PHP2Shell: Memory flaws expose bundled runtimes and containers

Horizon3.ai published first-hand research on PHP2Shell, highlighting that exposure often exists outside an organization’s primary development stack. The findings indicate that security teams must look beyond their own PHP applications to identify affected runtimes in third-party products, containers, and hosted services. This broader scope complicates exploitability validation for security operations teams.

Root cause

The PHP2Shell vulnerabilities involve two related memory-handling failure patterns. Horizon3.ai notes that server integration, application behavior, and request lifecycles influence which attack paths are reachable. For the stale-state vulnerability specifically, the mechanism involves state surviving one request and being reused by a later request handled by the same worker process.

Attack path

Exploitation requires specific preconditions that Horizon3.ai is still characterizing. The research team validated that these vulnerabilities can be feasibly exploited in practice, but success depends on environmental factors. A working exploit against one environment does not guarantee identical results elsewhere, nor does an unsuccessful attempt prove an affected runtime is safe.

Affected versions

The research references CVE-2026-109618 and CVE-2026-109619. Horizon3.ai does not specify exact version ranges in this summary but emphasizes that identifying the actual runtime is the critical step. Teams must check applicable vendor guidance for their specific PHP builds to determine if they fall within the affected scope.

Mitigation

• Identify all PHP runtimes, including those bundled in third-party applications or containers.
• Verify whether a release containing fixes or applicable vendor backports has been deployed.
• Confirm that relevant services and workers have been restarted after updates.
• Ensure the patched runtime is actively serving the application, not just installed.

Signals worth monitoring

Teams usually review web server access logs for unusual request sequences or timing anomalies that might indicate state reuse. Check whether application performance monitoring tools show unexpected worker process behaviors or memory spikes. Look for failed authentication attempts followed by successful actions from the same source. Containment moves typically involve isolating affected containers, restricting network access to vulnerable services, and enabling detailed request logging to capture the specific conditions required for exploitation.

What to do and how to stay safe: PHP2Shell

• Audit all environments for hidden PHP runtimes in containers and third-party software.
• Contact hosting providers to confirm which PHP version is actively serving your applications.
• Monitor for vendor advisories regarding backports or specific configuration mitigations.
• Prepare incident response plans that account for the difficulty of verifying runtime updates.

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does using PHP2Shell mean every PHP application is vulnerable?

No, Horizon3.ai states that exploitability depends on specific preconditions and environmental factors, not just the presence of PHP.

How do I know if my hosted application is patched?

A provider’s statement is less useful than confirmation that the patched runtime is actively serving your specific application.

Are there confirmed exploits in the wild?

Horizon3.ai has validated feasibility in practice but is still characterizing the conditions for real-world exposure.