PHP2Shell attacks now open working shells. Patch every PHP server and check it for intruders by Thursday

For a week, PHP2Shell was a flood of attempts with no confirmed break-ins. That changed over the weekend. A researcher’s honeypots recorded attackers running shell commands on PHP 8.4.26, and on Monday CISA added both flaws to its Known Exploited Vulnerabilities catalog with a federal deadline of Thursday, October 29.

We flagged on October 23 that patched servers still needed a log review. Now the attacks work, so any server that sat unpatched over the weekend needs both the update and a look for planted files.

PHP2Shell moved from crashes to working shells over the weekend. CISA now gives federal agencies until Thursday, and it wants a forensic check, not just a patch.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Honeypots caught working PHP2Shell shells, and CISA listed both bugs

Adel Karimi, detection and response lead at Perplexity, runs honeypots that serve ordinary PHP pages on PHP 8.4.26 under Apache mod_php with a single worker. On October 24 they recorded 35 shells across three honeypots from two IP addresses, SecurityWeek reports. The attackers used a four-step chain of requests: some exhausted PHP’s memory, some leaked memory contents, and the last ran a shell command. The traffic closely matched a public proof of concept.

Karimi warned that his setup was deliberately favorable and does not measure how reliable the exploit is against other worker counts or builds. Expel researcher Marcus Hutchins called it “by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far.” On Sunday a researcher also took the prize in a public capture-the-flag contest built on a stock PHP 8.4.26 server, 19 hours after the server went up, according to GovInfoSecurity.

CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on October 26 with a due date of October 29, and marked both as requiring forensic triage under BOD 26-04. Its alert says the flaws affect every PHP installation that serves web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

Any web server still on an older PHP build

BleepingComputer, citing VirusTotal estimates, puts the number of PHP hosts exposed online at more than 5.1 million. CISA notes that PHP often ships inside other products, so the copies nobody thinks of as “PHP servers” are the ones most likely to be missed: vendor appliances, control panels, container images and old intranet apps.

Patching closes the hole but does not remove anything an attacker already put on the box. That is why CISA’s KEV entry asks agencies to check for compromise as well. Palo Alto Networks says PAN-OS and Panorama management interfaces are affected too, with the remaining hotfixes due between October 27 and October 30.

Patch, then check each server for shells by Thursday

• Move every PHP install to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, starting with anything reachable from the internet. Check the version the web server actually loads (a phpinfo() page or php-fpm -v), not only the CLI.
• If a server runs PHP 8.1 or older, CISA says take it offline until it is upgraded. There is no fixed build for those branches.
• Ask vendors of appliances and hosted apps that bundle PHP for their fixed version and date, and write down the answer.
• For any server that was unpatched on or after October 24, look for shells, new PHP files in web roots and new cron jobs before calling it done.
• Keep PAN-OS and Panorama management access limited to trusted internal addresses until your hotfix is installed.

Details

• CVEs: CVE-2026-109618 (memory corruption on out-of-memory handling) and CVE-2026-109619 (stale request state), both unauthenticated remote code execution. Added to CISA KEV October 26, 2026; due October 29, 2026; forensic triage required.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21. PHP 8.1 and earlier are unsupported.
• Separate, unpatched PHP flaw: on October 23 PHP shared a mitigation for a new code execution bug that needs an unusual mix of configuration and application code. Its advice is session.upload_progress.enabled=0 until a fix ships (BleepingComputer).
• PAN-OS hotfixes: 10.2.18-h13, 11.1.16-h4, 11.2.10-h16, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16 are out; 10.2.13-h27 and 11.2.13-h4 are due October 27, and the rest by October 30.

Hunt / verify

• Look for PHP worker processes (php-fpm, apache2, httpd, lsphp) with child processes such as sh, bash, curl or wget. CISA’s alert links a Sigma rule for this.
• Karimi’s honeypots logged bursts of PHP out-of-memory errors and worker crashes before the first shell. Search error logs for clusters of “Allowed memory size” errors followed by segfaults from the same client.
• List PHP files changed in web roots since October 17, for example find /var/www -name "*.php" -newermt 2026-10-17, and compare them against your deploys.
• If you are building the triage habits a week like this needs, our CySA+ exam guide covers the log and process analysis behind these checks.

Source: CISA PHP alert, updated October 26; CISA KEV addition

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 26, 2026)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• CISA Known Exploited Vulnerabilities Catalog
• SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells
• BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild
• GovInfoSecurity: Honeypots Now Recording In-the-Wild PHP2Shell Exploits
• Palo Alto Networks: Impact of CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks products

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].