Updated October 24, 2026. This report was refreshed with the latest Threat Center data. The October 23 version is kept at the end of the page.
Threat intel reportPanorays Threat Center · October 24, 2026
- Primary impacted company
- PHP
- Incident type
- Security Vulnerability
- IdentifiedOctober 20, 2026First report of the incident14
- ActiveNot yet
- ContainedNot yet
- ConcludedNot yet
What happened
PHP released emergency updates for two critical vulnerabilities dubbed PHP2Shell that permit unauthenticated remote code execution, as threat actors launched millions of exploit attempts in the wild.346810
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and both rated 9.2, reside in PHP core memory management and error handling routines, affecting every reachable PHP endpoint across major versions.36810 Exploitation can trigger memory corruption during out-of-memory handling or leverage stale global state across worker requests, leaving virtually no application-level log footprints.6810
Originally scheduled for coordinated disclosure on October 22, 2026, details and proof-of-concept exploits leaked early, leading the PHP project to issue emergency patches on October 21 for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.681012 Amazon detected an exploit attempt against its honeypot on October 17, four days prior to disclosure, while Cloudflare recorded exploit traffic escalating to millions of requests by early October 22.36
Security researchers observed threat actors attempting to weaponize the flaws to install a Mirai botnet variant known as Potassium, though security firms reported scanning and probing without confirmed remote code execution in the wild.34
On October 23, PHP issued an informational advisory for an additional remote code execution vulnerability, CVE-2026-115560, advising administrators to disable session upload progress while scheduling routine patches.358
Confirmation ladder
3- Attacker claimNot reached
A threat actor says it did this. No independent confirmation.
- Trusted source reportedOctober 21, 2026
A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.
- Company acknowledgedOctober 20, 2026
The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.
- Follow-upOctober 21, 2026
Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.
Timeline
9- October 17, 2026
- Reported October 20, 2026
- October 20, 2026
Identifiers and embargo details regarding two critical PHP remote code execution flaws leak publicly on Hacker News.12
- October 21, 2026, at 2 a.m. UTC
Amazon detects multiple proof-of-concept exploits for PHP2Shell originating from anonymized infrastructure.6
- October 21, 2026, at 8:36 a.m. UTC
ELLIO observes the first PHP2Shell request targeting its sensors after Chainguard publishes built container images containing the fix.6
- October 21, 2026, at 13:30 UTC
- Reported October 21, 2026
CISA issues an alert urging organizations to immediately patch or disconnect vulnerable PHP systems.9
- Early October 22, 2026
Cloudflare reports exploit attempts surging to millions of requests across its network.3
- October 23, 2026
Attack analysis
- Attack vector
- Specially crafted HTTP requests sent to internet-facing PHP endpoints.
Attackers send unauthenticated HTTP requests targeting PHP core routines before application code runs, triggering memory corruption during out-of-memory handling or recycling stale global state.46810
- Attack model
- Mass exploitation scanning attempting to recruit vulnerable web servers into a Mirai botnet.
Threat actors launched automated scans across millions of targets to deploy a Mirai fork named Potassium capable of executing 24 flood attack commands.34
- Scale
- Millions of exploit attempts targeting web servers globally.
