CRITICAL: PHP Ships Emergency PHP2Shell Fixes as Exploit Attempts Surge

If you have ever told a client that their website is safe because "the app is fully patched," this is the week that sentence stops working. The PHP project shipped emergency releases on October 21, 2026 for two critical flaws in the PHP engine itself, collectively nicknamed PHP2Shell, and attackers were throwing exploits at them before most administrators had finished reading the advisory. These bugs live underneath WordPress, Laravel, Drupal, Magento and every homegrown customer portal your clients forgot they owned. Clean application code buys you nothing here. If the PHP runtime answering the request is vulnerable, the server is vulnerable.

This is a drop everything and patch it now situation. Here is what we know, what the exploitation looks like, and what you should be doing before lunch.

The Two Bugs Behind PHP2Shell

The pair are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rated each of them 9.2 under CVSS v4.0. A leaked claim floating around before disclosure called them a perfect 10.0, which was never PHP's rating, but frankly 9.2 for unauthenticated remote code execution in a runtime that powers roughly 70 percent of the web is not a number anyone should find comforting.

CVE-2026-109618 is an out-of-memory handling flaw. According to PHP's advisory, running out of memory can interrupt the engine while internal request data is only partially initialized, and the request cleanup code then treats that half-built garbage as if it were valid. Anyone who has spent time around memory corruption bugs knows exactly where that road leads. CVE-2026-109619 is a use-after-free in the session upload progress machinery. Request-owned internal state can survive after its memory has been freed, and a later request handled by the same worker can pick up that stale state before it gets reset. Two different root causes, same destination.

Affected versions stretch back to roughly PHP 5.4, which means this code has been sitting in the engine for more than a decade. Calif, one of the research teams credited, traced the bug's lineage all the way back to PHP research published in 2004. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 are end of life and get no official binaries, although the project did publish minimal source backports for those three branches for anyone willing to build from source. PHP 8.2 itself goes end of life on December 31, 2026, so if you are patching an 8.2 box this week you should also be scheduling its upgrade.

The researchers who found and reported the flaws came from Wiz, Calif and OpenAI's Codex Security team, working with the PHP security team and Google's Gemini team on the fix. They have been candid that AI models helped turn these bugs into working exploits. That detail matters for everyone downstream, and we will come back to it.

Which Servers Are Actually Exposed

PHP's advisory names every common server API as affected, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The highest risk sits with mod_php, where a demonstrated exploit needs nothing more than a single unauthenticated request, and it fires before any application code runs at all. There is no login to bypass and no vulnerable plugin to find. A static contact form, a login page or a health check endpoint is enough of a doorway.

PHP-FPM is a slightly more nuanced picture. For CVE-2026-109618, PHP's own analysis says FPM is susceptible but no complete FPM exploit has been demonstrated yet. CVE-2026-109619 does reach code execution on both mod_php and FPM, though the FPM path depends on the running application performing a particular operation. I would not lean on that distinction for comfort. "No public exploit yet" has a shelf life measured in days, and this disclosure has already proven how quickly that clock runs.

There is also a nasty side effect that does not require code execution. Researchers showed that an attacker can read live worker memory, which can expose passwords, session tokens, API keys and certificates belonging to other users' requests. They demonstrated it against applications they did not control. So even a box where the full RCE chain fails could be quietly leaking secrets.

The exposure numbers are ugly. VulnCheck counted 2,608,039 internet-facing PHP hosts, with more than 700,000 running PHP 3.x through 7.3 and roughly 400,000 on the end of life 7.4, 8.0 and 8.1 branches. Modat put the figure higher at 4.38 million internet-facing PHP services as of October 20, and found that about 79 percent of them run unsupported branches. PHP 7.4 alone accounted for 878,761 of those services. That is a long tail of servers that will never see a vendor patch.

A Disclosure That Fell Apart

Coordinated disclosure was originally set for October 22 at 14:00 UTC. It did not survive contact with reality. A leak on October 20 revealed the planned date, and that evening around 20:00 UTC Calif accidentally posted a video of its working proof of concept. PHP moved the release up a day. Chainguard published patched container images at 07:41 UTC on October 21, which, as the PHP Foundation dryly put it, meant "any attacker could now study the fix in binary form while every other PHP user was still waiting for the release."

The pre-disclosure story gets stranger. Amazon's MadPot honeypot logged an exploit attempt on October 17, four days before the patches existed, from 103.216.220[.]92, an anonymized address geolocated to Australia. The earliest proof of concept attempts Amazon flagged on release day arrived around 02:00 UTC on October 21, with more following over the next six hours from addresses including 31.223.184[.]166, 37.19.200[.]5, 134.209.159[.]64, 103.114.163[.]188 and 95.217.98[.]37. ELLIO's sensors saw their first PHP2Shell request at 08:36 UTC, less than an hour after Chainguard's images went public.

