PHP2Shell Threat Intel Report: PHP Remote Code Execution Flaws (CVE-2026-109618 & CVE-2026-109619)

Updated October 27, 2026. This report was refreshed with the latest Threat Center data. The October 24 and October 23 versions are kept at the end of the page.

Threat intel reportPanorays Threat Center · October 27, 2026

Primary impacted company: PHP
Incident type: Data Exposure

Current statusActiveFix released October 21, 2026^29101316Since October 21, 2026. Attackers still have access, affected systems are still down, the flaw is being exploited, or authorities say the campaign is still running.

IdentifiedOctober 20, 2026First report of the incident¹⁹
ActiveOctober 21, 2026CISA, CERT-EU, Cloudflare, PerplexityStill running^{2347910151617}
ContainedNot yet
ConcludedNot yet

What happened

The PHP project released emergency security updates to address two critical remote code execution vulnerabilities, collectively dubbed PHP2Shell, impacting core versions of the PHP runtime.⁹¹⁶

Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale, the flaws allow unauthenticated remote code execution on web servers running vulnerable PHP configurations before application code executes.⁹¹⁶ CVE-2026-109618 is an out-of-memory corruption flaw caused by PHP’s use of longjmp() during request termination, while CVE-2026-109619 stems from stale global state surviving across requests after backing memory is freed.⁹ The PHP Foundation stated that “Both issues sit in parts of PHP that nearly every request touches: memory management and error handling,” noting that an attacker could also read live worker process memory to expose passwords, authentication tokens, API keys, and certificates.¹³¹⁶

The vulnerabilities were discovered by researchers from Calif, OpenAI, and Wiz, and were originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC.¹³¹⁶ After technical details and proof-of-concept exploit code leaked ahead of time, the PHP project moved the release forward and issued patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026.⁹¹³¹⁶ Two days later, on October 23, 2026, PHP issued an informational advisory for a third flaw, CVE-2026-115560, which also enables remote code execution in narrow, unusual configurations using session upload progress.⁹¹⁰

Exploitation attempts began before public disclosure, with Amazon’s threat intelligence team logging attempts against its MadPot honeypot service starting on October 17, 2026.¹⁰¹³ Following the public release, Cloudflare reported millions of exploit attempts, while security researchers observed threat actors attempting to deploy a Mirai botnet variant dubbed Potassium.¹⁰¹¹ CYFIRMA also observed a suspected North Korea-linked campaign attributed with moderate confidence to the Lazarus Group ecosystem, which used compromised nodes to probe 216 hosts across multiple critical sectors. Palo Alto Networks Unit 42 reported that an attacker compromised an unidentified European government entity using PHP2Shell, accessing password hashes and multi-factor authentication secrets within two hours of initial exploitation and attempting domain administrator privilege escalation.⁷ On October 26, 2026, the Cybersecurity and Infrastructure Security Agency added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after honeypot compromises confirmed remote code execution in the wild.²³

Confirmation ladder

Attacker claimNot reached
A threat actor says it did this. No independent confirmation.
Trusted source reportedOctober 22, 2026
A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.
Company acknowledgedOctober 20, 2026
The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.
Follow-upOctober 23, 2026
Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.

Timeline

October 17, 2026

Amazon detects an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on its MadPot honeypot service.¹⁰¹³

What the attackers didTrusted source reported
October 20, 2026

The PHP project announces an upcoming security release addressing two critical vulnerabilities.⁹¹⁹

Company or authority statementCompany acknowledged
October 21, 2026, at 2 a.m. UTC

Amazon detects multiple proof-of-concept exploits for PHP2Shell coinciding with the release day.¹³

What the attackers didTrusted source reported
October 21, 2026, at 8:36 a.m. UTC

ELLIO observes the first PHP2Shell request targeting its sensors after Chainguard published built images containing the fix.¹³

What the attackers didTrusted source reported
October 21, 2026, at 13:30 UTC

PHP releases emergency security updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to patch CVE-2026-109618 and CVE-2026-109619.⁹¹⁶

