Comparison
PHP2Shell vs Log4Shell
Both are unauthenticated remote code execution in software that sits under a huge share of the internet. The big differences: Log4Shell was trivial to exploit and hard to find; PHP2Shell is harder to exploit and easier to find.
Last reviewed 2026-10-22
| PHP2Shell | Log4Shell | |
|---|---|---|
| What it is | Two memory-safety bugs in the PHP interpreter | JNDI lookup injection in the Log4j 2 Java logging library |
| CVE | CVE-2026-109618, CVE-2026-109619 | CVE-2021-44228 (plus follow-ups) |
| Disclosed | 21 Oct 2026 (leaked 20 Oct) | 9 Dec 2021 (exploit public the same day) |
| Score | CVSS 4.0 9.2 | CVSS 3.1 10.0 |
| Authentication | None | None |
| How hard to exploit | Harder: crafted multipart requests, tuned to each target’s memory layout over repeated attempts | Trivial: one string such as ${jndi:ldap://…} anywhere that gets logged |
| Reach | Any site on a vulnerable PHP — a large share of the web | Any Java app logging attacker input with Log4j 2.0–2.14.1 — servers, appliances, games |
| Finding affected systems | Easy-ish: it is the PHP runtime; check the version per server or container | Hard: Log4j hid as a transitive dependency inside JARs and vendor products |
| Fix | Update PHP and restart workers | Upgrade Log4j (several rounds: 2.15 → 2.16 → 2.17) and rebuild every affected app |
| Who fixes it | Whoever runs the server: you, your host or cloud provider | Every vendor that bundled Log4j, plus everyone running those apps |
| Attacks | Early attacks reported on release day; no confirmed compromise published yet | Mass exploitation within hours; listed in CISA KEV |
| Data theft without RCE | Yes — memory disclosure path | Indirectly (environment variables via DNS lookups) |
Where they are alike
- No login, no user interaction — just network requests.
- Foundational software most owners never think about, so many systems will stay unpatched for a long time.
- Application updates do not help; the vulnerable layer sits underneath.
Where they differ
- Exploitation effort. Log4Shell was a copy-paste string; PHP2Shell is a memory-corruption chain that must be adapted per target. Expect fewer, more capable attackers at first — and broader abuse once reliable tooling spreads.
- Inventory. “Which servers run PHP, and which version?” is answerable in hours. Log4j took organisations weeks to find.
- Long tail. PHP’s long tail is shared hosting and abandoned servers on PHP 7.x and 8.0/8.1, which get no new release.
Questions
Is PHP2Shell as bad as Log4Shell?+
Similar reach and the same worst case (unauthenticated remote code execution), but harder to exploit: Log4Shell worked with one string in any logged field, while PHP2Shell exploits must be tuned to each target. PHP2Shell is easier to inventory and fix, because it lives in the PHP runtime rather than hidden inside application dependencies.
Do Log4j fixes or scanners help with PHP2Shell?+
No. They are unrelated: Log4Shell is in a Java logging library, PHP2Shell is in the PHP interpreter. Different scanners, different fixes.
Related
- What is PHP2Shell?What PHP is, what remote code execution means, why PHP2Shell is serious, and what website owners and SaaS customers should actually do — without jargon.
- CVSS 9.2 vs 10.0Why PHP2Shell was initially rated CVSS 10.0 and officially scored 9.2. Understand the CVSS 4.0 vector and what it means for your risk.
- TimelineFrom the 2024 audit to the 21 October 2026 release: every PHP2Shell disclosure step in UTC, the early leaks, the PHP Foundation’s response and who found what.