10. 10.US agencies urge fixes to programming language flaws · Nextgov
  11. 11.CVE-2026-109618 and CVE-2026-109619 · Unit 42, Palo Alto Networks
  12. 12.php2shell exploitation prior to public disclosure in MadPot · AWS Security Blog
  13. 13.Usage statistics of PHP · W3Techs
  14. 14.PHP2Shell · Wikipedia

Independent explainer. Not sponsored, and nobody in the story was asked to approve it. Not affiliated with the PHP Foundation, php.net or any organisation named here.

More films

See all 4 films

AI safety incident report

Why hundreds of AI agents attacked Hugging Face

5 chapters

5:23

Developer tools

Why your AI coding agent burns tokens, and how to stop it

10 chapters

3:37

Australian startup funding

Why investors say no to almost everyone

9 chapters

In production

Work with us

Have something hard to explain? We make the film.

Every film here started as a dense source: a 91-page report, an app’s documentation, a funding dataset. We turn sources like yours into short films that make them clear.

Talk about a film