PHP2Shell, Unpacked

On 21 October, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, which researchers have dubbed “PHP2Shell”. Both are in code that nearly every request touches: memory management and error handling.

Volker Dusch leads the PHP Foundation’s Ecosystem Security Team and spent the past weeks working on this release. In this open Q&A session, moderated by Sebastian Bergmann, he answers your questions about what happened and what comes next.

How were the vulnerabilities found? Why did a problem that first surfaced in 2024 take so long to fix? What happened when information leaked two days before the coordinated disclosure, and why was the release moved up by only one day? How does a small team cope with a fast-growing number of reports now that LLM-based tools are used to find vulnerabilities? And what does it take to put the security of a language that runs a large part of the web on a sustainable footing?

Bring your questions.

The first time I present “PHP2Shell, Unpacked” will be at the International PHP Conference on 27 October 2026 in Munich.

I present this together with Volker Dusch.

About me

I started writing PHPUnit in 2000 and still maintain it. I helped start the PHP Foundation, serve on its board, and support its Ecosystem Security Team. As a co-founder of thePHP.cc, I advise organisations on testing strategy, secure development practices, and supply chain security.

I know the maintainer's side of a vulnerability report from PHPUnit, which lands in millions of vendor directories. For CVE-2026-24765, I backported the fix to PHPUnit 8.5, 9.6, 10.5 and 11.5, branches that otherwise no longer get bug fixes. For the Ecosystem Security Team, I wrote So you received a security report. Now what?, a guide for maintainers on what to do once a report arrives. As a board member, I am also part of the discussion this session ends with: what it takes to put the security of PHP on a sustainable footing.