PHP2Shell Shakes Core PHP Runtime: Dual CVSS 9.2 Vulnerabilities Enable Unauthenticated RCE

The PHP Project Security Team has issued urgent out-of-band security releases across all supported branches following the disclosure of two critical Remote Code Execution (RCE) flaws residing inside the core PHP runtime. Dubbed 'PHP2Shell' by cybersecurity researchers, both CVEs carry a critical severity rating of CVSS v4.0 9.2.

Unlike standard web application vulnerabilities that stem from application-level logic flaws or vulnerable third-party plugins (such as SQL injection or deserialization issues in WordPress or Laravel frameworks), PHP2Shell targets the Zend Engine's low-level memory allocation lifecycle written in C. Consequently, exploitation occurs directly at the HTTP server layer without requiring any pre-existing authentication.

Technical Anatomy: OOM State Corruption and Stale Global References

The security advisories published by the PHP project identify two distinct memory corruption vectors that compromise the HTTP request boundary:

SAPI Attack Surfaces: Elevated Peril for Apache mod_php

The vulnerabilities impact virtually every standard Server API (SAPI) deployment, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and modern Go-powered environments like FrankenPHP. However, advisories from Google Cloud Security and NHS England Cyber Alerts highlight that Apache mod_php architectures face the most immediate risk.

Under mod_php, the PHP interpreter shares the Apache worker process address space. Proof-of-Concept (PoC) exploits verified by security researchers confirm that code execution can be triggered during initial HTTP payload parsing before any application script (such as WordPress or Drupal's index.php) is even loaded. This architectural reality prevents standard application-layer WAF rules from providing complete defense.

Affected Versions and Mandatory Patch Targets

Official security updates are now available across all active PHP branches. Systems administrators and DevOps engineers must verify that production runtimes meet the following minimum patched versions:

SRE Remediation Protocols: The 'php -v' Misconception

Cloud security analysts caution against relying on CLI version strings alone. Executing 'php -v' in a shell only verifies the CLI binary, which often differs from the active web SAPI daemon (such as php-fpm). Furthermore, enterprise Linux distributions frequently backport security fixes without changing the upstream minor release number.

SREs must inspect native package manager versions and cross-reference distributor security tracker announcements. Following binary updates, all web server processes, worker pools, and containerized pods must undergo a rolling restart to purge stale shared objects (.so) mapped in resident memory.

# 1. Inspect active package version (Ubuntu / Debian)
dpkg -l | grep -E class="text-[#7ee787]">'php8\.[2-5]'

# 2. Check PHP-FPM daemon binary version
php-fpm -v

# 3. Full service daemon restart
sudo systemctl restart php8.3-fpm
sudo systemctl reload nginx
# On Apache mod_php systems:
sudo systemctl restart apache2

# 4. On Container / Kubernetes clusters:
kubectl rollout restart deployment/php-web-workload

“There are no configuration tweaks or WAF heuristics that substitute for binary patching at the runtime engine level. With PHP underpinning three-quarters of the public web, leaving core runtimes unpatched invites automated botnet compromise.”

Given that functional PoCs have been validated and published in technical communities, organizations worldwide must treat PHP2Shell as a Priority-1 operational emergency and expedite fleet-wide patching immediately.