Blog
Log4Shell vs PHP2Shell: same class of ubiquitous runtime, different clocks
Log4Shell (CVE-2021-44228) and PHP2Shell (CVE-2026-109618/CVE-2026-109619) both exploit ubiquitous runtimes with unauthenticated RCE. The comparison reveals how runtime ubiquity shapes the remediation timeline — and why the PHP event in 2026 carries lessons from the 2021 Log4j response.
Runtimes · Operator triage
Log4Shell (CVE-2021-44228) and PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are not the same vulnerability, but they share the structural property that made Log4Shell the defining vulnerability event of 2021: both exploit a runtime that is present in enormous numbers of production systems without centralised control over the deployment inventory.
Understanding that structural similarity — and where it breaks down — tells you more about the remediation timeline you are facing than the CVSS score alone.
Side-by-side comparison
| Property | Log4Shell (CVE-2021-44228) | PHP2Shell (CVE-2026-109618 / CVE-2026-109619) |
|---|---|---|
| Runtime | Apache Log4j 2 (Java logging library) | PHP CGI/FPM (web scripting runtime) |
| Discovery | December 2021 | October 2026 |
| Auth required | None | None |
| Attack vector | Network — JNDI injection via any logged field | Network — crafted HTTP request to PHP CGI/FastCGI |
| Exploitation complexity | Low — one-liner proof-of-concept within 24 hours | Low — CGI path traversal is a known technique class |
| OS scope | Cross-platform (Java runs everywhere) | Both: CVE-2026-109618 cross-platform, CVE-2026-109619 Windows only |
| Inventory problem | Log4j bundled as transitive dependency — developers often unaware | PHP version installed by OS package manager or hosting stack — often unmonitored |
| EOL exposure | Java 8 / Log4j 2.x branches all required separate patches | PHP 8.1 EOL Dec 2025 — no patch issued; permanently exposed |
| Vendor patch timeline | Log4Shell patch within days (2.15.0 → 2.16.0 → 2.17.0 sequence) | Patch in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 simultaneously |
| Ecosystem actors | Spring, AWS, Cisco, Fortinet, VMware all affected via Log4j dependency | PHP used by WordPress, Laravel, Drupal, Joomla hosting stacks |
| Worm-like propagation observed | Yes — within days of disclosure | Advisory issued; exploitation activity expected to follow same pattern |
The ubiquitous runtime remediation problem
The reason Log4Shell required months to remediate in many environments was not patch availability — the patches arrived quickly. The reason was inventory blindness: organisations did not know where Log4j was running because it was embedded as a transitive dependency of other Java applications. The remediation question "where is Log4j 2.x deployed?" could not be answered from asset management.
PHP has a different but analogous inventory problem. PHP versions are:
- Installed via Linux distribution package managers (apt, yum, dnf) and often not tracked separately from the OS
- Embedded in containerised applications with frozen base images that do not receive OS-level package updates
- Running on shared hosting stacks where the hosting provider, not the application developer, controls the PHP version
- Bundled in commercial applications with specific PHP version requirements that conflict with the patched release
CISA's October 2021 response to Log4Shell established the template that the October 2026 PHP advisory follows. Both advisories use the same language: "immediate patching required." Both face the same structural obstacle: you cannot patch what you cannot find.
Where the clocks differ
| Timeline factor | Log4Shell | PHP2Shell |
|---|---|---|
| Time to widespread PoC | ~24 hours | Expect similar pattern |
| Time to worm/botnet exploitation | ~5 days | Historical CISA PHP advisories show rapid weaponisation |
| CISA KEV addition | Within days | PHP CVEs expected in KEV given Critical/coordinated advisory |
| Remediation tail in enterprise | 12–18 months for full closure | PHP EOL problem suggests similarly long tail |
| Transitive dependency problem | Severe (Maven/Gradle) | Moderate (Composer, but PHP version itself is OS-level) |
The Log4Shell remediation tail — documented by Tenable in December 2022 — showed that a year after disclosure, a significant fraction of enterprise environments still had unpatched Log4j deployments. Expect a similar curve for PHP, particularly for EOL 8.1 deployments.
Engagement implications
If you are engaged against an environment that runs PHP:
- Inventory PHP versions before the patch window closes. If the engagement covers server infrastructure, PHP version enumeration is the priority finding during the first week after the advisory.
- PHP 8.1 and earlier are permanently exposed. No patch will be issued. If you find EOL PHP, that is a separate finding: an unmitigable exposure requiring version upgrade, not just patching.
- Containerised PHP may not be caught by OS-level updates. Container images with frozen base layers will still run the vulnerable PHP version even after the host OS package manager is updated. Ask whether the application is containerised; if yes, confirm the container base image date.
- WordPress/Laravel hosting stacks are high-probability. If a hosting platform runs PHP, the hosting provider's PHP version policy determines whether customers are automatically protected or manually responsible.
- CGI mode is the differentiator for CVE-2026-109618. Not all PHP deployments run in CGI mode. Confirm before treating every PHP server as equally exposed — PHP-FPM in socket mode has a different attack surface.
The Log4Shell parallel is useful for client communication: "This is structurally similar to Log4Shell — ubiquitous runtime, no auth required, broad ecosystem impact, inventory problem at scale" is a frame clients who lived through 2021 will recognise.