PHP2Shell
The PHP2Shell[1] exploit are a set of two vulnerabilities (CVE-2026-109618 and CVE-2026-109619)[2][3] than affect the core of PHP from the version 5.4 to 8.6 [4], they are reported to be a level 9.2 on the CVSS scale[5] ←This is le bad and has caused a lot of chaos on the whole internet o algo. 
Impact
Its estimated that around 69% of the internet runs on PHP,[6] and therefore most websites have been affected. 
Some examples are goverment sites, imageboards, forums, games, etc.[7], and although an exact number of websites has not been said, based on my calculations, atleast 25 Million websites could be affected.[8] This video shows the exploit in a controlled enviroment against wordpress [9]
How it works
The two vulnerabilities act slighty differently but allow an attacker to reach the same goal of remote execute malicious code through the same mechanism of embeding invalid memory data by just sending some modified HTTP POST requests.[10]
CVE-2026-109618 (RCE via out-of-memory): Works by sending a modified request that overflows the memory limit allocation system causing it to crash but leaving invalid cached memory data in it that its later executed when the system tries to do a cleanup. This vulnerability allows attackers to inject malicious code and cause denial of service by exhausting the server resources. Heres the error message: "PHP Fatal error: Allowed memory size of 16777216 bytes exhausted (tried to allocate 3670048 bytes) in Unknown on line 0" [11]
CVE-2026-109619 (RCE via stale global state): Works by exploiting the same mechanism of the previous vulnerability but targeting global variables and using multiple requests, the first step targets a global state variable in a PHP process worker, crashing it and causes the invalid memory to get embed in it even after being reset, then the second request causes the worker to read the cached invalid memory and execute malicious code or cause a memory dump leak of the websites stored information. [12]
This allows attackers to access user data, API keys, Passwords, enviromental variables and even gain privilege to the backend servers and websites.
Solution
The only solution its to upgrade to the latest version of PHP and then restart the servers your site its running in.
Heres the image on what branches and version should be updated.[13] 
And heres the guide on how to do it. https://www.php.net/archive/2026.php#2026-10-21-5
SNCA
~The vulnerabilities where found by OpenAI[14] and by Wiz[15] in a dual effort to patch cybersecurity exploits and vulnerabilities.
~This incident marks the 2th time that imageboards source code have been affected by 0-day AI vulnerabilities (see vichan incident or something like that), the only remaining "safe" mainstream code engine that remains for now its jschan.
~Searching for info i found this comic that explain the situation in great detail. https://calif.io/php2shell/
~Also this its how i found out about the situation [shit nophono cares fan about]
Citations
- ↑ https://www.php2shell.com/
- ↑ https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- ↑ https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- ↑ https://en.wikipedia.org/wiki/PHP2Shell
- ↑ https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
- ↑ https://w3techs.com/technologies/details/pl-php
- ↑ https://mashable.com/tech/php-vulnerability-websites-offline-affected-services
- ↑ https://publicwww.com/websites/.PHP/
- ↑ https://www.php2shell.com/
- ↑ https://blog.cloudflare.com/php-vulnerabilities-waf-protection
- ↑ https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
- ↑ https://nvd.nist.gov/vuln/detail/cve-2026-109619
- ↑ https://www.php2shell.com/#upgrade-php
- ↑ https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
- ↑ https://www.wiz.io/blog/php2shell-php-rce
