Date: October 2026

Severity: Critical

Affected Technologies: PHP 8.2, 8.3, 8.4, and 8.5; Apache with mod_php, PHP-FPM, PHP-CGI, FrankenPHP, LiteSpeed, and applications embedding vulnerable PHP runtimes.

On October 21, 2026, the PHP development team released security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities have a CVSS v4.0 score of 9.2 and could allow unauthenticated attackers to execute arbitrary code with the privileges of the web server process. [1]

The vulnerabilities affect the PHP runtime itself, rather than a particular PHP-based application. PHP is widely used to power websites and content management systems such as WordPress, Drupal, and Joomla. According to the Censys PHP2Shell Exposure Tracker [2] and at the time of writing, approximately 32 million web properties are identified as vulnerable to PHP2Shell. This highlights the potential scale of exposure across internet-facing PHP deployments. However, the tracker’s count of vulnerable web properties should not be interpreted as the number of unique servers or confirmed compromises, as multiple web properties may reside on the same host. 

Technical Details

The first vulnerability, CVE-2026-109618, [3] involves memory corruption when PHP runs out of memory during request initialization. Subsequent cleanup operations may access data that was not fully initialized, potentially allowing remote code execution. The second vulnerability, CVE-2026-109619, [4] involves stale references to memory that has already been released. A subsequent request handled by the same PHP process may access this invalid memory, potentially allowing information disclosure or arbitrary code execution.

PHP states that installations serving web requests may be at risk, including PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP, and LiteSpeed. However, demonstrated exploitability varies by deployment: successful exploitation was confirmed against Apache mod_php for both vulnerabilities and PHP-FPM for CVE-2026-109619. [1]

Exploitation in the Wild

Exploitation attempts have been observed before and after public disclosure. According to Amazon Threat Intelligence [5], an exploitation attempt was detected on October 17, 2026, before the vulnerabilities were publicly disclosed. Cloudflare [6] also reported attack traffic before patches were released, with attackers modifying payloads to evade security protections. Additionally, SecurityWeek [7] reported successful shell execution against three honeypot systems on October 24.

Fixed Versions

The following upstream PHP releases contain fixes for these vulnerabilities [1]:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older branches no longer receive regular upstream security updates. Organizations running these versions should upgrade to a supported release or apply a verified vendor-provided backport. PHP 8.2 is also scheduled to reach end of life on December 31, 2026. [8]

Recommendations

If your organization runs PHP-based applications or web servers, these are the actions you need to take:

1. Identify all PHP installations across production servers, development environments, containers, and third-party or vendor-managed applications.
2. Upgrade immediately to a fixed PHP release or the corresponding security-patched package provided by your operating-system vendor. Restart PHP-FPM or the relevant web server and verify that the running process loads the patched version.
3. Isolate vulnerable systems if immediate patching is not feasible. The NSA guidance [9] recommends taking affected systems offline until they can be fully mitigated. Configuration changes and WAF rules alone do not fully remediate these vulnerabilities.
4. Review logs for exploitation attempts, particularly from October 20, 2026, onward, when details of the vulnerabilities reportedly leaked. Consider reviewing earlier logs as well, given the pre-disclosure activity reported by security vendors.
5. Hunt for indicators of compromise, including PHP or web server worker processes spawning shells, scripting interpreters, or download utilities; reverse-shell commands; unauthorized PHP files in web roots or temporary directories; unexpected scheduled tasks or accounts; suspicious outbound connections; and PHP process crashes.
6. Use network detection as a supplementary control. Corelight’s PHP2Shell detection repository [10] provides open-source Zeek and Suricata detections. These can support monitoring where HTTP traffic is visible, but the maintainers caution that the rules are incomplete and may match benign traffic.
7. Investigate and contain suspected compromises. Isolate affected servers, preserve web server and PHP logs, rotate credentials stored on compromised systems, and assess for unauthorized file access, persistence, and lateral movement.

Organizations should immediately focus on remediation, starting with internet-facing PHP servers and systems that handle sensitive information. Following the reported pre-disclosure activity, and attempts to exploit after disclosure, patching should be followed by an investigation for possible prior compromise. Updating the PHP runtime does not remove persistence that an attacker may already have established.

References:

1. PHP Official Security Announcement [October 21, 2026]
2. Censys – PHP2Shell Services Tracker
3. CVE-2026-109618 – Official PHP Security Advisory
4. CVE-2026-109619 – Official PHP Security Advisory
5. Amazon Threat Intelligence – Pre-Disclosure Exploitation
6. Cloudflare – PHP Vulnerabilities and WAF Protection
7. SecurityWeek – PHP2Shell Exploitation Moves From Probes to Working Shells
8. PHP Supported Versions
9. NSA Advisory on Critical PHP Vulnerabilities
10. Corelight – Open-Source PHP2Shell Detection Rules