PHP team releases emergency fixes for PHP2Shell remote code execution flaws

This is a new development in a story we reported earlier: PHP releases emergency patches for PHP2Shell flaws as exploit attempts rise.

The PHP development team released emergency fixes Oct. 21, 2026, for two critical vulnerabilities that let attackers run code remotely on web servers without authentication.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell, allow unauthenticated remote code execution on every PHP installation serving web requests. Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers Apache with mod_php the highest-risk configuration. Official security updates cover only PHP 8.2 and later, although versions after PHP 5.4.0 can be affected.

The PHP development team issued patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA recommends updating to those same releases. PHP 7.4, 8.0 and 8.1 have separate minimal fix code that requires manual application or vendor confirmation.

CISA urges organizations to inventory every PHP installation and take unpatched systems offline when immediate updates are impossible. CISA said no confirmed exploitation in live attacks had been observed as of publication. The National Security Agency and other agencies also recommend taking affected systems offline while updates proceed.

The UK National Cyber Security Centre advises organizations to scan for PHP installations, evaluate compromise risks and remove unpatched systems from active use. ENISA, the European Commission, CERT-EU, Europol’s European Cybercrime Centre and EU national computer security teams released a joint statement Oct. 21. It urged immediate patching and prioritization of internet-facing systems. ASD’s ACSC advises monitoring for patch releases and says versions from PHP 5 onward may be affected.

The Canadian Centre for Cyber Security classified the flaws as Use After Free vulnerabilities (CWE-416) and warned internet-exposed PHP servers face heightened risk. Palo Alto Networks estimated more than 22 million potentially affected exposed PHP instances. W3Techs estimates PHP runs on approximately 75 percent of websites where the server-side language can be detected, while another estimate puts roughly 70 percent of worldwide websites with identified programming languages on PHP.

An exploitation attempt appeared in Amazon Threat Intelligence’s MadPot honeypot network on Oct. 17, 2026, four days before public disclosure. Fastly said it has seen evidence of active attacks across its global network. Unit 42 researchers saw threat actors use agentic AI attack platforms for post-exploitation activity against a European government body.

The threat intelligence team confirmed it has seen an exploit proof of concept. “Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.” — Palo Alto Networks’ Unit 42 threat intelligence team

In one observed case, attackers took password hashes and multifactor authentication secrets within two hours of initial exploitation and tried Domain Admin privilege escalation. Wiz researchers said frontier AI models made exploiting the longstanding flaw substantially easier. The flawed code has existed in PHP for decades.

Fastly’s chief product officer described the volume of PHP traffic on the company’s network. “We observe many billions of PHP requests a day across Fastly’s global network, and we are seeing evidence of active attacks.” — Kelly Shortridge, Fastly Chief Product Officer

CVE-2026-109618 relates to out-of-memory handling that interrupts PHP while request data remains partially initialized. For CVE-2026-109619, backing memory is freed while stale global state survives. A single unauthenticated request can start the attack before application code runs.

A code-base audit financed by OpenAI Group PBC in August 2026 used GPT-5.6 Sol to scan PHP, and a Calif.io Inc. employee carried it out. Cloudflare released web application firewall (WAF) rules and updated its content delivery network (CDN) to shield customers, though it stressed that patching remains necessary. Fortinet is reviewing 12 products, and Cisco is reviewing 31 products and cloud services, with no confirmed vulnerable product yet.

Palo Alto Networks said PHP2Shell affects all versions of PAN-OS and Panorama, but fixed releases have not shipped yet. CrowdStrike Holdings Inc. and other enterprise providers added mitigations to their products. OpenAI released a tool to help Codex users find vulnerable PHP installations.

Searchlight Cyber released an open-source scanner that checks whether hosts are exposed to the two PHP flaws. Stealien offers a free online inspection service that checks for PHP2Shell vulnerabilities. Everspin added attack-blocking rules for Eversafe for Web SaaS customers, and Theori Inc. reproduced and verified the vulnerability before releasing an emergency response guide.

Temporary measures such as adjusting memory limits and restricting file upload functions lower risk without fixing the vulnerability. System administrators are told to review access logs and PHP error logs for unusual requests, unauthorized file creation or unexpected process execution. A suspected compromise calls for isolation, malware removal and credential changes.

On Oct. 21, 2026, the patch consortium moved up its release after the vulnerability leaked on a developer forum, having originally planned a Thursday rollout. The industry fix effort generated more than 10,000 lines of code spanning more than 20 PHP files.

Since Sept. 11, 2026, manufacturers must disclose actively exploited vulnerabilities through the Single Reporting Platform under the Cyber Resilience Act. The regulation’s main requirements take effect Dec. 11, 2027. Australian officials said operators temporarily removed some government websites from service while applying mitigations, and one European government pulled its website from public access as a precaution.