From there it snowballed. Cloudflare reported early attacks against customers and watched attackers mutate payloads to get around WAF rules it had switched on by default at 03:02 UTC. watchTowr reproduced CVE-2026-109618 and by 14:19 UTC was reporting active exploitation attempts against both CVEs. Pantheon blocked more than 60,000 suspicious requests probing the bugs. VulnCheck caught a scanner announcing itself with the user agent "php2shell-scan/109618" from 85.11.167[.]243 and 45.198.224[.]169, and saw 109.71.252[.]97 using both flaws. Amazon assessed that multiple distinct threat actors were involved, based on varied payloads and infrastructure.

As of this writing nobody has publicly confirmed a successful breach, and neither CVE was on CISA's Known Exploited Vulnerabilities catalog when the first reports landed. CISA and the UK NCSC have nonetheless urged organizations to patch immediately or take systems offline. Some organizations took that literally. BambooHR pulled its service offline in the US, Canada and Ireland, and in the Netherlands, MijnOverheid, DigiD and several government and education sites went dark as a precaution. When a national digital identity service decides downtime is the safer option, that tells you how seriously the people with visibility are taking this.

Amazon's CJ Moses summed up the bigger lesson: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit." The window between a fix shipping and a working exploit circulating used to be measured in weeks. For PHP2Shell it was hours, and arguably negative.

Patch First, Then Everything Else

The PHP team has been blunt that updating is the only complete fix. Core developer Gina Peter Banyard put it plainly when she said "the only mitigation is patching/upgrading PHP." Update the PHP runtime that actually serves requests, then restart Apache, PHP-FPM and any long-running workers, because a patched binary on disk does nothing for a worker process that loaded the old one last Tuesday. Remember too that updating WordPress or Laravel does not touch the PHP runtime beneath it. I guarantee someone on your team will confuse the two this week.

Linux distributions and LTS vendors received patches in advance, and they often ship fixes under older looking version numbers. Following Debian's advice, check the package changelog for the CVE identifiers rather than trusting the version string. CloudLinux has shipped fixed packages for ea-php52 through ea-php85 and all alt-php versions, which will matter to anyone running cPanel shared hosting. AWS, Cloudflare, Akamai, Azure, Google Cloud and Vercel have all published guidance or WAF mitigations, and OpenAI released a Codex skill called "php2shell-checker" to test whether a site or a local PHP binary is vulnerable.

If you genuinely cannot patch today, PHP lists partial mitigations, and it is explicit that none of them make an installation safe. For CVE-2026-109618, set memory_limit to -1 in a way applications cannot override, keep post_max_size low, and enforce request size limits at the web server or reverse proxy. PHP warns against using RLIMIT_AS or RLIMIT_DATA as a substitute because they can trigger the same vulnerable code path, so use container or cgroup limits instead. For CVE-2026-109619, set session.upload_progress.enabled to 0 in php.ini or the FPM pool configuration and restart every worker. On PHP 8.5, also set fatal_error_backtraces to 0. Those settings block the confirmed session paths but not every variant, so treat them as a tourniquet and not surgery.

After you patch, review your memory_limit and post_max_size values against what your applications actually need. The fix introduces a new hard memory limit, and when a process hits it the process ends without running shutdown handlers. Applications that rely on shutdown logic for cleanup or logging may behave differently, so expect a few odd support tickets.

Hunting for Signs You Were Hit

Detection is the uncomfortable part. CrowdStrike noted that successful exploitation leaves virtually no traces because "no application code ever ran," and the only server side artifact may be a memory limit fatal error in the PHP error log. That gives you a few threads to pull. Look for unusual multipart requests followed by memory limit errors or bursts of HTTP 500 responses. Look for oddly large PHPSESSID cookies in responses. Look for PHP worker restarts nobody can explain. Search your web and WAF logs for the "php2shell-scan" user agent and the IP addresses listed above, keeping in mind that IP indicators for opportunistic scanning age about as well as milk.

The FBI recommends watching for PHP processes that unexpectedly spawn command shells or download files, which is exactly the sort of parent and child process relationship your EDR should already be alerting on. If it is not, fix that rule today. The NSA has warned that successful exploitation gives attackers a direct path to file systems and databases. If a server was exposed and unpatched before you applied the fix, rotate the credentials, API keys and certificates it held, given the memory disclosure angle. Assume anything the worker touched could have been read.

Finally, take inventory. Sonatype's Ilkka Turunen made the point that the immediate priority is knowing where PHP is running and who owns its remediation. Most organizations will find PHP in places they forgot about, like an old marketing microsite, a vendor appliance's admin panel, or that intranet tool someone built in 2015 and never retired. Those are the boxes that get popped.

The MSP Angle

Every client with a website, a customer portal or a hosted line of business app has a PHP2Shell exposure question they cannot answer themselves, and that makes this an easy conversation to open with a rapid external attack surface scan and a runtime patch sweep. Clients still running end of life PHP 7.x or 8.1 are a natural fit for a managed hosting migration or ongoing vulnerability management engagement, because this will not be the last time an unsupported runtime leaves them with no patch at all.