Cloudflare observed exploit attempts surge from tens of thousands within 45 minutes of disclosure to millions by early October 22.3
Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK
- Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromattempting pre-authentication remote code execution against web servers via PHP2Shell vulnerabilities46810
- Active Scanning: Vulnerability ScanningATT&CK IDT1595.002TacticReconnaissanceMapped fromrunning screening scripts to check live websites for exploit prerequisites and server setup34
- Ingress Tool TransferATT&CK IDT1105TacticCommand and ControlMapped fromcontacting staging servers to download loader binaries and Linux ELF payloads4
- Network Denial of ServiceATT&CK IDT1498TacticImpactMapped fromrecruiting infected systems into a Mirai botnet to execute volumetric DDoS flood attacks4
Technologies
- PHP
- Apache mod_php
- PHP-FPM
- php-cgi
- FrankenPHP
- LiteSpeed
- Linux
- Mirai
Vulnerabilities
- CVE-2026-109618Exploited in attacks
Out-of-memory error handling via longjmp() leaves uninitialized request memory that is subsequently processed during cleanup, allowing remote code execution.134689101213
AffectedPHP 8.5 versions prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported branches 8.1 and older
- CVE-2026-109619Exploited in attacks
Stale global state survives memory deallocation across worker requests, allowing subsequent requests to access uninitialized data and achieve remote code execution.134689101213
AffectedPHP 8.5 versions prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported branches 8.1 and older
- CVE-2026-115560
Remote code execution flaw triggered when applications dynamically modify session serialize handlers before session initiation while session upload progress remains active.358
AffectedPHP web applications configured with specific dynamic session serialize handlers and active session upload progress
Indicators Addresses linked to the attackers. Values are defanged and not linked.
- IP address
103.216.220[.]92IP address geolocated to Australia used in an embargo exploit attempt against Amazon’s honeypot6 - IP address
31.223.184[.]166IP address observed in early exploit attempts6 - IP address
37.19.200[.]5IP address observed in early exploit attempts6 - IP address
134.209.159[.]64IP address observed in early exploit attempts6 - IP address
103.114.163[.]188IP address observed in early exploit attempts6 - IP address
95.217.98[.]37IP address observed in early exploit attempts6 - IP address
85.11.167[.]243attack source IP address attempting to deploy Mirai loader4 - IP address
217.60.242[.]76attack source IP address attempting to deploy Mirai loader4 - IP address
45.198.224[.]169attack source IP address attempting to deploy Mirai loader4 - IP address
92.118.112[.]100staging server contacted by attack sources to retrieve Mirai loader binary4 - Domain
thunder[.]godofthunder[.]stcommand-and-control domain queried by the Mirai botnet sample4 - IP address
134.199.154[.]64command-and-control IP address resolved by the Mirai botnet sample4 - IP address
206.188.197[.]105:9999exposed server hosting PHP2Shell exploit tooling and screening scripts4
Blast radius
- Reason
- PHP developed and maintains the server runtime affected by the critical PHP2Shell vulnerabilities.
- How they got in
- Specially crafted HTTP requests sent to internet-facing PHP endpoints.
- Affected products
- PHP, PHP-FPM, php-cgi
- Vulnerabilities used
- CVE-2026-109618 · CVSS score 9.8 Exploited in attacks
- CVE-2026-109619 · CVSS score 8.1 Exploited in attacks
Other companies in the coverage
19- AAmazonReporter or researcher
Amazon’s Threat Intelligence team reported detecting pre-disclosure exploit attempts against its honeypot infrastructure.36
- CCloudflareReporter or researcher
Cloudflare reported widespread exploit request volumes and deployed defensive WAF rules.36101113
- SSophosReporter or researcher
Sophos analyzed exploit attempts attempting to deliver the Potassium Mirai botnet variant.34
- AArctic WolfReporter or researcher
Arctic Wolf provided technical analysis of weaponized exploit payloads attempting to deploy Mirai malware.34
- PPrevidianReporter or researcher
Previdian monitored threat traffic and reported observing scanning activity without confirmed code execution.3
- WWordfenceReporter or researcher
Wordfence tracked exploit attempts and reported scanning activity across web properties.3
- CCybersecurity and Infrastructure Security AgencyReporter or researcher
CISA published an emergency alert urging organizations to patch or take vulnerable PHP systems offline.691112
- WwatchTowrReporter or researcher
watchTowr confirmed the embargo leak and reproduced vulnerability exploit conditions.1112
