PHP2Shell: The Critical Vulnerability Breaking the Internet Today — and How Daniel Fixes It in 12 Minutes
By 6:00 AM this morning, the NSA's Cybersecurity Directorate had already published a formal advisory. The BBC had it on their technology homepage. The Hacker News thread crossed 800 points before breakfast. Security teams around the world started their day with a single question: are we patched?
The vulnerability is called PHP2Shell. It's a remote code execution flaw in PHP's file upload handling — CVE-2026-109618 and CVE-2026-109619 — rated 9.2 CVSS Critical. No credentials required to exploit. No special access. Any unauthenticated user on the internet can trigger it. And it affects every PHP installation below the patch releases that went live today.
That's most of the web.
What PHP2Shell actually does
PHP's file upload system has supported a feature called upload_progress for years. When enabled, it tracks the progress of incoming file uploads and stores metadata in a session variable. It's used by progress bars on file upload forms across millions of sites.
The vulnerability lives in how PHP constructs that session variable name. A crafted upload request can inject PHP code into the session key itself — and because that key gets processed by the stream wrapper before validation, the code executes. The attacker doesn't need to upload a PHP file. They don't need a writable directory. They need a single malformed POST request to any page that accepts file uploads.
Once that executes, they have a shell session on your server. Full command access. Everything your web process can touch, they can touch.
CVE-2026-109619 is the related bypass for servers that had partially mitigated CVE-2026-109618 through WAF rules — the same underlying flaw, accessed through a different encoding path.
Who is at risk
If your server is running PHP and hasn't been updated since October 21, 2026, you're vulnerable. The affected range covers the entire PHP 8.x branch prior to today's patch releases. PHP 8.1 and older received no upstream patch at all — those servers need a branch upgrade.
The PHP project released fixes today:
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
- PHP 8.5 (dev branch) → 8.5.12
- PHP 8.1 and below → no upstream patch; requires branch upgrade
The working estimate from security researchers is that around 70% of active PHP deployments are currently unpatched. Given how recent the patch release is, that number is probably conservative for the next 24 to 48 hours.
What makes this one particularly dangerous
A lot of critical CVEs have friction. They require specific configurations, or a second-stage payload, or some social engineering to complete the chain. PHP2Shell doesn't. It's a single request from any IP address to any PHP application that processes file uploads.
Exploit code was published publicly within hours of the disclosure. Automated scanners are already sweeping for targets. The CISA added both CVEs to the Known Exploited Vulnerabilities catalog this morning, which means federal agencies have 24 hours to patch. Private organizations don't have that formal deadline, but the practical window to patch before automated attackers find you is measured in hours, not days.
The stopgap if you can't patch immediately is to set upload_progress.enabled = Off in php.ini and restart your PHP process. That disables the exploit vector without breaking most applications. Some progress-bar functionality will stop working. That's acceptable compared to the alternative.
The bandwidth problem
Here's the real-world problem most engineering teams are facing today: they know what to do, but they don't have the capacity to do it fast enough.
Patching a single PHP server is a 10-15 minute task for a DevOps engineer. You connect via SSH, apply the update, restart the PHP process, verify the new version, and document it. Straightforward.
Patching twenty servers is a four-hour afternoon. Patching a hundred servers is a week of sustained work, assuming nothing goes wrong. Most companies in that range have two to three DevOps engineers, and those engineers are also dealing with the alerts, the stakeholder questions, the incident ticket that just got opened, and the CISO who wants a status update every 30 minutes.
The patch is simple. The execution at scale is the problem.
What Daniel does
Daniel is Cognitive AI's autonomous AI engineer. He connects to your servers over SSH, reads the environment, assesses the vulnerability, proposes a remediation plan, and executes it after you approve. He works the way a skilled DevOps engineer would — methodically, one server at a time, with every command logged.
For PHP2Shell, the workflow looks like this:
You provide Daniel with the server's SSH connection details. He opens a session, reads the current PHP version and php.ini configuration, checks whether upload_progress.enabled is active, and assesses whether the server is vulnerable. This is the read-only assessment phase — nothing changes.
Then Daniel shows you exactly what he plans to do: disable the upload_progress setting as an immediate stopgap, upgrade PHP to the patched version for that branch, restart the PHP process, and verify the patched version is live. You approve with one click.
He executes. Every command, every output, every exit code is captured as he goes. When it's done, he writes a receipt — a complete audit record of what ran, when, what the output was, and what the before/after state looked like. That receipt goes to your Slack, your Jira ticket, your email, or wherever you want it.
Total elapsed time from starting the job to seeing the receipt: under 12 minutes on a typical server.
The receipt matters more than people think
When you're patching one server, the receipt is convenient. When you're patching a fleet and your CISO needs to report to the board that every server was patched within 24 hours of the disclosure, the receipt is everything.
Every Daniel remediation produces a structured record: the job ID, the server, the timestamp, the commands that ran, their outputs, and the final verification. That's an incident log entry. It's evidence that the work was done, when it was done, and what the state was before and after. If an auditor ever asks, or if legal ever needs to know, you have it.
Manual patching in a hurry usually produces a Slack message that says "ok I think I got all of them." Daniel produces documentation.
The moment for autonomous AI in security
PHP2Shell is a case study in why autonomous AI agents belong in security response. The vulnerability is well-understood. The fix is known. The procedure is repeatable. There is no creative problem-solving required — just execution, at speed, across many servers, with careful logging.
That's exactly what agents are for. The humans on your team should be triaging, communicating, making judgment calls about the servers that have unusual configurations, and deciding what comes next. The agents should be handling the execution.
If your team hasn't been patched yet, Daniel can help. The PHP Security Fix portal is live at cognitivedaniel.com/php-security-fix. You can run a simulation to see how the workflow works, or connect a real server and let Daniel get to it.
The window to patch before automated scanners find you is narrowing. The patch is simple. Let's get it done.