GoKawiilPHP core memory-safety flaws tracked as two CVEs under 'PHP2Shell' name
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the bugs live in PHP itself rather than in application logic, patching individual websites' code offers no protection—only upgrading the PHP runtime does, which could leave unpatched servers exposed regardless of which CMS or framework they run. The use of major platforms like WordPress as proof-of-concept targets likely helped underscore the scale of potential impact, given PHP's widespread use across the web.
- PHP2Shell covers two CVEs tied to memory-safety issues in PHP's core, not application code.
- Any site on an affected PHP version can be vulnerable, even minimal apps unrelated to WordPress, Drupal or Joomla.
- Updating to patched PHP releases is the fix; the PHP team has already issued remediations.
Source: php2shell.com, 2026-10-21
Published there as: “PHP2Shell”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.