PHP2Shell: five days from patch to 'known exploited'

On 21 October, PHP shipped emergency releases for two critical bugs now known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 out of 10 and can let an attacker with no login run code on a web server [1][4]. Five days later, CISA added both to its list of vulnerabilities known to be exploited [1].

The timeline shows how short the gap between a disclosure and an attack has become. Amazon's honeypots logged an exploit attempt on 17 October, four days before anyone announced the bugs [2][3]. Cloudflare saw tens of thousands of attempts within 45 minutes of disclosure, and millions by the next morning [3].

How the bugs work, in plain terms

Both bugs follow the same pattern: an error interrupts PHP halfway through a job, and PHP later treats the half-finished state as if it were complete [2].

• CVE-2026-109618. A crafted form upload makes PHP run out of memory while it is parsing the request. PHP has already counted a new entry but never filled it in, and its clean-up code later processes that entry anyway. An attacker who controls the leftover bytes can steer the clean-up into running a system command [2].

• CVE-2026-109619. After a fatal error, a PHP worker keeps stale data from one request and a later request can read it. Upload progress tracking, which is switched on by default, is the documented way in [1][2].

The part that matters most for defenders: this happens while PHP is reading the request, before your application code runs. A login page, an access check or a careful framework does not stand in the way [2].

Who is exposed

Any PHP runtime that serves HTTP: Apache with mod_php, which PHP considers the highest risk, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Containers that bundle their own interpreter count too [1][2]. That covers a large share of WordPress, Laravel and custom admin panels, including the forgotten ones.

A reality check, not a reason to wait

Reliable exploits have turned out to be harder to build than first feared. Rapid7 found that public proofs of concept work only for specific combinations of operating system, PHP version and web server [1]. Sophos and Arctic Wolf saw attempts to install a Mirai botnet variant that had not succeeded at the time of reporting, and several other teams saw heavy scanning without confirmed code execution [3].

That buys time; it does not remove the risk. CISA's listing was based on evidence of active exploitation, and attackers only need one combination that works [1][5]. Datadog's own lab exploit returned a normal HTTP 200 and left the worker running, so a healthy-looking response proves nothing [2].

Then there is the third bug. On 23 October, PHP disclosed CVE-2026-115560, which can also lead to code execution, but only in unusual session configurations. There is no patch yet; the fix comes in the next routine release. The mitigation is the same setting PHP recommended two days earlier, session.upload_progress.enabled=0 [3].

Signs someone has tried

Datadog lists several signals worth searching for [2]:

• multipart uploads with PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields your app doesn't use;

• "Allowed memory size exhausted" errors reported on "Unknown on line 0", meaning PHP failed before your code started;

• segmentation faults in Apache logs;

• a shell or download tool started by a PHP or web server process, which is the clearest sign of success.

A checklist for your own setup

• Do we know every PHP runtime we run, including vendor apps, appliances and old marketing sites?

• Is each one on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build that includes the fix?

• Have we rebuilt container images and restarted every worker, not just installed packages?

• Where we can't patch today, have we set session.upload_progress.enabled=0 and restricted public access?

• Are we alerting on shells spawned by php-fpm or Apache?

• Are we still running PHP 8.1 or older anywhere?

Get your complete exposure report

The hardest PHP server to patch is the one nobody remembers running. NexusVoid maps everything you expose to the internet, identifies the runtimes and versions behind each service, and tests whether newly disclosed bugs like PHP2Shell actually reach you, with a fix for each finding. Our 24/7 monitoring repeats that for every new disclosure, so the next one is checked within hours, not at your next audit. Get your complete exposure report →

References

1. Rapid7. "CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP." October 2026. rapid7.com

2. Datadog Security Labs. "PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)." 21 Oct 2026, updated 23 Oct. securitylabs.datadoghq.com

3. The Hacker News. "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches." 23 Oct 2026. thehackernews.com

4. CISA. "Critical Vulnerabilities in PHP Require Immediate Patching." 21 Oct 2026. cisa.gov

5. watchTowr. "CVE-2026-109618: Exploited Remote Code Execution in PHP." watchtowr.com