What the company didCompany acknowledged
October 23, 2026

PHP issues an informational advisory warning of CVE-2026-115560, recommending disabling session upload progress.⁹¹⁰¹²

Company or authority statementFollow-up
October 24, 2026

Perplexity detection and response lead Adel Karimi observes confirmed remote code execution against honeypot systems using PHP2Shell.²

What the attackers didTrusted source reported
October 26, 2026

CISA adds CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04.²³⁵⁶

Company or authority statementFollow-up

Attack analysis

Attributed actorLazarus Group

Also known as: Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet
MITRE ATT&CK group: G0032
Profile: Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.
SyncHole watering hole campaign. Lazarus Group has a documented history of compromising PHP and WordPress servers to plant PHP and ASP web shells, as observed in the SyncHole watering hole campaign.⁷
Responsibility: Attributed with moderate confidence to Lazarus Group operators. CYFIRMA attributed a low-volume reconnaissance and scanning campaign targeting 216 global hosts to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem.⁷

Attack vector: Specially crafted HTTP requests triggering memory corruption or stale global state
Attackers send unauthenticated HTTP requests to vulnerable PHP endpoints, exploiting out-of-memory handling in CVE-2026-109618 or uninitialized stale global request state in CVE-2026-109619 to execute arbitrary code.⁹¹¹¹⁶
Attack model: Pre-authentication remote code execution and credential harvesting
Threat actors exploited the vulnerabilities to execute commands before application code ran, deploy botnet malware, and establish NTLM-relay tunnels into Active Directory to escalate privileges.⁷¹¹¹⁶
Data exposed: Password hashes, multi-factor authentication secrets, and worker process memory contents
Unit 42 reported that attackers accessed password hashes and two-factor authentication secrets at a European government entity, while researchers demonstrated that reading PHP worker memory discloses passwords, API keys, and session cookies.⁷¹⁶

Taken October 21, 2026⁷¹⁶

Leak threatened

Leaked or for sale
Scale: Millions of exploit attempts across global infrastructure and 216 prioritized target hosts
Cloudflare recorded millions of exploitation attempts, while CYFIRMA identified 216 targeted hosts across 12 jurisdictions, and Unit 42 confirmed the compromise of a European government entity.⁷¹⁰¹¹
Dwell time: Under two hours to credential access
At a European government entity, attackers accessed password hashes and multi-factor authentication secrets within two hours of initial exploitation.⁷

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromExploiting pre-authentication vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP⁹¹⁶
Active Scanning: Vulnerability ScanningATT&CK IDT1595.002TacticReconnaissanceMapped fromScanning and probing global PHP infrastructure using screening scripts and honeypot probes⁷¹⁰¹¹
Command and Scripting Interpreter: Unix ShellATT&CK IDT1059.004TacticExecutionMapped fromPHP processes launching command shells or running shell commands¹¹¹³¹⁵
OS Credential DumpingATT&CK IDT1003TacticCredential AccessMapped fromAccessing password hashes from the authentication database⁷
Modify Authentication Process: Multi-Factor AuthenticationATT&CK IDT1556.006TacticCredential AccessMapped fromAccessing two-factor authentication secrets⁷
Adversary-in-the-Middle: Name Resolution Poisoning and SMB RelayATT&CK IDT1557.001TacticCredential AccessMapped fromEstablishing an NTLM-relay tunnel into Active Directory⁷
Account Discovery: Domain AccountATT&CK IDT1087.002TacticDiscoveryMapped fromAnonymous LDAP queries to domain controllers to discover the administrator account⁷
Ingress Tool TransferATT&CK IDT1105TacticCommand and ControlMapped fromContacting external IP addresses to retrieve loaders and download Linux ELF binaries¹¹¹⁵

Technologies

PHP
Apache mod_php
PHP-FPM

Vulnerabilities

CVE-2026-109618Exploited in attacks · listed by CISA

CVSS score9.8 NVD9.2 PHPNVD record

Out-of-memory corruption flaw allowing unauthenticated remote code execution²³⁹¹⁶

AffectedPHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35, and PHP 7.x/8.x branches
CVE-2026-109619Exploited in attacks · listed by CISA

CVSS score8.1 NVD9.2 PHPNVD record

Stale internal request-state flaw allowing unauthenticated remote code execution²³⁹¹⁶

AffectedPHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35, and PHP 7.x/8.x branches
CVE-2026-115560

Remote code execution flaw in narrow configurations modifying session serialization handlers with session upload progress enabled⁹¹⁰¹²

AffectedPHP with session.serialize_handler changed at runtime

Indicators Addresses linked to the attackers. Values are defanged and not linked.