- OOpenAIReporter or researcher
OpenAI co-discovered the vulnerabilities and released detection tooling.61013
- CCrowdStrikeReporter or researcher
CrowdStrike analyzed the exploit mechanism and noted the absence of application logs during exploitation.6
- CChainguardMentioned only
Chainguard published patched container images ahead of the coordinated disclosure embargo.6
- FFederal Bureau of InvestigationReporter or researcher
The FBI issued guidance instructing defenders to monitor PHP processes for shell launches or file downloads.6
- NNational Security AgencyReporter or researcher
The NSA warned that the vulnerabilities provide direct access to server file systems and databases.6
- NNational Cyber Security CentreReporter or researcher
The UK NCSC issued an alert warning of the severe risk posed by the PHP2Shell flaws.6
- NNational Cyber Security CentrumReporter or researcher
NCSC-NL tracked third-party software products embedding PHP that may be impacted by the flaws.8
- FFlatt SecurityReporter or researcher
Flatt Security analyzed potential workarounds and warned that configuration changes alone could not guarantee protection.11
- UUpwindReporter or researcher
Upwind provided third-party security commentary and guidance during the disclosure period.11
- HHuntressReporter or researcher
Huntress monitored partner environments and shared defense-in-depth guidance.12
- SShodanMentioned only
Shodan host data was referenced by security researchers estimating exposed internet-facing PHP installations.12
TPCRM perspective
Supply chain angle
Risk typeVulnerable vendor product on companies’ attack surface
- Dependency
Organizations and third-party vendors widely deploy the PHP runtime to execute web applications, host portals, and manage internet-facing services.689
- Party
First party if it is your own company; third party if you use PHP directly; fourth party through a supplier that uses it.
- Exposure path
An unpatched PHP runtime exposes any host serving web requests to pre-authentication remote code execution before application code executes.6810
Mitigations Published in vendor and government guidance, with the source of each
Update PHP runtime installations immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and restart web servers and long-running workers.38910
Source: PHP security advisory · VendorIsolate internet-facing PHP systems from public networks or take them offline until patches or updates can be applied.89
Source: CERT-EU and CISA · GovernmentDisable session upload progress by setting
Source: PHP security advisory · Vendorsession.upload_progress.enabled=0across server and pool configurations.35810Enforce
Source: PHP security advisory · Vendormemory_limit=-1as an un-overrideable admin setting and keeppost_max_sizelow to reduce out-of-memory attack paths.810Monitor web servers for suspicious behavior, specifically PHP processes launching command shells or downloading external files.69
Source: Federal Bureau of Investigation · Government
Follow it in Panorays
- Risk InsightsSearch “PHP”
The Supply Chain Impact tab lists your direct and indirect suppliers linked to PHP.
- Cyber News and Dark Web MentionsPHP’s company page
There are 13 articles on Cyber News related to this event.
- Supply ChainEach company’s page
Shows whether the company uses PHP.
- Technologies CenterReporting Hub › Live Dashboards
PHP is detected on companies’ attack surface, listed as PHP.
- FindingsEach company’s page
CVE-2026-109618 and CVE-2026-109619 are found on companies’ assets.
- Confirm PHP runtime patchingQuestionnaire / general task · to the companies linked to PHP
Ask whether they have inventoried all internet-facing systems running PHP and upgraded their runtime environments to the patched releases or applied temporary mitigations.
Sources
14- 1php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026
Provides technical research referencing CVE-2026-109618 and CVE-2026-109619.
- 2Exposed to PHP2Shell? Cyber Experts Weigh in With AdviceDark Reading · October 23, 2026
Covers expert mitigation advice for PHP2Shell vulnerabilities.
- 3PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell PatchesThe Hacker News · October 23, 2026
Reports on the surging exploit attempts and PHP’s warning regarding CVE-2026-115560.
- 4PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · October 23, 2026
Details large-scale exploit attempts to deploy the Potassium Mirai botnet variant.
- 5Informational advisory: Session upload progressGitHub (ikow) · October 23, 2026
Official PHP advisory regarding session upload progress and CVE-2026-115560.
- 6Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026
Details pre-disclosure exploitation attempts against Amazon honeypots and embargo leaks.
