PHP2Shell Exploitation Started Days Before Patches

Two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, were publicly patched on October 21, 2026. Exploitation attempts were observed as early as October 17, prior to patch release, originating from anonymized IP addresses, indicating threat actor activity under embargo. After patch disclosure, proof-of-concept exploits proliferated rapidly, with mass scanning and exploitation attempts detected by multiple security firms and cloud providers. While many exploit attempts failed or caused crashes, some attempts to deploy webshells were reported but unsuccessful. Over one million internet-facing PHP servers remained unpatched at disclosure, many running unsupported or end-of-life PHP versions. The US Cybersecurity and Infrastructure Security Agency (CISA) recommended immediate updates to patched PHP versions. Experts warn that the vulnerability's impact is significant due to widespread forgotten PHP instances and the difficulty in identifying all affected systems, drawing parallels to the Log4Shell incident. Temporary mitigations include restricting web server process capabilities until patching is complete.

The vulnerabilities allow remote code execution on affected PHP servers, potentially enabling attackers to execute arbitrary code. Exploitation attempts began before patches were publicly available, increasing risk. Although many proof-of-concept exploits are ineffective or cause crashes, the widespread presence of unpatched PHP servers—many running end-of-life versions—creates a large attack surface. The vulnerabilities have been actively scanned and exploited in the wild shortly after patch release. This could lead to unauthorized access, webshell deployment, and further compromise of affected systems if unpatched.

Official patches addressing both PHP2Shell vulnerabilities were released on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations should immediately apply these updates to all PHP installations. Until patching is complete, it is recommended to implement controls that restrict what web-facing PHP processes can execute or access, limiting their permissions to only necessary files and network services. These controls serve as a temporary mitigation and are not substitutes for patching. Continuous monitoring for signs of compromise is advised given the active exploitation attempts.