PHP project rushes PHP2Shell patches after leak and exploit surge

The PHP project released patches on Oct. 21, 2026, for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, after technical details leaked online a day earlier and attackers began probing internet-facing servers. Known together as PHP2Shell, the flaws allow unauthenticated remote code execution, which lets an attacker run commands on a server, and may enable server takeover on PHP versions back to 5.4.

Security researchers at Calif and Google Cloud’s Wiz discovered the flaws in August while working with OpenAI’s Patch the Planet project. Calif found the first flaw on Aug. 1 using OpenAI’s GPT-5.6 Sol and reported it to the PHP security team around Aug. 11. Wiz reached the same codebase on Aug. 19 using its Wiz Atlas platform, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Sol, confirmed unauthenticated code execution against Drupal and WordPress over the next two days, and notified the PHP security team on Aug. 24.

The PHP security team had planned a coordinated release with Calif, Wiz, Cloudflare, OpenAI, and Quarkslab for Oct. 22, but moved the patches forward after the Oct. 20 leak. The project issued PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Oct. 21, and each version closes both vulnerabilities. Each flaw carries a CVSS v4.0 severity rating of 9.2 out of 10.

The flaws affect PHP-FPM (FastCGI Process Manager) and Apache servers running with mod_php, an Apache module that embeds the PHP interpreter. CVE-2026-109618 involves the PHP engine’s reaction to running out of memory during a request, leaving internal request data partially initialized and treated as trustworthy by cleanup routines. CVE-2026-109619 lets request-owned internal state persist after its backing memory is freed, enabling a later request handled by the same PHP worker to act on stale values before initialization resets them.

Amazon’s MadPot honeypot network logged the first PHP2Shell exploitation attempt on Oct. 17, four days before the patches were publicly available. The attempt came from an IP address tied to a commercial anonymization network, which Amazon said suggests a threat actor was responsible. Amazon said PHP2Shell is now seeing broad exploitation in the wild. Amazon identified multiple proof-of-concept exploits on Oct. 21, roughly 12 hours before the scheduled public disclosure at 2 p.m. GMT, with the earliest detected at approximately 2 a.m. GMT.

Cloudflare saw thousands of PHP2Shell exploitation attempts across its network in the 10 hours before the public announcement. The count reached tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and millions by early Oct. 22. WatchTowr observed mass exploitation attempts shortly after the PHP project released the patches, but none of the circulating proof-of-concept exploits achieved remote code execution. Hadrian, Patchstack, and Cloudflare all reported seeing exploitation attempts hours before the PHP project released the fixes.

More than 1 million PHP servers were running unpatched software releases as of Oct. 21, according to VulnCheck, VirusTotal, and Censys. Censys saw roughly 2.58 million internet-facing hosts on Oct. 21, about 1.58 million reporting identifiable PHP versions and approximately 1.57 million unpatched. About 920,000 of the vulnerable PHP hosts are in the U.S., running mainly on AWS, DigitalOcean, Alibaba, OVHcloud, and Hetzner.

W3Techs data indicates PHP runs on approximately 69.7% of websites with a known server-side programming language. Patches exist only for supported PHP branches starting at version 8.2; PHP 8.1 and earlier, including all PHP 7 and PHP 5 releases, will not get official fixes. PHP states that updating is the only complete fix for the two vulnerabilities.

Organizations that cannot patch immediately have limited options. Mitigations include disabling vulnerable functionality where applicable and restarting PHP workers after configuration changes. Defenders can block unwanted multipart/form-data requests at the edge and cap request body size, multipart sections, and header counts.

Cloudflare said its free and paid web application firewall customers had default protection against PHP2Shell, and it began deploying WAF protections about nine hours before the PHP project released the official patch. Cloudflare CTO Dane Knecht said attackers kept altering payloads to circumvent each newly deployed defensive rule. CISA urged organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

Japanese organizations took online services or app features offline as a precaution, including Mizuho Bank, Mitsubishi UFJ Morgan Stanley Securities, Shizuoka Bank, All Nippon Airways, Japan Airlines, East Japan Railway, and the National Tax Agency. Japanese Prime Minister Sanae Takaichi issued an urgent public post on X calling on website operators to apply the fix immediately and said her office had taken its own website down.

Dutch responders pulled several services offline: the National Cyber Security Centre’s own site, the MijnOverheid citizen portal, the House of Representatives website, the Port of Rotterdam, and multiple hospital sites. Valtori, Finland’s state IT provider, powered down government public-facing web services as a safety step and said no breach took place. France’s Interior Ministry cut access to local government administrative sites, while the Finance Ministry portal and Météo-France also went offline.

Orange took some PHP-based services offline to patch them urgently, a move separate from a major mobile network outage the carrier blamed on equipment failure and said had no link to PHP2Shell. Kombit, Denmark’s municipal IT body, pulled several services offline, including the state school communication platform.

Canada’s Cyber Centre and Australia’s cybersecurity agency issued advisories urging organizations to patch or take vulnerable systems offline, while confirming they had detected no successful exploitation at the time of publication. Spain’s Instituto Nacional de Ciberseguridad sent a critical-level alert, the top tier on its scale, and told organizations to patch right away or remove public network access to exposed servers.

BlueVoyant CISO John Harbaugh said patching quickly will be difficult, and the bigger challenge is locating all systems requiring updates, including forgotten applications, shadow systems, and unknown PHP installations. ThreatLocker co-founder and CTO Michael Jenkins said stakeholders should apply emergency updates immediately and investigate for signs of compromise. Forescout threat hunting senior manager Sai Molige said PHP2Shell has the potential to become a Log4Shell-scale event but for different reasons, because attackers may find forgotten PHP infrastructure without an upstream fix.