- 7‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026
Covers the security industry alert and remediation efforts following leaked flaw details.
- 82026-018: Critical Vulnerabilities in PHPCERT-EU · October 21, 2026
CERT-EU security advisory detailing technical mechanics and mitigations for the PHP flaws.
- 9Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026
CISA security alert urging immediate patching and network isolation.
- 10PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026
Details PHP’s emergency updates for the two critical PHP2Shell vulnerabilities.
- 11PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026
Analyzes the limitations of temporary mitigations ahead of the official patch release.
- 12PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · October 21, 2026
Reports on the initial leak, out-of-cycle release scheduling, and attack surface estimates.
- 13Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026
Cloudflare blog detailing deployed WAF protections against PHP2Shell.
- 14Upcoming Critical PHP Security ReleasePHP · October 20, 2026
Initial advance security notice from PHP announcing upcoming patches.
Previous version: October 23, 2026
What changed in the October 24 update
- The status is unchanged: identified since October 20, 2026.
- A third vulnerability, CVE-2026-115560, was added after PHP’s informational advisory of October 23.
- Cloudflare reported exploit attempts reaching millions of requests by early October 22, with attackers trying to deploy a Mirai botnet variant named Potassium.
- The timeline grew from 7 to 9 events, the indicators from 6 to 13, the companies in the coverage from 6 to 19 and the sources from 10 to 14.
- The MITRE ATT&CK mapping now covers vulnerability scanning, tool transfer and denial of service alongside exploitation of the public-facing application.
Show the October 23 report
Threat intel reportPanorays Threat Center · October 23, 2026
- Primary impacted company
- PHP
- Incident type
- Security Vulnerability
- IdentifiedOctober 20, 2026First report of the incident10
- ActiveNot yet
- ContainedNot yet
- ConcludedNot yet
What happened
The PHP project issued emergency security updates to address two critical pre-authentication remote code execution vulnerabilities in the PHP core runtime, collectively dubbed PHP2Shell.246
Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws are rated 9.2 on the CVSS scoring system and were discovered by researchers from Calif, Wiz, OpenAI, and Quarkslab.269 The vulnerabilities impact every PHP release from the 7.x and 8.x series and expose all installations serving web requests, with Apache mod_php presenting the highest risk.246
CVE-2026-109618 allows remote code execution through memory corruption during out-of-memory handling, while CVE-2026-109619 enables remote code execution through stale global state surviving after freed request memory.4 In addition to code execution, researchers demonstrated that an attacker can read live memory from the PHP worker process to capture passwords, authentication tokens, API keys, and certificates belonging to other requests without prior code execution.6
According to CrowdStrike, an attack exploiting the flaws “leaves virtually no digital traces,” with worker processes returning HTTP 200 responses and leaving only an isolated memory-limit fatal error in web server logs.2
Following an advance disclosure leak on October 20, 2026, and early exploit attempts observed against Amazon honeypots dating back to October 17, 2026, the PHP team moved the release forward and shipped patches in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, at 13:30 UTC.2468 Government cybersecurity agencies, including CISA and the UK NCSC, issued alerts urging organizations to immediately patch exposed systems or disconnect them from the internet.25
Confirmation ladder
3- Attacker claimNot reached
A threat actor says it did this. No independent confirmation.
- Trusted source reportedOctober 21, 2026
A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.
- Company acknowledgedOctober 20, 2026
The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.
- Follow-upOctober 21, 2026
Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.