IP address85.11.167[.]243attack source IP address¹¹
IP address217.60.242[.]76attack source IP address¹¹
IP address45.198.224[.]169attack source IP address¹¹
IP address92.118.112[.]100loader retrieval server¹¹
IP address134.199.154[.]64command-and-control IP address¹¹
Domainthunder[.]godofthunder[.]stcommand-and-control domain¹¹
IP address206.188.197[.]105:9999exposed exploit tooling server¹¹
IP address204.76.203[.]7mass-exploit IP address probing honeypots⁷
IP address103.216.220[.]92pre-disclosure honeypot exploit source IP address¹³

Blast radius

Attacker

Lazarus GroupPre-authentication remote code execution and credential harvesting

Way in

PHPVendor of affected product · Company acknowledged

Reason: PHP developed the software affected by critical remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619.
How they got in: Specially crafted HTTP requests triggering memory corruption or stale global state
Affected products: PHP, PHP-FPM
Vulnerabilities used: CVE-2026-109618 · CVSS score 9.8 Exploited in attacks · listed by CISA

CVE-2026-109619 · CVSS score 8.1 Exploited in attacks · listed by CISA
Sources: ^{23910111213151619}

Other companies in the coverage

C
Cybersecurity and Infrastructure Security AgencyMentioned only

CISA issued alerts and added the PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog.^23561315
C
CloudflareReporter or researcher

Cloudflare monitored traffic and reported observing millions of exploitation attempts targeting the flaws.^4710161718
A
AmazonReporter or researcher

Amazon’s Threat Intelligence team detected pre-disclosure exploitation attempts against its honeypot service.¹⁰¹³
S
SophosReporter or researcher

Sophos analyzed exploit payloads attempting to deploy a Mirai botnet variant called Potassium.¹⁰¹¹
A
Arctic WolfReporter or researcher

Arctic Wolf reported on weaponized PHP2Shell exploitation attempts delivering Mirai botnet malware.¹⁰¹¹
P
Perplexity AIReporter or researcher

Perplexity’s detection and response team confirmed successful remote code execution against honeypot systems.²
C
ChainguardMentioned only

Chainguard broke the disclosure embargo by publishing patched container images ahead of the coordinated release.¹³

TPCRM perspective

Supply chain angle

Risk typeVulnerable vendor product on companies’ attack surface

Dependency: Ubiquitous web scripting engine. Organizations rely on PHP to power server-side web applications, content management systems, and backend API endpoints.²¹³¹⁶
Party: First party if it is your own company; third party if you use PHP directly; fourth party through a supplier that uses it.
Exposure path: Because the vulnerabilities reside in the core PHP runtime, an unauthenticated attacker can achieve remote code execution on any exposed endpoint regardless of application-level security controls.¹⁶
Assets at risk: Internal Active Directory credentials, server file systems, databases, and sensitive worker memory including session tokens and API keys.⁷¹³¹⁶
You are exposed if: You or your suppliers run unpatched versions of PHP prior to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on internet-accessible web servers.⁹¹⁶

Mitigations Published in vendor and government guidance, with the source of each

Update PHP to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply source backports for supported or LTS releases.⁹¹⁶

Source: PHP security advisory · Vendor
Disable session upload progress by setting session.upload_progress.enabled=0 in php.ini or server configurations and restart all workers.⁹¹⁰¹⁶

Source: PHP security advisory · Vendor
Set memory_limit=-1 via php_admin_value and enforce low post_max_size limits at the proxy or web server level.⁹¹⁶

