Security researchers at Wiz say they have uncovered multiple critical vulnerabilities in the core PHP engine, the code that runs roughly 70% of websites on the internet. The flaws, grouped under two CVEs with severity reaching CVSS 9.2, can allow unauthenticated attackers to execute code remotely or read sensitive process memory on affected servers.
PHP released patches on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Notebookcheck. Wiz says every PHP release from the past decade — dating back to version 5.4 — is affected by at least one of the issues, and that immediate patching is strongly advised.
What PHP2Shell actually exposes
The vulnerabilities are memory-safety bugs in how PHP handles fatal errors during request processing, especially out-of-memory errors, according to Wiz. A request that ends unexpectedly can leave PHP in a corrupted internal state, which attackers may then abuse.
Wiz describes the impact as two-fold: remote code execution, in some cases before any application code runs, and a Heartbleed-style memory disclosure. That leaked memory could contain passwords, authentication tokens, API keys and certificates belonging to other requests or to the server itself.
- Affects all PHP versions released in the last decade, going back to 5.4
- Two CVEs, severity up to CVSS 9.2
- Can lead to unauthenticated remote code execution
- Can expose sensitive process memory to attackers
