PHP2Shell at a Glance
9.2CVSS score, pre-auth RCE
~70%of websites run PHP (Wiz)
10+ yrsbug in every PHP since 5.4
63 daysfrom discovery to patch
Two CVEs (CVE-2026-109618, CVE-2026-109619) in PHP's own engine let an unauthenticated attacker run code or read server memory, with no app bug required. Wiz Research found them with frontier AI and showed working exploits on WordPress, Drupal and Joomla.
The Attack Needs to Reach PHP. OpenNHP Makes Sure It Can't.
Every PHP2Shell chain starts with an unauthenticated request. Behind OpenNHP, that request is dropped before it reaches PHP.
The Patching Race
Attackers had the exploit before the patch existed. Hidden servers don't have to win that race.
Patch vs. WAF vs. OpenNHP
| Patch PHP | WAF rules | OpenNHP | |
|---|---|---|---|
| Works before the CVE is known | ✕ | ✕ | ✓ |
| Needs an exploit signature | — | Yes | No |
| Blocks unauthenticated RCE | ✓ once applied | ~ known variants | ✓ |
| Blocks memory disclosure | ✓ once applied | ~ known variants | ✓ |
| Hides the server from scanners | ✕ | ✕ | ✓ |
| Fixes the bug itself | ✓ | ✕ | ✕ |
They work together: OpenNHP removes the unauthenticated attack path, and patching removes the bug. Patch anyway.
Proof, Not Promises
Where OpenNHP Fits
✓ Hide behind OpenNHP
- Admin panels (
/wp-admin, Drupal admin) - Internal PHP apps and back offices
- APIs used by known clients
- Staging and management servers
Must stay public
- Anonymous-visitor websites
- Patch these first, use WAF rules
- Hide their admin and origin access
Authorized users can still reach a hidden app, so OpenNHP shrinks who can attempt an exploit from "the whole Internet" to "people you approved."
What to Do Now
1
Patch
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distro's fixed package.
2
Inventory
List the PHP services that don't need to face the public Internet.
3
Hide
Put them behind OpenNHP so the next PHP2Shell has nothing to reach.
Don't Trust Us. Try to Break It at IETF 127.
Nov
14–15
2026
IETF 127 Hackathon · San Francisco
Bring your AI attack tools, your PHP2Shell tricks, and your scanners. The challenge: reach a server behind OpenNHP without authenticating first.
Resources
Authenticate Before Connection.
The next PHP2Shell is already in someone's AI pipeline. Give it nothing to reach.
Want help hiding your PHP services? Contact us at [email protected].