Source: PHP security advisory · Vendor
Take vulnerable, unpatched, or unsupported PHP systems offline from public networks until updates can be applied.⁹¹⁵

Source: CISA alert · Government
Monitor web servers for anomalous PHP worker processes spawning shells, unexpected file downloads, or unusually large response cookies.¹³¹⁵¹⁶

Source: FBI announcement · Government

Follow it in Panorays

Risk InsightsSearch “PHP”
The Supply Chain Impact tab lists your direct and indirect suppliers linked to PHP.
Cyber News and Dark Web MentionsPHP’s company page
There are 17 articles on Cyber News related to this event.
Supply ChainEach company’s page
Shows whether the company uses PHP.
Technologies CenterReporting Hub › Live Dashboards
PHP is detected on companies’ attack surface, listed as PHP.
FindingsEach company’s page
CVE-2026-109618 and CVE-2026-109619 are found on companies’ assets.
Confirm PHP runtime patchingQuestionnaire / general task · to the companies linked to PHP
Ask whether they run PHP in their external environments, whether all deployments have been updated to fixed versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and whether temporary mitigations such as disabling session upload progress have been applied where patching is pending.

Sources

1
php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026
Seed research report on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell).
2
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionThe Hacker News · October 27, 2026
Reports CISA adding the two actively exploited PHP2Shell flaws to its KEV catalog.
3
CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA News & Events · October 26, 2026
Official CISA notice adding CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog.
4
⚡ Weekly Recap: This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and MoreThe Hacker News · October 26, 2026
Weekly security recap highlighting the PHP2Shell flaws and associated widespread scanning.
5
CISA adds PHP, PHP Group, CVE-2026-109619 to KEV Catalog: PHP Stale Internal Request-State VulnerabilityKEV Catalog · October 26, 2026
KEV catalog entry for PHP stale internal request-state vulnerability (CVE-2026-109619).
6
CISA adds PHP, PHP Group, CVE-2026-109618 to KEV Catalog: PHP Memory Corruption VulnerabilityKEV Catalog · October 26, 2026
KEV catalog entry for PHP memory corruption vulnerability (CVE-2026-109618).
7
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingThe Hacker News · October 25, 2026
Details active exploitation of PHP2Shell vulnerabilities against a European government entity.
8
Exposed to PHP2Shell? Cyber Experts Weigh in With AdviceDark Reading · October 23, 2026
Provides risk assessment and remediation guidance for addressing the PHP2Shell flaws.
9
2026-018: Critical Vulnerabilities in PHPCERT-EU · October 23, 2026
CERT-EU security advisory detailing the disclosure and fixes for PHP2Shell vulnerabilities.
10
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell PatchesThe Hacker News · October 23, 2026
Reports on subsequent PHP security warnings and the rollout of PHP2Shell emergency patches.
11
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · October 23, 2026
Reports on large-scale exploit attempts leveraging PHP2Shell to spread Mirai-variant malware.
12
Informational advisory: Session upload progressGitHub (ikow) · October 23, 2026
Advisory referencing the PHP2Shell vulnerability CVE-2026-109619 and related session handling mitigations.
13
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026
Reports honeypot detection of exploit attempts targeting PHP2Shell prior to public disclosure.
14
‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026
Covers initial disclosure, leak, and remediation urgency surrounding the PHP2Shell flaws.
15
Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026
CISA alert urging immediate patching of the PHP2Shell vulnerabilities.
16
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026
Details the emergency security updates released by PHP to fix the PHP2Shell vulnerabilities.
17
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026
Discusses pre-patch workarounds and mitigation strategies for PHP2Shell prior to official updates.
18
Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026
Announces Cloudflare’s WAF deployment and coordinated disclosure for the PHP2Shell vulnerabilities.
19
Upcoming Critical PHP Security ReleasePHP · October 20, 2026
Advance notice from the PHP team regarding the upcoming emergency release fixing PHP2Shell.

Previous versions

October 24, 2026 version

The event status in this version was corrected to Active · Patch released on October 25, 2026, at the Threat Center team’s request.

