CRITICAL ALERT: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) Is Under Active Exploitation

Overview

On October 21, 2026, the PHP security team shipped emergency releases for two critical flaws in the PHP engine itself, now known as PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both are rated CVSS v4.0 9.2 and allow unauthenticated Remote Code Execution (RCE) on servers that handle web requests with PHP.

The disclosure did not go to plan. Details leaked on October 20, two days ahead of the coordinated date, forcing PHP to publish an advance notice that evening and patch the next day. The flaws were found by researchers at Calif, Wiz and OpenAI, with the help of frontier AI models, and Wiz has compared their potential reach to Heartbleed and Log4Shell.

The Threat

Because the bugs live in PHP’s request handling, they fire before any application code runs. That means WordPress, Drupal, Magento, Laravel and custom apps are all exposed through the runtime underneath them, and application-level hardening offers no protection. A successful exploit runs code with the privileges of the web server process.

• CVSS Score: 9.2 (Critical, CVSS v4.0) for each CVE.
• Root Cause: Both stem from PHP leaving memory in a corrupted state when a request ends abnormally. CVE-2026-109618 abuses out-of-memory handling that interrupts PHP while request data is only partly initialized. CVE-2026-109619 abuses request-owned global state that outlives its freed memory and is reused by a later request on the same worker.
• Affected Versions: All PHP releases serving web requests before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, including end-of-life branches back to PHP 5.
• Affected Runtimes: Apache with mod_php (highest risk, with a demonstrated pre-application exploit), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
• Attack Surface: PHP powers an estimated 70% of websites. Shodan alone lists roughly 884,000 internet-facing hosts on PHP 8.1 or older, which will not receive regular fixes.
• Secondary Impact: Wiz also showed attackers can read PHP worker memory containing passwords, API keys and other secrets, a direct feed into identity-based attack paths.

Exploitation Before the Patch

Attackers did not wait for the patch. Amazon Threat Intelligence says its MadPot honeypots recorded a PHP2Shell exploitation attempt on October 17, four days before public disclosure. watchTowr reported in-the-wild exploitation of both CVEs on October 21, and Cloudflare and Fastly confirmed attack attempts against their customers.

Public proof-of-concept code is spreading quickly on GitHub, and Wiz and Datadog have independently demonstrated working exploits. Wiz chained the bugs into unauthenticated RCE against out-of-the-box WordPress, Drupal and Joomla deployments.

The reaction has been unusual. CERT-EU advised isolating internet-facing apps that cannot be patched, government sites across Europe went offline, and even underground forums such as BreachForums and Dread shut down until they could patch. As of October 22, CISA had not yet added either CVE to its KEV catalog.

Immediate Recommendations

PHP states that updating is the only complete fix; no configuration change fully closes either vulnerability.

• Upgrade the PHP runtime serving web traffic to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or the web server so the new build loads.
• On PHP 8.1, 8.0 or 7.4, apply PHP’s minimal source backports or your distribution’s patched package, and plan a move to a supported branch. PHP 7.3 and older get no fix.
• Rebuild container images on a patched PHP base and replace any worker still running the old runtime.

Where patching must wait, reduce exposure and watch closely:

1. Restrict access: Take unpatched internet-facing apps offline or behind a VPN or allowlist, as CERT-EU advises.
2. Apply interim settings: Disable session.upload_progress.enabled, lower post_max_size, and enforce request size limits at the proxy. These narrow specific paths but do not make a server safe.
3. Deploy WAF rules: Cloudflare and other providers have shipped PHP2Shell signatures. Treat them as a temporary layer, since traffic that bypasses the WAF stays exposed.
4. Hunt for compromise: Look for odd multipart requests followed by memory-limit errors, repeated 500s, and malformed PHPSESSID cookies. Alert when php-fpm, httpd or apache2 spawns shells, curl or wget.
5. Continuous detection: Inventory every PHP install, including those bundled in appliances and control panels like cPanel and Plesk, and keep scanning for shadow instances.

How XM Cyber Can Help with CVE-2026-109618 and CVE-2026-109619

PHP2Shell is the Log4Shell moment for web servers. PHP is everywhere, often buried in appliances and legacy hosts nobody remembers owning, and patching it all at once is not realistic. This is exactly the purpose of Continuous Exposure Management: find which instances actually put your business at risk and fix those first.

XM Cyber’s External Attack Surface Management (XM EASM) discovers every external-facing host running a vulnerable PHP runtime, including forgotten and shadow instances. If any are found, the platform maps the end-to-end attack path from the exposed web server into the internal network to validate reachability and exploitability, and flags which instances compromise critical assets.

XM Vulnerability Risk Management (VRM) continuously assesses CVE-2026-109618 and CVE-2026-109619 across internal servers and containers, so teams can see where the old runtime still lives. The XM Cyber research team is also adding PHP2Shell attack techniques to the Continuous Exposure Management (CEM) platform.