PHP2Shell: two critical PHP flaws see early attacks ahead of the October 21 emergency patch

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 by the PHP security team and described in public reporting as unauthenticated remote code execution flaws in PHP file upload handling, are set for an emergency release on October 21, 2026 at 14:00 UTC. Details leaked on October 20 ahead of the planned disclosure. On October 21 at 07:43 UTC, Cloudflare CTO Dane Knecht said Cloudflare is seeing early attacks emerging and is updating its WAF mitigations as new vectors appear, with initial WAF rules deployed to all customers including the free tier. CERT-EU advisory 2026-018 says the flaws could affect all PHP versions from PHP 5 onwards, while fixes are expected only for supported 8.2 and later branches. W3Techs puts PHP on 69.3 percent of sites with a known server side language, and researcher estimates put internet exposed hosts at about 1.3 million to 1.9 million or more. This item upgrades the PHP flaws held on October 20, when no in the wild exploitation had been reported.

Sansec reports that several Dutch sites, including Tweakers, the Tweede Kamer and the National Cyber Security Centre, went offline as a precaution on October 21, and says it expects mass attacks after the release. Proof of concept code claiming to exploit the flaws is circulating but is unverified, according to Tenable. Site operators should apply the PHP update as soon as it is released; a PHP core developer has said patching or upgrading PHP is the only mitigation.

Update, October 21: php.net released the emergency fixes ahead of the planned 14:00 UTC release, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with the GitHub advisories published at 13:34 UTC. PHP now officially confirms both flaws as unauthenticated remote code execution: CVE-2026-109618 works through out-of-memory corruption during request setup, and CVE-2026-109619 through stale global state carried between requests handled by the same worker. Every PHP installation serving web requests is at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php rated the highest risk, and minimal source backports were released for the end-of-life 7.4, 8.0 and 8.1 branches. The UK National Cyber Security Centre is urging organisations to consider taking offline any system that cannot be fixed right away. Wordify reports attackers using a public proof of concept from 08:44 UTC on October 21, blocked by its firewall, and automated scanners checking large numbers of sites from about 12:00 UTC. No source has confirmed a successful break-in.

Further update, October 21: The NSA, the FBI and CISA are urging organisations to update PHP immediately or take affected systems offline until they can be patched, with CISA naming the same fixed versions, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and advising organisations that cannot update immediately, or that still run PHP 8.1 or earlier, to take PHP based systems offline. Palo Alto Networks Unit 42 says its Cortex Xpanse telemetry has identified more than 22.6 million internet exposed instances potentially vulnerable to the two flaws. A Nextgov/FCW analysis using Shodan found roughly 900 United States federal, state and local government sites showing signs of PHP use, many listing older versions, although Shodan may not yet reflect recent updates. Wiz has demonstrated successful attacks against WordPress, Drupal and Joomla installations and showed it could read passwords and credentials from server memory. CISA states it has not observed exploitation as of the time of its publication, which contrasts with the vendor reports of early attacks and scanning recorded above, and no source has yet confirmed a successful break-in in this update.

Further update, October 21: the two flaws were found with frontier AI models. Computer Weekly reports that security firms Wiz and Calif used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to locate and verify vulnerabilities that had gone undetected for more than a decade, coordinating with the PHP team before disclosure. OpenAI says Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet program, with Wiz independently reporting both vulnerabilities, and that it has committed $1 billion in subsidised access to its Daybreak security tooling for under-resourced defenders. The precautionary shutdowns also widened beyond the Dutch sites reported earlier: Finland's state IT provider Valtori took government public services offline, France's Interior Ministry placed its sites into preventive maintenance, Denmark's Kombit shut down several services, and Wikipedia's operator, the Wikimedia Foundation, took an unspecified number of systems down until they could be patched.

