PHP patches two critical PHP2Shell remote code execution flaws as Cloudflare reports early attacks

TLDR

• Amazon says PHP2Shell exploitation attempts began on 17 October, four days before patches were released.¹⁷
• Dataminr reports only scanning and non-working exploits, with no known compromises as of 22 October.¹⁸
• The NSA says attackers are likely to weaponise the flaws and urges immediate patching or taking systems offline.²⁰

The PHP security team posted an advance notice on 20 October that a security release is scheduled for Wednesday 21 October 2026 at 14:00 UTC, addressing two critical vulnerabilities, both rated 9.2 on CVSS v4.0.¹ The notice urges all PHP users to prepare to upgrade as soon as the release is available, says the team reserves the right to release earlier if details become public or exploitation appears in the wild, and says full details, affected versions and fixed versions will be published with the release.¹ BleepingComputer reports that no technical details have been disclosed, including which versions are affected or how the flaws can be exploited.²

BleepingComputer and Cyber Daily both quote watchTowr saying that information about the two flaws leaked ahead of a planned disclosure and that they are real.²³ BleepingComputer gives the identifiers as CVE-2026-109618 and CVE-2026-109619 and says watchTowr described them as remote code execution flaws believed to affect PHP versions 5, 6, 7 and 8.² According to BleepingComputer, watchTowr chief executive Benjamin Harris said the flaws had been under embargo for release on Thursday at 11 am ET, that both are CVSS 10, and that watchTowr believes it has reproduced CVE-2026-109618 but will not share technical information until patches are available.²³ Harris told Cyber Daily he expects the patch release to come sooner than the Thursday schedule.³

The accounts differ in places. PHP's notice rates both flaws 9.2 and schedules the release for Wednesday, while watchTowr describes both as CVSS 10 and cites a Thursday embargo.¹² BleepingComputer also reports a now-deleted post on Y Combinator's Hacker News forum by a user named "petecooper" that gave the same two identifiers and claimed disclosure on 22 October.² watchTowr told BleepingComputer it has not observed exploitation in the wild.² Cyber Daily's copy of the identifiers contains a typographical error, so the identifiers here follow BleepingComputer.²³

Why it matters: Exploitation attempts predate the patches by at least four days, so patching is not enough on its own and defenders should check logs back to 17 October.¹⁷¹⁸

Update, 21 October 2026: The PHP project has released the fixes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which its advisory says fix two critical vulnerabilities that can allow unauthenticated remote code execution.⁴ The flaws, now tracked collectively as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619, and the PHP security team's GitHub advisories rate both CVSS v4.0 9.2, confirming PHP's own figure rather than the CVSS 10 that watchTowr had cited.⁵⁶ PHP 8.1 and older no longer receive project updates, but because of the severity the team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source or have no long-term support vendor.⁴⁷ The project says there are no complete mitigations and updating is the only safe choice.⁴ It also says the volunteer-run rpms.remirepo.net repository will not have updates on the day and urges its users to switch to distribution packages or build from source.⁴ This supersedes the earlier statement that affected and fixed versions were unpublished.

According to the advisories, CVE-2026-109618 (out-of-memory corruption) arises because PHP uses longjmp() to bail out when memory runs out, which can leave request data partly initialised for request shutdown to read later.⁵ CVE-2026-109619 (stale global state) lets request-owned state, such as error or session state, remain referenced by a persistent worker after its memory is freed, so a later request on the same worker can trigger a use-after-free.⁶ The advisory says Apache mod_php is the confirmed susceptible server interface for the first flaw, with unauthenticated remote code execution as the web worker account validated against default limits, while PHP-FPM is considered susceptible by source analysis only.⁵ For the second, it confirms remote code execution against mod_php through PHP 8.5 fatal error backtraces and validates the session upload progress path against mod_php and PHP-FPM.⁶ Reliability depends on the build, extensions, front end and memory layout.⁵ BleepingComputer, quoting the PHP team, says all PHP installations serving web requests are affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, with risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.⁴⁷ The advisories list partial interim steps, including session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, but the PHP advisory says these only reduce exposure to specific attack paths.⁴⁶

