PHP post-mortem says maintainers knew of vulnerability two years before disclosure | Межа

The PHP2Shell exploit uses a flaw that can enable remote code execution. A PHP Foundation post-mortem says a small team of maintainers had known the issue for two years before it became public.

OpenAI’s GPT 5.6-Sol discovered critical vulnerabilities in PHP during the week of October 19, 2026. The PHP Foundation’s post-mortem says maintainers did not immediately consider the issue a cause for concern and discussed several possible fixes while trying to preserve compatibility with third-party extensions.

This is reported by Tom’s Hardware .

The flaw stems from an old design choice in PHP’s error handling. When a PHP process runs out of memory, it calls the C function longjmp(), which immediately moves execution elsewhere. If that happens while the engine is building a data structure, incomplete data can remain in memory. The cleanup code may then act on those inconsistent bytes.

With carefully crafted content in a web request, an attacker can exploit the flaw to run code with PHP’s permissions. Obtaining a remote shell requires knowing the exact PHP version and build, but the article says tens of millions of servers may be vulnerable. After disclosure, many system administrators disabled PHP version reporting.

PHP runs on around 70% of websites, and 73% of PHP installations online were running end-of-life versions without active support. Maintainers acknowledged management mistakes. The PHP Foundation team consists of one full-time employee and 14 part-time contractors.

The standard fix requires a point update and may require restarting some services. The currently maintained PHP branches are 8.1 through 8.5. The article says 73% of sites were still using PHP 7, and upgrading from 7.4 to 8.0 in late 2020 required changes to some code. Depending on their circumstances, users of PHP 7.3 or older may need to update their websites, since not all Linux distributions are expected to backport fixes. PHP 7.3 was released in 2018, and nearly 8% of PHP installations were running version 5.x, released in 2005.

The PHP Foundation published patches for versions 7.4 through 8.1. Ondřej Surý, a Debian developer, prepared packages for PHP 5.6 through 8.1 for Debian and Ubuntu variants; CloudLinux and AlmaLinux also produced backported fixes. Ubuntu Pro and Zend released packages for older PHP versions, down to 5.5. Palo Alto Networks issued an advisory for products powered by its PanOS system.

Web application firewalls such as Immunify360 may block malicious requests before they reach a server. Cloudflare and Fastly added PHP2Shell detection to their rule sets, while server-level security suites such as CrowdStrike can detect and block malicious activity by the PHP binary. The article says these protections may have slowed exploitation.

At least one high-profile campaign chained the PHP flaw with Fragnesia, also known as Dirty Frag, to gain kernel-level access to 25 servers seemingly linked to the U.S. government. As of October 29, BitSight had recorded numerous PHP2Shell intrusion attempts from distinct origins. Its researchers monitoring dark-web forums said there was no one-size-fits-all exploit package available at that time.

Censys initially estimated that around 45.7 million of 119 million PHP installations were vulnerable. At the time of writing, the number of unpatched services had fallen to around 29 million, suggesting a patch rate of 1 million per day, depending on how it is counted. Backported fixes may not change a version number, so patched systems could still be counted as unpatched.

Censys said 62% of the PHP servers it monitors were not reporting their version, making the actual totals uncertain. The article notes that a significant percentage of those systems may still be unpatched.

You might be interested in:

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.