- What PHP2Shell is
- How the two bugs work
- How it was found, and the leak
- How to patch and protect your servers
Bonus: this 3D animation
Most write-ups of PHP2Shell use words like memory corruption and stale state. This page shows the same story as a short 3D animation, so you can watch it instead. You do not need to know any programming. Press play, or click through the six scenes at your own pace, and drag the picture sideways to look around.
Your browser could not start 3D graphics. The scene-by-scene list below tells the same story, and part 1 of the series explains it in words and diagrams.
A simplified analogy, not the real code. Real attacks are hard to pull off reliably, because they depend on the exact PHP build, settings and memory layout.
What you just watched, scene by scene
This list tells the same story as the animation, for anyone who prefers to read it or cannot run 3D graphics.
- A normal visit. A visitor asks for a page and PHP builds it piece by piece.
- A limited workspace. Each request gets a fixed amount of memory, and it is wiped afterwards.
- Bug 1 (CVE-2026-109618). An attacker makes PHP run out of space at one precise moment. PHP jumps out mid-job, and the cleanup step trusts the half-built piece.
- Bug 2 (CVE-2026-109619). One request leaves a note pointing at a drawer. The drawer is emptied and reused, and a second request follows the old note into the attacker's data.
- Why a login does not help. All of this happens in PHP before the site's own code runs, so the attacker's instructions get past the login and can reach files and settings.
- The fix. Patched PHP stops at the next safe point when it hits the limit, instead of jumping out mid-job.
What the animation simplifies
- The kitchen, desk and drawer are comparisons. The real bugs are in how PHP's C code handles memory, which parts 2 covers properly.
- The severity rating says exploitation is high complexity. Attackers need the right PHP build, settings and memory layout, and for the second bug both requests must reach the same worker.
- The result of an attack is code running as the web worker account, not automatic control of the whole machine. It is still enough to read what that account can read.
- The fix scene shows the first bug's change (stopping at the next safe point). The advisories say the patches are not complete fixes, so the patch guide also covers extra protections.
Where to go next
- Part 1: what PHP2Shell is, in words and diagrams.
- Part 2: how the two bugs work, for technical readers.
- Part 4: how to patch and protect your servers, whatever your setup.
Sources: PHP advisory for CVE-2026-109618, PHP advisory for CVE-2026-109619, Datadog Security Labs, CISA alert. Read 23 October 2026. The animation is an illustration, not a real incident. 3D drawn with three.js (MIT license)