PHP2Shell Explained: Targeted Before the Patch
Quick answer. PHP2Shell is two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that let unauthenticated requests run code. Attackers probed them before the October 21, 2026 fix and had working exploits by October 24. Every PHP host needed patching within days.
Video transcript
Two critical PHP flaws let unauthenticated requests run code on web servers. Attackers probed them before the fix.
PHP runs roughly 70 percent of websites. Both flaws sit in its core, each rated CVSS 9.2.
Both bugs leave PHP using memory it should no longer trust. One is reachable through session upload progress, on by default. The other uses crafted uploads to force out-of-memory corruption.
Amazon saw the flaws targeted four days before the patch, which shipped October 21. On October 24, honeypots showed working code execution. CISA listed both flaws on October 26.
VirusTotal estimates more than 5.1 million PHP hosts are exposed online. PHP also runs inside vendor products.
Cyfirma reported suspected North Korea-linked activity targeting financial services and trading platforms, warning of possible cryptocurrency theft. The link is unconfirmed.
Update to a fixed release and retire PHP 8.1 and older. If you must wait, disable session upload progress and restart workers. Ask vendors for fixes and check hosts for compromise.
Workarounds are partial. A patch only helps once you know every place PHP runs, including vendor appliances.
Guardian's Managed Security matches new disclosures against your system in real time. If one reaches you, an engineer confirms the exposure and helps you patch.
Read the full article for every fix, or talk to Guardian about which advisories reach your stack.
PHP runs roughly 70% of websites, per W3Techs figures cited by BleepingComputer.
In October 2026, two flaws in PHP's own core let attackers run code on web servers without logging in. The pair is tracked as PHP2Shell.
The advance warning, the leak, the patch and the first working exploits all landed within a week.
What Happened
On October 20, the PHP security team gave notice of a release fixing "two critical vulnerabilities, both rated CVSS v4.0 9.2."
It said it might ship early if details went public or exploitation appeared in the wild.
Details did leak. Per BleepingComputer, the CVE IDs and mitigation advice appeared online before the patch, along with some proof-of-concept code.
The PHP security team said none of those proofs of concept worked.
On October 21, the fixes shipped in four releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older no longer get project updates. The team published minimal source backports for 7.4, 8.0 and 8.1.
How the Flaws Work
Both bugs leave PHP using memory it should no longer trust. Both are unauthenticated remote code execution flaws.
| Detail | CVE-2026-109619 | CVE-2026-109618 |
|---|---|---|
| PHP's name | RCE via stale global state | RCE via OOM corruption |
| Root cause | State outlives the request memory it points to | Out-of-memory exit leaves request data half built |
| Known path | Session upload progress, on by default | Crafted multipart uploads |
| Share of attempts F5 saw | About 98% | About 2% |
| Severity (PHP) | CVSS v4.0 9.2 | CVSS v4.0 9.2 |
F5 Labs lists both at CVSS 9.8, without naming the version. This post uses PHP's own v4.0 score.
Stale global state
A PHP worker keeps global state that can point to memory owned by one request.
If a fatal error interrupts that request, the pointer can survive after the memory is freed. A later request on the same worker then uses it.
Session upload progress is a validated path, per PHP's advisory. It is enabled by default and does not need the application to start a session.
Out-of-memory corruption
PHP exits out-of-memory errors with longjmp(). If that happens while request memory is only partly set up, shutdown code reads invalid state.
Crafted multipart uploads can push a request past its memory limit. F5 Labs saw attack payloads padded with about 62 KB of filler.
Who is at risk
PHP lists all installations serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
It rates mod_php highest, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
Timeline and Exposure
| When (2026) | What happened |
|---|---|
| Four days before the patch | Amazon sees attackers targeting the flaws |
| Oct 20 | PHP announces a critical security release |
| Oct 21, 08:36 UTC | F5's sensors record their first PHP2Shell scans |
| Oct 21 | Fixed releases and advisories published |
| Oct 23 | PHP flags a rarer third flaw, CVE-2026-115560 |
| Oct 24 | Honeypot evidence of working remote code execution |
| Oct 26 | CISA adds both CVEs to its exploited list |
| Oct 29 | CISA's due date for federal civilian agencies |
Before the patch
Amazon Threat Intelligence saw attackers targeting the flaws four days before the patches, BleepingComputer reports.
F5 Labs recorded its first PHP2Shell scanning at 08:36 UTC on October 21, more than five hours before publication. Within hours of disclosure, it saw thousands of attempts.