Update, October 22: Amazon says the first PHP2Shell exploitation attempt came on October 17, four days before disclosure, while the flaws were still under embargo: its MadPot honeypot was targeted from a commercial anonymization network, further attempts from different sources followed in the hours before disclosure, and multiple proof of concept variants appeared about 12 hours beforehand. Amazon says PHP2Shell is now being broadly exploited in the wild and urges organisations to investigate suspicious activity dating back to October 17. Cloudflare chief executive Matthew Prince said attempts ran to thousands in the 10 hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within 2 hours, and millions by October 22. WatchTowr observed mass exploitation attempts after the patch release while noting that the circulating proof of concepts largely do not achieve remote code execution. On exposure, Censys counted about 1.57 million unpatched hosts among 1.58 million version identifiable hosts seen on October 21, and VulnCheck counted more than 2.6 million internet facing PHP hosts, nearly all vulnerable, with about 1 million on end of life versions.

Update, October 26: BleepingComputer reports that the two PHP2Shell flaws have now been successfully exploited in the wild. Perplexity detection lead Adel Karimi's honeypots recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26, with an 800 KiB decoded cookie dump delivered in the response and a shell command running about 1.6 milliseconds after the execution request. Expel researcher Marcus Hutchins, who has been tracking alleged successful exploitation reports, called it the highest quality confirmation so far. The confirmed success is honeypot evidence, not a confirmed production victim, and earlier reporting through October 22 had found scanning, fingerprinting and non-working exploits with no known compromises. Separately, Palo Alto Networks Unit 42 on Sunday, October 25 retracted its earlier claim that PHP2Shell was used against a European government entity, saying it can no longer confirm that initial access was through these CVEs.

Update, October 27: CISA added both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, 2026, confirming active exploitation of the two flaws. Federal Civilian Executive Branch agencies must secure their systems by October 29, 2026 under Binding Operational Directive 26-04. The Hacker News reports that the KEV addition followed the October 24 honeypot confirmation of successful remote code execution recorded above, and that Censys estimates more than 32.5 million PHP services are still running an affected version. BleepingComputer notes that CISA has not yet shared further details about the ongoing attacks beyond the catalog listing.

Update, October 28: Dream Research reports the first confirmed production victim exploitation of PHP2Shell beyond the October 26 honeypot evidence recorded above. Dream says an attacker chained a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) in a single unauthenticated request to root 25 servers on October 23 to 24, 2026: 24 firewalls of one large unnamed vendor, filtered from about 19,000 internet facing devices found through FOFA to 240 targets in the United States, Japan, Taiwan and South Korea, plus the internal firewall management server, reached through a reboot surviving reverse SSH tunnel built from two rooted firewalls in a United States government affiliated environment. On 22 firewalls the attacker left webshells only; from the management server the attacker decrypted the LDAP service account password, enumerated all domain users and groups, and attempted password spraying, backdoor Active Directory account creation and SAML signing key extraction, with the outcomes of those attempts unknown. Dream says the tunnel and webshells are likely still active. Dream assesses a Chinese nexus, AI assisted operation; that attribution is Dream's inference from Chinese language prompts, FOFA use and target selection, and is not confirmed. Update, October 29: Palo Alto Networks updated its PHP2Shell advisory to say active exploitation has been observed targeting its internet exposed management interfaces. Palo Alto Networks said the two flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution through the PAN-OS management web interface, which includes the HTTPS web UI and XML API service, that no special configuration is required, and that the risk is highest when management access is allowed from external IP addresses on the internet, with hotfixes for some PAN-OS branches still due on October 29 and 30. The Hacker News notes that the timing suggests Dream Research's October 28 report of 25 rooted servers, 24 of them firewalls of one large unnamed vendor, may be related to this Palo Alto Networks activity; neither Dream nor Palo Alto Networks has confirmed that link, and it is not stated as fact here.

Sources: Tenable; Sansec; Patchstack; The Hacker News; Wordify; Defense One; CISA; Unit 42; Computer Weekly; Tesla News Wire; SecurityWeek; Cybernews; BleepingComputer; Machine; BleepingComputer; The Hacker News; Dream Research; SecurityWeek; The Hacker News