What changed in the October 27 update

The Threat Center now reports the event as Active since October 21, 2026, with the fix released the same day.
CYFIRMA attributed a reconnaissance and scanning campaign against 216 hosts, with moderate confidence, to operators in the Lazarus Group ecosystem.
Palo Alto Networks Unit 42 reported the compromise of a European government entity, where password hashes and multi-factor authentication secrets were accessed within two hours.
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, 2026.
The incident type changed from Security Vulnerability to Data Exposure, the MITRE ATT&CK mapping grew from 4 to 8 techniques and the sources from 14 to 19.

Show the October 24 report

Threat intel reportPanorays Threat Center · October 24, 2026

Primary impacted company: PHP
Incident type: Security Vulnerability

Current statusActive · Patch releasedIdentified October 20, 2026.

IdentifiedOctober 20, 2026First report of the incident¹⁴
ActivePatch released
ContainedNot yet
ConcludedNot yet

What happened

PHP released emergency updates for two critical vulnerabilities dubbed PHP2Shell that permit unauthenticated remote code execution, as threat actors launched millions of exploit attempts in the wild.³⁴⁶⁸¹⁰

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and both rated 9.2, reside in PHP core memory management and error handling routines, affecting every reachable PHP endpoint across major versions.³⁶⁸¹⁰ Exploitation can trigger memory corruption during out-of-memory handling or leverage stale global state across worker requests, leaving virtually no application-level log footprints.⁶⁸¹⁰

Originally scheduled for coordinated disclosure on October 22, 2026, details and proof-of-concept exploits leaked early, leading the PHP project to issue emergency patches on October 21 for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.⁶⁸¹⁰¹² Amazon detected an exploit attempt against its honeypot on October 17, four days prior to disclosure, while Cloudflare recorded exploit traffic escalating to millions of requests by early October 22.³⁶

Security researchers observed threat actors attempting to weaponize the flaws to install a Mirai botnet variant known as Potassium, though security firms reported scanning and probing without confirmed remote code execution in the wild.³⁴

On October 23, PHP issued an informational advisory for an additional remote code execution vulnerability, CVE-2026-115560, advising administrators to disable session upload progress while scheduling routine patches.³⁵⁸

Confirmation ladder

Attacker claimNot reached
A threat actor says it did this. No independent confirmation.
Trusted source reportedOctober 21, 2026
A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.
Company acknowledgedOctober 20, 2026
The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.
Follow-upOctober 21, 2026
Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.

Timeline

October 17, 2026

Amazon detects an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on its MadPot honeypot from an IP address geolocated to Australia.³⁶

What the attackers didTrusted source reported
Reported October 20, 2026

The PHP security team publishes an advance notice announcing an upcoming security release.⁸¹²¹⁴

Company or authority statementCompany acknowledged
October 20, 2026

Identifiers and embargo details regarding two critical PHP remote code execution flaws leak publicly on Hacker News.¹²

What the attackers didTrusted source reported
October 21, 2026, at 2 a.m. UTC

Amazon detects multiple proof-of-concept exploits for PHP2Shell originating from anonymized infrastructure.⁶

What the attackers didTrusted source reported
October 21, 2026, at 8:36 a.m. UTC

ELLIO observes the first PHP2Shell request targeting its sensors after Chainguard publishes built container images containing the fix.⁶

What the attackers didTrusted source reported
October 21, 2026, at 13:30 UTC

The PHP project releases emergency patches for CVE-2026-109618 and CVE-2026-109619 across versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.³⁴⁸¹⁰

What the company didCompany acknowledged
Reported October 21, 2026

CISA issues an alert urging organizations to immediately patch or disconnect vulnerable PHP systems.⁹

Company or authority statementTrusted source reported
Early October 22, 2026

Cloudflare reports exploit attempts surging to millions of requests across its network.³

Company or authority statementTrusted source reported
October 23, 2026

The PHP project issues an informational advisory warning of an unpatched remote code execution issue tracked as CVE-2026-115560.³⁵⁸