Cloudflare, Amazon, watchTowr and others detected attempts before disclosure, but tagged them as unsuccessful, per BleepingComputer.
After the patch
On October 24, Adel Karimi of Perplexity published honeypot evidence of working remote code execution. Marcus Hutchins of Expel confirmed the findings.
The target was Apache with mod_php on PHP 8.4.26, the release just before the fix. Karimi noted it was a deliberately favorable single-worker setup.
CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26. It gave federal civilian agencies until October 29.
Who was exposed
VirusTotal estimates more than 5.1 million PHP hosts are exposed online, per BleepingComputer.
PHP also sits inside vendor products. Cisco patched its Expressway Series and Duo Access Gateway, and Palo Alto Networks sped up a planned release, BankInfoSecurity reports.
For crypto and trading firms, one report stands out. Cyfirma reported activity by "Korean-speaking operators" it suspects are linked to North Korea, according to BankInfoSecurity.
Its list of targeted sectors includes financial services firms and online trading platforms. Cyfirma warned the access could enable cryptocurrency theft.
BankInfoSecurity reports the Lazarus link as suspected, not confirmed. Cyfirma based it on "behavioral and linguistic indicators," not shared infrastructure or malware.
For how that group works, see our Lazarus Group playbook.
None of the sources we read names a confirmed victim or a loss.
What It Shows
The embargo leaked. The patch had a date, and the details went public first.
Probing started before the advisory. F5 saw scanning hours before the CVEs were published.
The deadline was days. CISA gave federal agencies three days from listing to act.
Workarounds were partial. PHP says only an update is a complete solution; its other measures "do not make an installation safe."
Inventory is the hard part. A patch only helps once you know every place PHP runs, including inside vendor appliances.
For how fast disclosed crypto flaws get exploited, see our study of time to exploit in crypto.
What to do now
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package.
- Move off PHP 8.1 and older, or get a vendor backport.
- If you must wait, set
session.upload_progress.enabled=0in php.ini or the pool config, then restart every worker. - On PHP 8.5, also set
fatal_error_backtraces=0. - Keep
post_max_sizelow; PHP suggests 8M if you take no uploads. - Ask vendors whose products embed PHP for their fix.
- Check internet-facing PHP hosts for compromise, as CISA directs federal agencies to do.
How Guardian Matches Advisories
Guardian's Managed Security ingests vulnerability disclosures in real time and matches them against your system.
Where one reaches you, an engineer confirms the exposure and works with you to patch it immediately.
PHP2Shell is one of the recent advisories listed on the Managed Security page.
Shield, part of Managed Security, is Guardian's continuous coverage of everything you have facing the internet: hosts, ports, services, storage, certificates and edge rules.
For the difference between finding exposed assets and fixing what is exploitable, read exposure management vs attack surface management.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution, and PHP rates each CVSS v4.0 9.2. Fixed releases shipped on October 21, 2026.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get project updates, though the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some vendors ship their own fixes.
Was PHP2Shell exploited before the patch?
Attackers targeted it before the patch: Amazon saw activity four days early, and F5 saw scanning hours early. Those attempts were reported as unsuccessful. Working remote code execution was confirmed in honeypots on October 24, three days after the fix.
What is CVE-2026-115560?
A related, less likely PHP flaw, announced on October 23. It needs an unusual combination of configuration and application code. PHP is fixing it in its regular release cycle and suggests setting session.upload_progress.enabled=0 until then.
Sources
- PHP: Upcoming Critical PHP Security Release (October 20, 2026)
- PHP: Security advisory: Critical remote code execution vulnerabilities, update now (October 21, 2026)
- PHP: Informational advisory: Session upload progress (October 23, 2026)
- php-src (GitHub): GHSA-6wmf-4rv5-p3rp, RCE via stale global state, CVE-2026-109619 (October 21, 2026)
- php-src (GitHub): GHSA-w8hw-w9fx-j79w, RCE via OOM corruption, CVE-2026-109618 (October 21, 2026)
- CISA: Known Exploited Vulnerabilities Catalog, CVE-2026-109618 and CVE-2026-109619 (added October 26, 2026)
- F5 Labs: PHP2Shell Exploitation Attempts Observed (October 22, 2026)
- BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild (October 26, 2026)
- BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks (October 27, 2026)
- BankInfoSecurity: PHP2Shell Actively Exploited, US Cybersecurity Agency Warns (October 27, 2026)
- Guardian: Managed Security
Know which advisories reach your stack
Guardian's Managed Security matches disclosures like PHP2Shell against your system, and an engineer works with you to patch what is exposed.