PHP2Shell: When a security embargo breaks down

PHP2Shell was a wake-up call for the PHP ecosystem. Not because PHP had suddenly become insecure, but because two critical runtime vulnerabilities exposed the damage a breakdown in coordinated disclosure can cause.

Discovered in 2026, PHP2Shell was the collective name for two vulnerabilities in PHP core: CVE-2026-109618 and CVE-2026-109619. Both could lead to unauthenticated remote code execution (RCE), potentially allowing an attacker to execute arbitrary commands on a server with a specially crafted HTTP request.

An attacker could potentially go from a request to a shell on your server.

That’s serious when PHP powers a significant proportion of the web.

So why the panic?

The vulnerabilities were being handled under a coordinated disclosure embargo, giving PHP maintainers and hosting providers time to prepare patches before publishing details attackers could use.

Disclosure was planned for 22 October 2026.

The plan unravelled.

On 20 October, details began circulating online. CVE identifiers appeared on public forums, screenshots of leaked information spread across social media, and a proof-of-concept exploit video briefly appeared before being deleted.

Patched container images then became publicly available more than six hours before the scheduled release.

Defenders were racing to understand and patch the vulnerabilities while attackers gained a clearer picture of what to target. Security researchers and threat actors began developing and circulating their own proof-of-concept exploits.

The PHP maintainers brought the release forward to 21 October.

Why this mattered

This wasn’t another application dependency vulnerability. The flaws were in the runtime itself, potentially affecting enormous numbers of PHP applications, whether built with Laravel, Symfony, WordPress or custom code.

The incident also showed how fragile coordinated disclosure can be. An embargo works only while information remains controlled. Once exploit details leak, the balance shifts rapidly from giving defenders time to prepare to giving attackers an opportunity to strike.

The takeaway? Keep your PHP runtime patched. Framework updates and application-level security matter, but they cannot protect you from vulnerabilities in the interpreter itself.

PHP2Shell was a reminder that your application’s foundation deserves as much attention as the application itself.

Read more

• PHP Foundation's disclosure timeline and post-mortem⁠ — particularly useful for understanding how the embargo unravelled.

• AWS: PHP2Shell exploitation before public disclosure⁠ — evidence that attackers were already probing the vulnerability before the patches were released.