On exploitation, the PHP advisory describes a demonstrated exploit against mod_php but does not claim attacks in the wild.⁴ BleepingComputer and Tenable both report that, before the patches were released, Cloudflare chief technology officer Dane Knecht said the company had deployed web application firewall rules for the known exploit methods and was already seeing early attacks, which he called a stopgap only.⁷⁸ This differs from the earlier report that watchTowr had seen no exploitation.⁷⁸ BleepingComputer adds that the UK National Cyber Security Centre has told UK organisations to update PHP systems immediately or take them offline until patched.⁷ Tenable says a video demonstrating an exploit chain circulated, credited to researchers LCFR and Calif.io, that CERT-EU has published an advisory, and that code claiming to exploit the flaws is circulating but unverified, so it should be treated with caution.⁸ Exposure estimates vary: BleepingComputer cites VirusTotal figures of over 5.1 million exposed PHP hosts, while Tenable cites researcher estimates of 1.3 million to 1.9 million.⁷⁸

Update, 22 October 2026: Government websites went offline in Europe and elsewhere on 21 October as operators reacted to the two PHP flaws before the fix was released, Reuters reports.⁹ Government agencies in the Netherlands and Finland were among those that took sites offline as a precaution, and PHP said a fixed version was live at around 1345 GMT.⁹ The Dutch government said the National Cyber Security Centre advised site owners to assess their own risk and consider going offline until the update arrived, and that Overheid.nl, MijnOverheid.nl and DigiD were among the sites taken down, while Rijksoverheid.nl does not use PHP.¹⁰ The BBC reports that the Finnish government, Edinburgh council and the BBC itself took pages offline, and that Wikimedia took some systems down, though Edinburgh council and the BBC programme sites had not confirmed a link to PHP.¹¹

Accounts of exploitation still differ. The Dutch government said on 21 October there were no signs yet of active exploitation, while Reuters reports Cloudflare's chief technology officer saying early attacks were emerging and Reuters also citing reports of hackers exploiting the flaws.⁹¹⁰ The BBC reports that the US National Security Agency advised organisations unable to update to take systems offline, and that the UK National Cyber Security Centre, EU and Australian agencies and Japan's national cyber-security office issued similar warnings.¹¹ CNA's Reuters explainer says Calif, working with OpenAI, reported the first flaw on 11 August and Wiz reported a second on 24 August, both using AI models.¹³

Singapore's Cyber Security Agency published alert AL-2026-151 on 21 October, saying both flaws (CVSS v4.0 9.2) allow unauthenticated remote code execution and affect all versions of PHP.¹² It advises organisations to identify every system running PHP, prioritise internet-facing systems and check web servers where PHP is used by third-party components, even if the main website does not use PHP.¹² The advisory does not name any affected Singapore website.

Update, 22 October 2026: The PHP Foundation has published a lengthy statement on how the two flaws were handled, and reporting on it adds detail on the history of the bugs, the early leak and the scale of exposure. The Record reports the foundation as saying the history of CVE-2026-109618 dates back to 2024, when PHP underwent its first external security audit in several years, but no action was taken because engineers could not agree how to fix it without backward compatibility breaks, new denial-of-service potential or changes to many third-party extensions.¹⁴ The foundation said its security team, operating on consensus, struggled to choose and feared shipping the wrong fix, and that with no known route to remote code execution the work stalled and restarted over months.¹⁴ SecurityWeek, citing Calif, says an initial out-of-memory flaw was found in 2020 and rediscovered during the 2024 audit, and that frontier AI models later helped turn it into remote code execution.¹⁶ The Record says a Calif researcher reported the bugs on 11 August and that OpenAI, Wiz and Trail of Bits found the same flaws in audits, while SecurityWeek says Calif and OpenAI independently reported the issue on 11 August and that OpenAI and Wiz later reported additional attack vectors.¹⁴¹⁶

Disclosure had been planned for 22 October, but information leaked online on 20 October and the foundation brought the release forward by one day, according to SecurityWeek.¹⁶ The Record reports the foundation as saying Calif mistakenly published a video showing its proof of concept working against several targets, which kept circulating after it was deleted and accelerated the development of exploit tools, and that the foundation watched several proofs of concept on Tuesday evening but identified none that worked.¹⁴ The foundation also said Chainguard broke the embargo early on Wednesday by publishing images containing the fix, which let attackers study it in binary form while other users waited.¹⁴ Chainguard chief executive Dan Lorenc told The Record he began to see exploitation attempts the previous night and made a judgement call to release it, and that he thought the PHP maintainers had done a great job.¹⁴ SecurityWeek says Chainguard published six hours before the coordinated release, and that Cloudflare deployed protections nine hours before public disclosure.¹⁶