Company or authority statementCompany acknowledged

Attack analysis

Attack vector: Specially crafted HTTP requests sent to internet-facing PHP endpoints.
Attackers send unauthenticated HTTP requests targeting PHP core routines before application code runs, triggering memory corruption during out-of-memory handling or recycling stale global state.⁴⁶⁸¹⁰
Attack model: Mass exploitation scanning attempting to recruit vulnerable web servers into a Mirai botnet.
Threat actors launched automated scans across millions of targets to deploy a Mirai fork named Potassium capable of executing 24 flood attack commands.³⁴
Scale: Millions of exploit attempts targeting web servers globally.
Cloudflare observed exploit attempts surge from tens of thousands within 45 minutes of disclosure to millions by early October 22.³

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromattempting pre-authentication remote code execution against web servers via PHP2Shell vulnerabilities⁴⁶⁸¹⁰
Active Scanning: Vulnerability ScanningATT&CK IDT1595.002TacticReconnaissanceMapped fromrunning screening scripts to check live websites for exploit prerequisites and server setup³⁴
Ingress Tool TransferATT&CK IDT1105TacticCommand and ControlMapped fromcontacting staging servers to download loader binaries and Linux ELF payloads⁴
Network Denial of ServiceATT&CK IDT1498TacticImpactMapped fromrecruiting infected systems into a Mirai botnet to execute volumetric DDoS flood attacks⁴

Technologies

PHP
Apache mod_php
PHP-FPM
php-cgi
FrankenPHP
LiteSpeed
Linux
Mirai

Vulnerabilities

CVE-2026-109618Exploited in attacks

CVSS score9.8 NVD9.2 PHPNVD record

Out-of-memory error handling via longjmp() leaves uninitialized request memory that is subsequently processed during cleanup, allowing remote code execution.^134689101213

AffectedPHP 8.5 versions prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported branches 8.1 and older
CVE-2026-109619Exploited in attacks

CVSS score8.1 NVD9.2 PHPNVD record

Stale global state survives memory deallocation across worker requests, allowing subsequent requests to access uninitialized data and achieve remote code execution.^134689101213

AffectedPHP 8.5 versions prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported branches 8.1 and older
CVE-2026-115560

Remote code execution flaw triggered when applications dynamically modify session serialize handlers before session initiation while session upload progress remains active.³⁵⁸

AffectedPHP web applications configured with specific dynamic session serialize handlers and active session upload progress

Indicators Addresses linked to the attackers. Values are defanged and not linked.

IP address103.216.220[.]92IP address geolocated to Australia used in an embargo exploit attempt against Amazon’s honeypot⁶
IP address31.223.184[.]166IP address observed in early exploit attempts⁶
IP address37.19.200[.]5IP address observed in early exploit attempts⁶
IP address134.209.159[.]64IP address observed in early exploit attempts⁶
IP address103.114.163[.]188IP address observed in early exploit attempts⁶
IP address95.217.98[.]37IP address observed in early exploit attempts⁶
IP address85.11.167[.]243attack source IP address attempting to deploy Mirai loader⁴
IP address217.60.242[.]76attack source IP address attempting to deploy Mirai loader⁴
IP address45.198.224[.]169attack source IP address attempting to deploy Mirai loader⁴
IP address92.118.112[.]100staging server contacted by attack sources to retrieve Mirai loader binary⁴
Domainthunder[.]godofthunder[.]stcommand-and-control domain queried by the Mirai botnet sample⁴
IP address134.199.154[.]64command-and-control IP address resolved by the Mirai botnet sample⁴
IP address206.188.197[.]105:9999exposed server hosting PHP2Shell exploit tooling and screening scripts⁴

Blast radius

Attacker

UnattributedMass exploitation scanning attempting to recruit vulnerable web servers into a Mirai botnet.

