PHP2Shell Exploitation Confirmed: Organizations Urged to Patch Critical PHP Vulnerabilities

Organizations running PHP should prioritize security updates and investigate potential exposure following reports of exploitation attempts and successful exploitation demonstrations involving two critical vulnerabilities collectively known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619.

The PHP development team released security updates on October 21, 2026, addressing both vulnerabilities. The flaws can allow unauthenticated attackers to execute arbitrary code remotely under vulnerable conditions, creating significant risks for internet-facing web servers and applications.

Threat intelligence reports indicate that exploitation attempts began before the vulnerabilities were publicly disclosed. Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to October 17, 2026, while researchers subsequently demonstrated successful exploitation in a honeypot environment.

These findings reinforce the need for organizations to treat PHP2Shell as an urgent security issue. However, evidence of successful exploitation in a particular environment does not mean every PHP deployment can be compromised using the same technique.

The immediate priority is to identify affected PHP installations, apply the appropriate security updates, and investigate whether any vulnerable systems were compromised before remediation.

What Is PHP2Shell?

PHP2Shell is the name associated with two critical vulnerabilities in the PHP runtime that may allow unauthenticated remote code execution (RCE).

Unlike vulnerabilities limited to a particular web application, these flaws affect PHP's underlying request-processing and memory-management behavior. Consequently, organizations may be exposed through vulnerable PHP installations even when their application code has not been identified as the source of the problem.

The two vulnerabilities are:

CVE-2026-109618: Remote Code Execution Through Out-of-Memory Handling

This vulnerability involves PHP's handling of out-of-memory (OOM) conditions during request processing.

When memory allocation fails while internal request data is only partially initialized, subsequent cleanup operations may handle invalid state incorrectly. Under exploitable conditions, this memory corruption can potentially lead to arbitrary code execution.

A demonstrated attack showed that a single unauthenticated request could trigger the vulnerability before application code executes.

CVE-2026-109619: Remote Code Execution Through Stale Internal State

This vulnerability involves stale internal state and pointers that can persist after the memory associated with a request has been freed.

If a later operation reuses this stale state before normal initialization resets it, the resulting memory-management error may create another path to remote code execution.

The vulnerabilities are particularly concerning because exploitation can target PHP's runtime behavior rather than relying exclusively on a weakness in an individual application's business logic.

For official technical details, consult the PHP security advisories.

PHP2Shell: What the Latest Threat Intelligence Reveals

The response to PHP2Shell has developed rapidly, with security researchers and threat intelligence teams reporting activity both before and after public disclosure.

October 17, 2026: Exploitation Attempt Detected Before Public Disclosure

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt in its MadPot telemetry on October 17, four days before public disclosure of the vulnerabilities.

The activity originated from an IP address associated with a commercial anonymization network. This discovery indicates that exploitation attempts were already occurring before organizations could respond to the public security announcement.

October 21, 2026: Emergency Security Updates Released

The PHP development team released security updates for the affected PHP branches. Security organizations subsequently published technical analyses and defensive guidance as details of the vulnerabilities and proof-of-concept exploits became available.

The availability of public technical information increases the importance of rapid patching, asset discovery, and monitoring for suspicious activity.

October 26, 2026: Successful Exploitation Demonstrated

Adel Karimi, Head of Detection and Response at Perplexity, reported evidence of successful exploitation through a honeypot running Apache mod_php with PHP 8.4.26.

The investigation identified memory data that could be used during subsequent exploitation stages. Marcus Hutchins, a threat researcher at Expel, also confirmed the findings.

The demonstration establishes that the attack technique can work under the tested conditions. However, the researchers noted that the single-worker configuration used in the test favored exploitation, so the findings should not be interpreted as proof that all production environments are equally exploitable.

Security takeaway: Organizations should not wait for evidence of a successful attack against their own infrastructure before applying the available fixes.

Sources: Amazon Threat Intelligence and Wiz Research.

Which PHP Versions Are Affected?

The PHP security releases published on October 21, 2026, address CVE-2026-109618 and CVE-2026-109619 in the following supported release branches.

Versions earlier than the corresponding fixed release in each listed branch are affected by the PHP2Shell vulnerabilities.

The investigation reported by Wiz indicates that PHP versions dating back to PHP 5.4 may be affected by at least one of the vulnerabilities. Organizations using older or unsupported branches should therefore not assume their systems are safe simply because they are not running a recently released version.

PHP 8.1 and older versions no longer receive security updates from the main PHP project. Some operating system vendors and long-term support providers may supply backported fixes, so administrators should verify the status of their specific packages.

For the latest release information, consult the official PHP 2026 release archive.

Additional Risk: CVE-2026-115560 Remains a Separate Security Concern

Beyond PHP2Shell, security researchers have also reported CVE-2026-115560, a related vulnerability involving PHP's Session Upload Progress functionality.

Importantly, this issue is distinct from CVE-2026-109618 and CVE-2026-109619. Applying the PHP2Shell security updates does not, by itself, establish that CVE-2026-115560 has been resolved.