Timeline
7- October 17, 2026
An unidentified threat actor attempts to exploit the unpatched vulnerabilities against an Amazon MadPot honeypot service from an Australian IP address.2
- Reported October 20, 2026
- October 20, 2026
Leaked posts circulate details and CVE identifiers for two critical unpatched PHP remote code execution vulnerabilities scheduled for disclosure on Thursday.8
- October 21, 2026, at 2 a.m. UTC
Amazon detects the earliest proof-of-concept exploit attempts across anonymized infrastructure.2
- October 21, 2026, at 8:36 a.m. UTC
ELLIO sensors detect the first exploit requests less than an hour after Chainguard published built container images containing the fix.2
- October 21, 2026, at 13:30 UTC
The PHP team releases patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 along with source backports for unsupported branches.4
- Reported October 21, 2026
CISA publishes an alert urging organizations to inventory and immediately patch vulnerable PHP installations or take them offline.5
Attack analysis
- Attack vector
- Sending an unauthenticated HTTP request triggering memory corruption during request parsing
An unauthenticated remote attacker can trigger the vulnerabilities against exposed PHP endpoints before any application-level code executes, exploiting memory management or error handling in the runtime.246
- Attack model
- Pre-authentication remote code execution and process memory extraction
Attackers can achieve remote code execution across web servers running PHP or read sensitive data directly from live worker memory without authentication.246
- Data exposed
- Process worker memory including passwords, session tokens, API keys, and certificates
Researchers demonstrated that an attacker can read live memory from the PHP worker process holding credentials and tokens from concurrent or prior requests.6
- Scale
- All web servers running unpatched PHP 7.x and 8.x, powering an estimated 70% of websites
Cloudflare noted that PHP is used by almost 70% of websites, and internet scans identified hundreds of thousands of publicly accessible servers running legacy or unsupported versions.28
- Dwell time
- At least 4 days of pre-disclosure zero-day targeting
Amazon detected exploit targeting against its honeypot infrastructure on October 17, 2026, four days before coordinated public disclosure on October 21, 2026.2
Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK
- Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromExploiting unauthenticated vulnerabilities in public-facing PHP web server endpoints246
- Command and Scripting InterpreterATT&CK IDT1059TacticExecutionMapped fromUnexpectedly launching command shells or downloading files from PHP worker processes25
- Data from Local SystemATT&CK IDT1005TacticCollectionMapped fromReading passwords, authentication tokens, and API keys directly from PHP worker memory6
- ProxyATT&CK IDT1090TacticCommand and ControlMapped fromRouting exploit traffic through commercial anonymization networks and proxies2
Technologies
- PHP
- PHP 7.x
- PHP 8.x
- PHP 8.2
- PHP 8.3
- PHP 8.4
- PHP 8.5
- Apache mod_php
- PHP-FPM
- php-cgi
- FrankenPHP
- LiteSpeed
Vulnerabilities
- CVE-2026-109618Exploited in attacks
Memory corruption during out-of-memory error handling via longjmp() enabling pre-authentication remote code execution.1245689
AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches
- CVE-2026-109619Exploited in attacks
Stale global state referencing freed request memory enabling pre-authentication remote code execution.1245689
AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches
Indicators Addresses linked to the attackers. Values are defanged and not linked.
- IP address
103.216.220[.]92Anonymized IP address geolocated to Australia used in pre-disclosure honeypot exploit attempt on October 17, 20262 - IP address
31.223.184[.]166IP address observed launching exploit attempts against honeypots on October 21, 20262 - IP address
37.19.200[.]5IP address observed launching exploit attempts against honeypots on October 21, 20262 - IP address
134.209.159[.]64IP address observed launching exploit attempts against honeypots on October 21, 20262 - IP address
103.114.163[.]188IP address observed launching exploit attempts against honeypots on October 21, 20262 - IP address
95.217.98[.]37IP address observed launching exploit attempts against honeypots on October 21, 20262
Blast radius
- Reason
- The PHP project’s core runtime contains two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- How they got in
- Sending an unauthenticated HTTP request triggering memory corruption during request parsing
- Affected products
- PHP, PHP 7.x, PHP 8.x, PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5, PHP-FPM, php-cgi
- Vulnerabilities used
- CVE-2026-109618 · CVSS score 9.8 Exploited in attacks
- CVE-2026-109619 · CVSS score 8.1 Exploited in attacks
Other companies in the coverage
6- AAmazonReporter or researcher
Amazon’s Threat Intelligence team reported detecting pre-disclosure exploit attempts against its MadPot honeypot service.2
- CCloudflareReporter or researcher
Cloudflare observed early exploit attempts and deployed emergency WAF rules to protect customer sites.2679
- OOpenAIReporter or researcher
OpenAI co-discovered the vulnerabilities and released a Codex detection skill for defenders.269
- CChainguardMentioned only
Chainguard published fixed container images prior to the scheduled disclosure time.2
- CCrowdStrikeReporter or researcher
CrowdStrike provided technical telemetry analysis demonstrating that attacks leave virtually no server logs.2
- CCybersecurity and Infrastructure Security AgencyReporter or researcher
CISA issued an emergency alert advising organizations to immediately apply PHP security patches.25
TPCRM perspective
Supply chain angle
Risk typeCritical third-party runtime vulnerability in web infrastructure
- Dependency
Web runtime engine. Organizations and cloud vendors run PHP to serve web applications, APIs, content management systems, and hosting platforms.246
- Party
First party if it is your own company; third party if you use PHP directly; fourth party through a supplier that uses it.