Way in

PHPVendor of affected product · Company acknowledged

Reason: PHP developed and maintains the server runtime affected by the critical PHP2Shell vulnerabilities.
How they got in: Specially crafted HTTP requests sent to internet-facing PHP endpoints.
Affected products: PHP, PHP-FPM, php-cgi
Vulnerabilities used: CVE-2026-109618 · CVSS score 9.8 Exploited in attacks

CVE-2026-109619 · CVSS score 8.1 Exploited in attacks
Sources: ^{134568910121314}

Other companies in the coverage

A
AmazonReporter or researcher

Amazon’s Threat Intelligence team reported detecting pre-disclosure exploit attempts against its honeypot infrastructure.³⁶
C
CloudflareReporter or researcher

Cloudflare reported widespread exploit request volumes and deployed defensive WAF rules.^36101113
S
SophosReporter or researcher

Sophos analyzed exploit attempts attempting to deliver the Potassium Mirai botnet variant.³⁴
A
Arctic WolfReporter or researcher

Arctic Wolf provided technical analysis of weaponized exploit payloads attempting to deploy Mirai malware.³⁴
P
PrevidianReporter or researcher

Previdian monitored threat traffic and reported observing scanning activity without confirmed code execution.³
W
WordfenceReporter or researcher

Wordfence tracked exploit attempts and reported scanning activity across web properties.³
C
Cybersecurity and Infrastructure Security AgencyReporter or researcher

CISA published an emergency alert urging organizations to patch or take vulnerable PHP systems offline.⁶⁹¹¹¹²
W
watchTowrReporter or researcher

watchTowr confirmed the embargo leak and reproduced vulnerability exploit conditions.¹¹¹²
O
OpenAIReporter or researcher

OpenAI co-discovered the vulnerabilities and released detection tooling.⁶¹⁰¹³
C
CrowdStrikeReporter or researcher

CrowdStrike analyzed the exploit mechanism and noted the absence of application logs during exploitation.⁶
C
ChainguardMentioned only

Chainguard published patched container images ahead of the coordinated disclosure embargo.⁶
F
Federal Bureau of InvestigationReporter or researcher

The FBI issued guidance instructing defenders to monitor PHP processes for shell launches or file downloads.⁶
N
National Security AgencyReporter or researcher

The NSA warned that the vulnerabilities provide direct access to server file systems and databases.⁶
N
National Cyber Security CentreReporter or researcher

The UK NCSC issued an alert warning of the severe risk posed by the PHP2Shell flaws.⁶
N
National Cyber Security CentrumReporter or researcher

NCSC-NL tracked third-party software products embedding PHP that may be impacted by the flaws.⁸
F
Flatt SecurityReporter or researcher

Flatt Security analyzed potential workarounds and warned that configuration changes alone could not guarantee protection.¹¹
U
UpwindReporter or researcher

Upwind provided third-party security commentary and guidance during the disclosure period.¹¹
H
HuntressReporter or researcher

Huntress monitored partner environments and shared defense-in-depth guidance.¹²
S
ShodanMentioned only

Shodan host data was referenced by security researchers estimating exposed internet-facing PHP installations.¹²

TPCRM perspective

Supply chain angle

Risk typeVulnerable vendor product on companies’ attack surface

Dependency: Organizations and third-party vendors widely deploy the PHP runtime to execute web applications, host portals, and manage internet-facing services.⁶⁸⁹
Party: First party if it is your own company; third party if you use PHP directly; fourth party through a supplier that uses it.
Exposure path: An unpatched PHP runtime exposes any host serving web requests to pre-authentication remote code execution before application code executes.⁶⁸¹⁰
Assets at risk: Server operating systems, file systems, databases, and process memory storing session tokens and credentials become accessible to attackers.⁶¹⁰
You are exposed if: You or your vendors operate internet-accessible web services powered by unpatched PHP releases prior to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or unsupported branches.⁸¹⁰

Mitigations Published in vendor and government guidance, with the source of each

Update PHP runtime installations immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and restart web servers and long-running workers.³⁸⁹¹⁰

Source: PHP security advisory · Vendor
Isolate internet-facing PHP systems from public networks or take them offline until patches or updates can be applied.⁸⁹

Source: CERT-EU and CISA · Government
Disable session upload progress by setting session.upload_progress.enabled=0 across server and pool configurations.³⁵⁸¹⁰

Source: PHP security advisory · Vendor
Enforce memory_limit=-1 as an un-overrideable admin setting and keep post_max_size low to reduce out-of-memory attack paths.⁸¹⁰

