PHP2Shell: critical PHP RCE exploited, patch now
Patches for PHP2Shell landed on October 21, but CISA has since added both CVEs to its Known Exploited Vulnerabilities Catalog after honeypot evidence of remote code execution. This is no longer a theoretical risk for unpatched PHP.
TechShield Team
Why this matters now
CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, allow unauthenticated remote code execution on unpatched PHP. The CVSS v4.0 score is 9.2, and RCE has been confirmed on Apache with mod_php according to SecurityWeek. PHP Foundation says both flaws sit in memory management and error handling, paths that nearly every request touches, which made them serious and hard to fix.
According to Unit 42, CVE-2026-109618 stems from improper control-flow handling around out-of-memory errors with longjmp(), leaving request memory uninitialized. CVE-2026-109619 leaves global memory pointing to freed regions after longjmp() fatal-error handling; later requests can read or branch on that stale pointer. SecurityWeek also notes the flaws can be used to read sensitive process memory such as credentials and API keys.
Affected versions and scope
Patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Minimal source backports were also released for PHP 7.4, 8.0, and 8.1. PHP maintainers say every installation that handles web requests is potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
| PHP branch | Fixed release | Support status |
|---|---|---|
| 8.5 | 8.5.12 | Active support until 31 Dec 2027 |
| 8.4 | 8.4.27 | Active support until 31 Dec 2026 |
| 8.3 | 8.3.36 | Security fixes only until 31 Dec 2027 |
| 8.2 | 8.2.35 | Security fixes only until 31 Dec 2026 |
Branches 8.1 and older are end of life. The source backports for 7.4, 8.0, and 8.1 do not replace an upgrade plan, because those branches will not receive regular security fixes. SecurityWeek also reports that the flaws affect nearly all PHP releases back to version 5.4.
On scale, PHP powers roughly 70% of all websites, with more than 5.1 million PHP hosts exposed online and about 3.8 million instances with at least one port open, according to VirusTotal estimates cited by BleepingComputer. Unit 42 observed more than 22.6 million potentially vulnerable exposed instances in its telemetry.
Exploitation timeline
Information leaked on October 20, prompting PHP to release fixes on October 21, a day earlier than planned. Proof-of-concept exploits began circulating before the patch. PHP's security team said none were functional before release, but Amazon observed attackers targeting the flaws four days before patches landed. Cloudflare, Hadrian, Patchstack, Previdian, and watchTowr also saw widespread attempts that were initially tagged as unsuccessful.
Over the weekend, Perplexity confirmed RCE in a honeypot against Apache mod_php running PHP 8.4.26. CISA then added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities Catalog and ordered FCEB agencies to remediate by Thursday under Binding Operational Directive 26-04. BOD 26-04 applies only to FCEB agencies, but CISA encourages all organizations to prioritize KEV-listed flaws through risk-based vulnerability management.
Hadrian says most observed attacks abuse PHP's session upload-progress path. If you cannot patch immediately, that path should be at the top of your log and detection review.
What to do now
- Build a complete inventory of PHP web-request handlers, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, containers, and hosts behind reverse proxies.
- Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on the branch you run.
- For 7.4, 8.0, and 8.1, apply the source backport while immediately planning an upgrade to a supported branch.
- If patching is not possible, apply PHP Foundation's exposure-reduction measures. They reduce specific attack paths, not make the installation safe.
- Update vendor detection rules and monitor CISA's KEV catalog for new exploitation details.
What to watch next
Hadrian expects more exploit paths to appear before and after the fix is deployed. Wiz notes that CVE-2026-109618 and CVE-2026-109619 group four memory-safety issues and do not cover every variant; tracked and likely untracked variants exist. Treat these patches as a required priority, not a final step.
PHP's security team also shared mitigation for CVE-2026-115560, a separate no-patch RCE flaw that requires an unusual combination of configuration and application code. Keep monitoring PHP Foundation and CISA advisories as vendors expand detections and governments refine remediation guidance.
