PHP2Shell vulnerabilities exploited before patches, with millions of attacks detected after release

Amazon detected an exploitation attempt targeting PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, 2026—four days before their public disclosure. The PHP Foundation released emergency patches on October 21, 2026, one day earlier than planned after a leak of vulnerability details disrupted coordinated disclosure efforts. These flaws affect all PHP versions released in the last decade, including PHP 5.4 and later, enabling unauthenticated remote code execution (RCE) and server takeover.

PHP powers approximately 69.7% of websites with known server-side programming languages, including major content management systems (CMS) like WordPress, Drupal, Joomla, and Magento. The vulnerabilities, discovered by security researchers at Calif, Google Cloud’s Wiz, and OpenAI’s Patch the Planet project in Aug. 2026, pose a critical risk due to their widespread adoption and the ability to execute arbitrary code without authentication. The US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) urged organizations to apply patches immediately or take websites offline as a precaution.

Exploitation attempts intensified rapidly after the patch release. Cloudflare observed thousands of probes in the 10 hours before disclosure, escalating to tens of thousands within 45 minutes post-announcement, hundreds of thousands within two hours, and millions shortly thereafter. Over 1 million PHP servers remained unpatched as of October 21, 2026, with approximately 1.57 million internet-facing hosts exposed, according to Censys. VulnCheck further reported that over 700,000 servers run end-of-life (EoL) PHP versions (3.x through 7.3), and 400,000 run unsupported versions (7.4, 8.0, or 8.1), leaving them without official fixes.

The FBI advised monitoring web servers for suspicious activity, such as PHP processes unexpectedly launching command shells or downloading files, as indicators of exploitation. CrowdStrike noted that compromised endpoints may only show a memory-limit fatal error in server logs, making detection difficult.

Government websites in the Netherlands, Finland, and France were taken offline as a precautionary measure before applying patches. South Korea, China, and Japan also issued emergency cybersecurity measures, including patching guidance and heightened alert levels. The US National Security Agency (NSA) emphasized the urgency of patching, stating that the vulnerabilities could lead to severe consequences if left unaddressed.

Official patches are available only for supported PHP branches (8.2 and later), including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations using unsupported versions must migrate to supported branches to receive fixes. Cloudflare deployed web application firewall (WAF) rules to protect customers, including free-tier users, but emphasized that these are stopgap measures. Gina Peter Banyard, a PHP core developer, stated, “The only mitigation is patching / upgrading PHP.”

Exploitation attempts originated from several IP addresses associated with commercial anonymization networks, indicating involvement by several threat actors. VulnCheck identified hosts 85.11.167[.]243 and 45.198.224[.]169 using a specialized user-agent to target honeypots, suggesting weaponized scans designed to exploit CVE-2026-109618.

AI-assisted analysis has reduced the time required to develop working exploits, enabling threat actors to act quickly once technical details are disclosed. Sai Molige noted, “PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason.” Organizations are advised to disable vulnerable functionality, restart PHP workers, and strengthen perimeter defenses while patching. Pantheon reported blocking over 60,000 suspicious requests probing the vulnerability, highlighting the scale of early exploitation attempts.

Immediate defender actions

Defenders should prioritize patching supported PHP versions (8.2.35, 8.3.36, 8.4.27, and 8.5.12) immediately. Organizations using unsupported versions must migrate to supported branches. Monitor PHP error and access logs for memory-limit fatal errors or suspicious PHP process activity. Review and update web application firewall (WAF) rules to block known exploitation patterns, and disable vulnerable functionality as a temporary measure while patching is underway.