PHP2Shell: Two critical PHP remote code execution flaws patched, exploitation attempts under way

What happened

According to a published vulnerability analysis, the PHP project announced security releases on October 21, 2026 for two critical vulnerabilities. CVE-2026-109618 can corrupt memory during out-of-memory handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. The analysis says both carry a CVSS v4 score of 9.2 and can allow unauthenticated remote code execution with the web worker's privileges. ^[1]

The pair is known as PHP2Shell. The Hacker News reports the flaws sit in the PHP runtime rather than in any application, so a site can be exposed even when its own code is not at fault. Details circulated before the release, and Sophos News published a note on a proof-of-concept exploit. ^[2][3][4]

Patches and mitigations

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to The Hacker News, which says the PHP team states that only updating fully protects a server. CISA urges organizations to patch immediately and has updated its alert with a SIGMA detection rule. The UK's NCSC has also urged organizations to take immediate action. ^[2][5][6]

The SANS Internet Storm Center says patches are available from many vendors, with exceptions such as QNAP. The Hacker News reported that PHP later warned of a separate issue that affects only applications configured in an unusual way. PHP considers it an unlikely risk and is not issuing an emergency fix, recommending that a feature be turned off instead. ^[7][8]

Exploitation

Amazon Threat Intelligence says it detected an exploitation attempt against its MadPot honeypot service on October 17, 2026, four days before the patches were released. The Hacker News reports the attempt came from an IP address associated with a commercial anonymization network. ^[9][10]

After the release, SecurityWeek and The Hacker News reported attempts to use the flaws to enrol systems in a Mirai botnet variant called Potassium. The Hacker News says those attempts were unsuccessful, and SecurityWeek says no successful compromise had been confirmed. The two CVEs are not listed in CISA's KEV catalogue. ^[11][12]

Disagreement over exploitability

The Record reports that experts are downplaying the viability of exploits, and the SANS Internet Storm Center says no simple, reliable exploit had surfaced as of October 23. SANS also says Cloudflare reports a lot of exploit activity. By contrast, security researcher LiveOverflow says he used AI tools to achieve remote code execution against PHP with Apache and WordPress, and describes claims both that the fix is incomplete and that exploitation is too hard. ^[13][7][14]