- Exposure path
A supplier hosting web endpoints on vulnerable versions of PHP can be remotely compromised or have sensitive request data read from memory without any vulnerability in their own application code.46
Mitigations Published in vendor and government guidance, with the source of each
Update PHP runtime installations immediately to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply backported distribution patches.456
Source: PHP security advisory · VendorIsolate internet-facing applications running PHP from public networks or take unsupported installations offline until updates are applied.45
Source: CISA alert and CERT-EU advisory 2026-018 · GovernmentSet
Source: PHP security advisory · Vendormemory_limit=-1at the web server or pool configuration level to prevent controllable out-of-memory aborts under CVE-2026-109618.46Set
Source: PHP security advisory · Vendorsession.upload_progress.enabled=0across php.ini or FPM pool configurations and restart all worker processes to block known session attack paths for CVE-2026-109619.46Deploy web application firewall rules to detect and filter suspicious request structures and multipart payloads.579
Source: Cloudflare · Security researcherMonitor web server processes for unexpected execution of command shells, interpreters, or file download utilities.25
Source: FBI and CISA · Government
Follow it in Panorays
- Risk InsightsSearch “PHP”
The Supply Chain Impact tab lists your direct and indirect suppliers linked to PHP.
- Cyber News and Dark Web MentionsPHP’s company page
There are 10 articles on Cyber News related to this event.
- Supply ChainEach company’s page
Shows whether the company uses PHP.
- Technologies CenterReporting Hub › Live Dashboards
PHP is detected on companies’ attack surface, listed as PHP.
- FindingsEach company’s page
CVE-2026-109618 and CVE-2026-109619 are found on companies’ assets.
- Confirm PHP runtime patchingQuestionnaire / general task · to the companies linked to PHP
Ask whether they have inventoried all systems running PHP across their infrastructure and confirmed updates to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Sources
10- 1php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026
Seed research repository referencing the CVE identifiers and PoC research.
- 2Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026
Details honeypot exploitation attempts four days prior to disclosure and technical telemetry characteristics.
- 3‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026
Covers security industry reaction to leaked details and active exploit attempts.
- 42026-018: Critical Vulnerabilities in PHPCERT-EU · October 21, 2026
CERT-EU technical security advisory detailing the flaw mechanics, affected versions, and temporary mitigations.
- 5Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026
CISA alert urging immediate inventorying and patching of vulnerable PHP installations.
- 6PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026
Comprehensive reporting on the emergency release, technical differences across runtimes, and worker memory leakage.
- 7PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026
Analysis of proposed configuration workarounds and defensive limitations prior to patching.
- 8PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · October 21, 2026
Early reporting on the embargo leak, initial CVSS ratings, and advance security notice.
- 9Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026
Cloudflare blog post detailing coordinated disclosure and WAF protection deployment.
- 10Upcoming Critical PHP Security ReleasePHP · October 20, 2026
Official advance notice published by the PHP project.
