PHP2Shell patches are out and attackers are already trying them. Confirm every PHP server runs the new version

We flagged PHP’s emergency release in yesterday’s brief. It shipped on Wednesday with two CVEs, now called PHP2Shell, that can let an attacker run code on a web server without logging in.

Attack attempts started around the same time. watchTowr says both bugs are hitting its sensors, though it has not seen one succeed yet. CISA, the UK NCSC and EU agencies told organisations to patch now or take PHP systems offline.

PHP2Shell patches are out and the first attack attempts are already hitting sensors. Check that every PHP worker is actually running the new version.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

PHP2Shell fixes are out and attack attempts have started

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. CVE-2026-109618 is code execution through memory corruption when a request hits PHP’s memory limit at the wrong moment. CVE-2026-109619 lets internal state from one request point at freed memory that a later request on the same worker uses. Both are rated 9.2 under CVSS v4.0.

PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, with a demonstrated exploit that fires before any application code runs.

Cloudflare said it saw attack traffic against its customers after the leak, with attackers changing payloads to get past its WAF rules. Hadrian reported exploitation “at scale” through PHP’s session upload-progress path, according to SecurityWeek. CISA said it had not observed exploitation when it published its alert.

mod_php servers and anything still on PHP 8.1 or older

The PHP project does not ship builds for PHP 8.1 and older. Its security team posted minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions and LTS vendors received the patch in advance, so check your vendor’s packages. The volunteer remirepo repository said it would not have updates on release day.

The PHP Foundation says Chainguard published patched images more than six hours before the coordinated release, which gave attackers an early look at the fix.

Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker

• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from your distribution, vendor or php.net, starting with internet-facing servers that run mod_php.
• Restart PHP-FPM pools and Apache afterwards, then confirm the running version, not just the installed package.
• Where you cannot patch today, set session.upload_progress.enabled=0 in php.ini or the pool config and restart workers. PHP says this blocks the confirmed session path but not other variants.
• Ask hosting providers for the date they patched your accounts.

Details

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via out-of-memory corruption, CVSS v4.0 9.2.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state, CVSS v4.0 9.2.
• Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Source backports for 7.4, 8.0, 8.1. Not in CISA KEV as of October 21.

Hunt / verify

• Watch for PHP worker processes launching shells or downloading tools, which is the activity CISA asks defenders to look for.
• Search web logs for unusually large multipart POSTs and requests carrying PHP_SESSION_UPLOAD_PROGRESS fields to pages that take no uploads.
• Check php -v and php-fpm -v (or the versioned binaries) on each host after the restart.

Source: PHP security advisory, October 21, 2026; CISA alert

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• watchTowr: PHP2Shell, PHP Remote Code Execution Exploited
• SecurityWeek: PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability
• The PHP Foundation: Today’s PHP Security Release
• CVE.org: CVE-2026-109618
• CVE.org: CVE-2026-109619

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].