PHP2Shell Patches Leave a Third PHP Flaw, CVE-2026-115560, Unfixed

An unauthenticated attacker can run code on a PHP web server with one crafted upload (on builds with session.upload_progress left at its default of on), the PHP project said Oct. 21. A third flaw, disclosed two days later, has no fix.

The two flaws are CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Each is rated 9.2 on the CVSS 4.0 severity scale, according to Rapid7, which lists the vector as CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H.

What the PHP advisory says about CVE-2026-109618 and CVE-2026-109619

The PHP project's security advisory calls both bugs unauthenticated remote code execution. CVE-2026-109618 is "RCE via OOM corruption": out-of-memory handling can interrupt PHP while request data is only partly initialised, and cleanup then treats it as valid.

CVE-2026-109619 is "RCE via stale global state". Request-owned state survives after its memory is freed, and a later request on the same worker can use it before normal initialisation resets it.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every release announcement carries the same line: "There are no complete mitigations, updating is the only safe choice."

Branch	Vulnerable	First fixed
PHP 8.5	below 8.5.12	8.5.12
PHP 8.4	below 8.4.27	8.4.27
PHP 8.3	below 8.3.36	8.3.36
PHP 8.2	below 8.2.35	8.2.35

How one multipart upload reaches the bug

OX Security researchers Nir Zadok and Moshe Siman Tov Bustan wrote that PHP handles an out-of-memory condition by aborting with zend_bailout(), a jump that skips cleanup in code that has not finished updating its own bookkeeping.

The exposed path is the upload-progress handler. A multipart POST carrying PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS fields makes the parser reopen, decode and rewrite the session on each upload tick, and OX said this runs before the request's script is compiled. Allocation sizes depend on part count and field name lengths, which the sender controls.

OX said it validated the issue without weaponising it and did not publish a full exploit chain. It listed the fix as commit 01a40e89fb, "Avoid state corruption via bailout", with Arnaud Le Blanc as lead author. In OX's regression run of about 77 oom_* tests, PHP 8.2.35 passed all of them and the unpatched 8.2.34 failed 7. OX, a security vendor, also estimated about 2 million internet-facing servers are affected; that figure is its own.

PHP 5.4.0 is the oldest version OX lists as carrying the upload-progress feature. PHP 8.1 and older no longer get project updates, though the project published minimal source backports for 7.4, 8.0 and 8.1, according to BleepingComputer.

The score understates the exposure and overstates the ease. Attack complexity is rated high and attack requirements present, which fits Rapid7's finding that each public exploit works only for one operating system, PHP version and web server combination. But the vulnerable code runs before application code, so no amount of application hardening closes it.

Timeline from the leak to the third flaw

• Oct. 17: Amazon's MadPot honeypot recorded an exploitation attempt, according to Help Net Security. Amazon does not know how the attacker got details before disclosure, Help Net reported.
• Oct. 20: A Hacker News post claimed two PHP flaws were due for disclosure Oct. 22. PHP posted an advance notice that evening. Calif mistakenly posted a video of its working proof of concept, the PHP Foundation said, as relayed by The Hacker News.
• Oct. 21, 03:02 UTC: Cloudflare turned on firewall rules by default for the known exploit vectors.
• Oct. 21, about 14:00 UTC: PHP published the fixes. At 14:19 UTC watchTowr reported active exploitation attempts, per The Hacker News.
• Oct. 22: Palo Alto Networks said all PAN-OS and Panorama versions are affected and no fixed release exists, Help Net reported.
• Oct. 23: The Canadian Centre for Cyber Security added CVE-2026-115560, which the Oct. 21 releases do not fix.

Who found it, and where accounts differ

BleepingComputer credits Calif, OpenAI and Wiz. The Hacker News adds that the finders were Wiz Research, Calif and OpenAI's Codex Security team, working with the PHP security team and Google's Gemini team on the fix. Inc42 reports that Calif credited a pseudonymous researcher, LCFR, with first finding the flaw, and that Wiz independently reported both bugs.

The Terminal could not load OpenAI's own disclosure post, which returned an access error, so the Inc42 account of OpenAI's statement is unconfirmed here.

What each source says about exploitation

The sources do not agree on how much exploitation there is, and none reports a confirmed break-in of a named server.

Source	Statement
Cloudflare CTO Dane Knecht	"We are seeing early attacks emerging and are updating mitigations as new vectors show up."
Rapid7	Has not observed exploitation in the wild, but cites multiple reports of attempts
Canadian Centre for Cyber Security	Identified no active exploitation so far, says that could change quickly
watchTowr	Reported active exploitation attempts at 14:19 UTC on Oct. 21

The Hacker News reported that neither flaw was in the CISA Known Exploited Vulnerabilities catalog at the time of its article.

Appliance vendors and the third flaw

Help Net reported that as of 6:25 a.m. Eastern on Oct. 22, Fortinet was checking 12 products and Cisco 31 products and cloud services, and neither had confirmed a vulnerable one. Fortinet had a separate exploited flaw in the news the week before, covered in our FortiMail report. Cisco, Veeam and SonicWall appliances also dominate the SafePay ransomware advisory.

The Canadian centre's Oct. 23 update says CVE-2026-115560 needs an uncommon mix of PHP configuration and application behaviour, and that applications which do not change the serialization handler at runtime are not exposed. Until a patch exists, the PHP Security Team recommends session.upload_progress.enabled=0. Only the Canadian centre was found describing this flaw.

What to do before the next patch

Update first. Rapid7 recommends doing it outside normal patch cycles and starting with internet-facing hosts. Rapid7 lists stopgaps that reduce exposure but do not fix it: memory_limit=-1 with a worker restart, session.upload_progress.enabled=0, and on PHP 8.5 fatal_error_backtraces=0. It warns against using RLIMIT_AS or RLIMIT_DATA.

Users of the volunteer-run rpms.remirepo.net repository had no update on Oct. 21 and should switch to distribution packages or build from source, Help Net reported. Searchlight Cyber released an open-source scanner, php2shell-scanner, on Oct. 22.

PHP 8.2 reaches end of life on Dec. 31, 2026, so the 8.2.35 fix is the last this branch is guaranteed to get.