A post-mortem from the PHP Foundation reveals that a small team of maintainers was aware of a critical vulnerability for two years before it was publicly disclosed. The flaw, which allows for remote code execution, was discovered by OpenAI's GPT 5.6-Sol during the week of October 19, 2026. The discovery has led to the emergence of the PHP2Shell exploit, a chained attack that has already been linked to a campaign gaining kernel-level access to 25 servers.
The vulnerability stems from an architectural decision in the PHP engine's error handling involving the longjmp() C function. When a process runs out of memory, the function triggers an immediate jump in execution. If this occurs while a data structure is being built, inconsistent, half-baked data remains in the memory heap. An attacker can exploit this by injecting specific content into a web request, allowing them to execute arbitrary code with PHP's permissions.
While the exploit requires an attacker to know the exact version and build of PHP being used, the scale of the potential impact is significant. PHP hosts approximately 70% of all websites on the internet. Security firm BitSight reported numerous intrusion attempts across its monitoring fleet following the disclosure, noting that attacks originated from many distinct locations.
Data indicates that 73% of PHP installations online are running end-of-life versions that no longer receive active support. Nearly 8% of installations are running version 5.x, which was released in 2005. While the PHP Foundation has published source code patches for versions 7.4 through 8.1, users on older versions may be forced to upgrade their website code to remain secure.
The PHP Foundation attributed the delay in addressing the flaw to the complexities of maintaining compatibility with third-party extensions. The organization noted that it is a small outfit consisting of one full-time employee and 14 part-time contractors. "The team admitted it had made management mistakes," the post-mortem stated.
In response to the threat, several commercial vendors including Ubuntu Pro and Zend have released packages for ancient versions of PHP, dating back to 5.5. Additionally, web application firewalls such as Immunify360 have updated their rulesets to include detection for the PHP2Shell exploit.
