---
title: "Critical PHP vulnerabilities in PHP2Shell expose web infrastructure to remote code execution"
description: ""
canonical_url: "https://cloudsmith.com/blog/critical-php-vulnerabilities-in-php2shell-expose-web-infrastructure-to-remote-code-execution"
last_updated: "2026-10-22T14:23:54.311Z"
---
# Critical PHP vulnerabilities in PHP2Shell expose web infrastructure to remote code execution

Two critical core PHP vulnerabilities, together known as PHP2Shell, were disclosed this week and emergency patches are available. The flaws sit in PHP itself, so any site, developer environment, or CI pipeline running an unpatched version of PHP is exposed.

This kind of vulnerability requires a fast patch. PHP comes into environments in lots of places - in base images, CI runners, developer containers, and open source package repositories. In this scenario, ideally you’ll want a single view of your dependencies, so you don’t have to do a search across fragmented tools.

## What happened

When PHP hits an out-of-memory error, a flaw in how it handles memory lets an unauthenticated attacker run arbitrary commands or read sensitive data from server memory.

The flaws affect every PHP release from 5.4 through 8.5.11. [PHP reported that they consider consider the risk highest for mod_php](). There is a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

## See which PHP versions your teams pulled and stop affected versions from being used

Cloudsmith can be the source of truth for what packages came into your environment, by which users, and when. That gives you a clear picture of your exposure.

**Find affected Cloudsmith repositories: **Search your Cloudsmith repositories and package logs for the affected PHP versions.

**Upgrade to patched versions: **Patched versions are available, but 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 8.1 and earlier are end of life and will not receive a fix.

**Block critical vulnerabilities automatically: **Set a vulnerability policy that blocks packages with critical vulnerabilities. It applies as soon as an advisory is published and protects you against future critical vulnerabilities.

**Re-evaluate continuously:** When new threat intelligence lands, Cloudsmith re-checks all existing packages in your Cloudsmith repositories against your policies automatically.

_[Book a demo](https://cloudsmith.com/book-a-demo) with Cloudsmith for a custom assessment of your software supply chain._