Accounts of exploitation continue to differ. SecurityWeek says watchTowr saw its first in-the-wild attempts around the time the patches landed but no successful ones, that Hadrian reported exploitation "at scale", mostly through PHP's session upload-progress path, a few hours before the fixes, and that Patchstack, Cloudflare and Vega also saw attempts.¹⁶ The Record quotes Cloudflare's chief technology officer saying attacks were already emerging, and watchTowr's head of threat intelligence Jake Knott saying nobody had been successful to date but that this was not expected to last.¹⁵

On exposure, The Record cites a VirusTotal analysis identifying 5.1 million IP addresses running PHP, of which at least 758,000 run end-of-life versions and 85,000 ran the latest releases available before the emergency patches.¹⁴ It notes these figures describe PHP's internet-facing footprint rather than confirmed vulnerable systems, and that Cisco Talos estimates roughly half of vulnerable PHP systems may not receive a patch.¹⁴ SecurityWeek says the flaws affect nearly all releases back to PHP 5.4, can also be used to read process memory that may hold credentials and API keys, and are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports for PHP 7.4, 8.0 and 8.1.¹⁶ The Record says the patches apply only to versions back to PHP 8.2 and that older versions no longer receive updates from the PHP project.¹⁴ SecurityWeek adds that the foundation counts 15 new CVEs published since 1 July as AI has surfaced more PHP vulnerabilities.¹⁶ The Record reports that Nintendo was among the organisations that took services offline, and that OpenAI said Calif used its tools to find the bugs through its Patch the Planet programme.¹⁵

Update, 23 October 2026: Amazon says it saw PHP2Shell exploitation attempts four days before the patches, Dataminr reports no confirmed compromises, and the NSA has urged immediate patching. Amazon Threat Intelligence says its MadPot honeypot telemetry shows an exploitation attempt dating to 17 October, four days before public disclosure, from an IP address tied to a commercial anonymization network.¹⁷ It says further attempts followed from about 02:00 UTC on 21 October through varied anonymization infrastructure with differing payloads, suggesting multiple actors, and that it is unclear whether any would have succeeded against real systems.¹⁷ Amazon says PHP2Shell is now seeing broad exploitation attempts in the wild and advises defenders to start investigations from at least 17 October rather than the disclosure date.¹⁷ BleepingComputer's report repeats these findings.¹⁹

Dataminr's threat research team reports a more cautious picture. In a report dated 22 October it says observed activity since disclosure is limited to scanning, fingerprinting and non-working exploits, with no known compromises and no confirmed functional exploit, though it expects working exploits to emerge.¹⁸ It notes Check Point and Palo Alto Networks have indicated some of their products are affected through their use of PHP, and that the flaws reach back to PHP 5.4.0 while patches cover only maintained versions, leaving legacy applications exposed.¹⁸ Amazon describes exploitation attempts and says it is unclear whether any succeeded, while Dataminr says no compromises are known.¹⁷¹⁸

The NSA said on 21 October that attackers are likely to weaponise the flaws, which it says sit in PHP itself rather than in hosted applications or their configuration, and that immediate patching is required across US government departments and agencies.²⁰ It recommends organisations inventory systems that rely on affected PHP versions, add enhanced logging, replace end-of-life PHP services that cannot be patched and, where an immediate update is not feasible, take the system offline until it is mitigated.²⁰

TechTarget adds detail on the disclosure breakdown and the response. It reports that more than 30 UK government services were taken offline and, citing Reuters, that federal sites in the Netherlands, Germany, Belgium and France were also shut down as a precaution.²¹ It quotes Chainguard chief executive Dan Lorenc as saying his company learned of the coming disclosure on 16 October, independently found the bug that night using an in-house AI harness and a frontier model, and chose to publish fixed images early after multiple vendors in the disclosure channel reported seeing active exploitation overnight on 20 into 21 October.²¹ The PHP Foundation disputes that framing, saying the early publication let any attacker study the fix in binary form while other users waited.²¹