As of the latest reports available on October 27, 2026, the vulnerability had been disclosed as an additional security concern affecting even the patched PHP2Shell releases. The PHP project indicated that a fix would be included in a subsequent regular release.

As an interim measure, administrators can disable Session Upload Progress where the feature is not required:

session.upload_progress.enabled=0

After changing the configuration, verify that the setting is effective in the relevant PHP runtime and that application functionality remains intact.

Organizations should monitor official PHP security advisories and vendor announcements for confirmation of the fixed release. This configuration change should be treated as a targeted mitigation, not a permanent substitute for a security update.

For further context, see Cloudflare's PHP vulnerability protection update.

How Could PHP2Shell Affect Your Organization?

Successful remote code execution can give attackers the ability to run unauthorized commands under the privileges of the affected PHP process. Depending on the environment, this may lead to several business risks.

1. Sensitive Data Exposure

Attackers may attempt to access application configuration files, database credentials, API keys, or other information available to the compromised process.

If those credentials grant access to additional systems, the incident may extend beyond the original web server.

2. Web Shells and Persistent Access

An attacker may attempt to deploy a web shell or another mechanism to maintain access after the initial exploitation.

Consequently, patching the vulnerability is essential but may not be sufficient if the server was already compromised. Organizations should investigate suspicious files, processes, scheduled tasks, and other persistence mechanisms.

3. Lateral Movement Across Internal Systems

A compromised web server can provide an entry point for probing internal networks, accessing connected services, or attempting to reuse stolen credentials.

Network segmentation and least-privilege access controls can reduce the potential impact of such activity.

4. Business Disruption

Unauthorized changes to application files or data, service outages, and incident response activities may affect business operations and increase recovery costs.

The actual impact depends on the privileges obtained, the systems accessible from the compromised host, and the effectiveness of existing security controls.

6 Recommended Actions to Mitigate PHP2Shell

Organizations should combine immediate remediation with verification and ongoing monitoring.

1. Identify All PHP Assets

Build an inventory of PHP installations across production servers, development environments, containers, websites, and third-party applications.

Check internet-facing assets first, but do not overlook internal systems or software products that embed PHP.

2. Apply the Appropriate Security Updates

Upgrade affected PHP installations to the fixed release for the relevant supported branch.

For systems managed by Linux distributions, cloud platforms, hosting providers, or commercial vendors, verify whether the applicable security package has been released and installed.

Test application compatibility and confirm that the running PHP runtime—not merely the package repository or deployment configuration—uses the intended version.

3. Restrict Exposure if Immediate Patching Is Impossible

If an affected system cannot be patched immediately, assess whether access can be restricted or the application temporarily isolated from public networks.

Follow vendor-specific mitigation guidance and evaluate the operational impact before implementing temporary controls.

The PHP project has stated that there are no complete mitigations for the original PHP2Shell vulnerabilities. Updating to a fixed release remains the recommended solution.

4. Investigate Signs of Previous Exploitation

Review web server access logs, process execution records, endpoint detection alerts, and other available telemetry for activity that may indicate exploitation.

Look for unexpected command execution by web server processes, suspicious child processes, unusual outbound connections, and unauthorized changes to application files.

Investigate the period before patch deployment as well as activity afterward.

5. Review Credentials and Access Permissions

If there is evidence or a credible suspicion of compromise, determine which credentials and secrets were accessible to the affected process.

Rotate potentially exposed credentials, revoke unauthorized sessions or tokens, and enforce least privilege across connected systems.

6. Strengthen Detection and Incident Response

Ensure security monitoring covers web servers and the infrastructure they connect to. Correlate alerts across application, host, network, and identity telemetry where available.

Establish clear procedures for isolating compromised systems, preserving forensic evidence, removing persistence mechanisms, and validating system integrity before returning services to production.

Conclusion: Patch PHP2Shell and Verify That Your Systems Are Secure

PHP2Shell highlights the risks posed by critical vulnerabilities in widely deployed software runtimes. Reports of exploitation attempts before public disclosure, combined with subsequent demonstrations of successful exploitation, make timely remediation a priority for organizations operating PHP-based services.

Security teams should identify vulnerable assets, install the appropriate PHP security updates, investigate possible prior compromise, and address the separate risk associated with CVE-2026-115560.

Most importantly, organizations should recognize that vulnerability remediation does not end when a patch is installed. Confirming the effective runtime version, reviewing suspicious activity, and investigating signs of previous access are essential parts of a complete response.

BigFish Tec encourages organizations to strengthen vulnerability management, security monitoring, and incident response capabilities to reduce exposure to emerging cyber threats and protect business-critical systems.

References

1. PHP Official Release Archive — 2026

2. Wiz Research — PHP2Shell: Critical PHP RCE Vulnerabilities

3. Amazon Threat Intelligence — PHP2Shell Exploitation Before Public Disclosure

4. Cloudflare — Protection Against PHP Vulnerabilities

5. CERT-EU — Critical Vulnerabilities in PHP

Editorial note: This article reflects publicly available information reviewed as of October 27, 2026. Verify the latest PHP security advisories and vendor-specific patch status before publication, particularly for CVE-2026-115560.