Source: PHP security advisory · Vendor
Monitor web servers for suspicious behavior, specifically PHP processes launching command shells or downloading external files.⁶⁹

Source: Federal Bureau of Investigation · Government

Follow it in Panorays

Risk InsightsSearch “PHP”
The Supply Chain Impact tab lists your direct and indirect suppliers linked to PHP.
Cyber News and Dark Web MentionsPHP’s company page
There are 13 articles on Cyber News related to this event.
Supply ChainEach company’s page
Shows whether the company uses PHP.
Technologies CenterReporting Hub › Live Dashboards
PHP is detected on companies’ attack surface, listed as PHP.
FindingsEach company’s page
CVE-2026-109618 and CVE-2026-109619 are found on companies’ assets.
Confirm PHP runtime patchingQuestionnaire / general task · to the companies linked to PHP
Ask whether they have inventoried all internet-facing systems running PHP and upgraded their runtime environments to the patched releases or applied temporary mitigations.

Sources

1
php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026
Provides technical research referencing CVE-2026-109618 and CVE-2026-109619.
2
Exposed to PHP2Shell? Cyber Experts Weigh in With AdviceDark Reading · October 23, 2026
Covers expert mitigation advice for PHP2Shell vulnerabilities.
3
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell PatchesThe Hacker News · October 23, 2026
Reports on the surging exploit attempts and PHP’s warning regarding CVE-2026-115560.
4
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · October 23, 2026
Details large-scale exploit attempts to deploy the Potassium Mirai botnet variant.
5
Informational advisory: Session upload progressGitHub (ikow) · October 23, 2026
Official PHP advisory regarding session upload progress and CVE-2026-115560.
6
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026
Details pre-disclosure exploitation attempts against Amazon honeypots and embargo leaks.
7
‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026
Covers the security industry alert and remediation efforts following leaked flaw details.
8
2026-018: Critical Vulnerabilities in PHPCERT-EU · October 21, 2026
CERT-EU security advisory detailing technical mechanics and mitigations for the PHP flaws.
9
Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026
CISA security alert urging immediate patching and network isolation.
10
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026
Details PHP’s emergency updates for the two critical PHP2Shell vulnerabilities.
11
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026
Analyzes the limitations of temporary mitigations ahead of the official patch release.
12
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · October 21, 2026
Reports on the initial leak, out-of-cycle release scheduling, and attack surface estimates.
13
Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026
Cloudflare blog detailing deployed WAF protections against PHP2Shell.
14
Upcoming Critical PHP Security ReleasePHP · October 20, 2026
Initial advance security notice from PHP announcing upcoming patches.

October 23, 2026 version

What changed in the October 24 update

The event status moved from Identified to Active · Patch released.
A third vulnerability, CVE-2026-115560, was added after PHP’s informational advisory of October 23.
Cloudflare reported exploit attempts reaching millions of requests by early October 22, with attackers trying to deploy a Mirai botnet variant named Potassium.
The timeline grew from 7 to 9 events, the indicators from 6 to 13, the companies in the coverage from 6 to 19 and the sources from 10 to 14.
The MITRE ATT&CK mapping now covers vulnerability scanning, tool transfer and denial of service alongside exploitation of the public-facing application.

Show the October 23 report

Threat intel reportPanorays Threat Center · October 23, 2026

Primary impacted company: PHP
Incident type: Security Vulnerability

Current statusIdentifiedSince October 20, 2026. Articles report the incident.

IdentifiedOctober 20, 2026First report of the incident¹⁰
ActiveNot yet
ContainedNot yet
ConcludedNot yet

What happened

The PHP project issued emergency security updates to address two critical pre-authentication remote code execution vulnerabilities in the PHP core runtime, collectively dubbed PHP2Shell.²⁴⁶

Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws are rated 9.2 on the CVSS scoring system and were discovered by researchers from Calif, Wiz, OpenAI, and Quarkslab.²⁶⁹ The vulnerabilities impact every PHP release from the 7.x and 8.x series and expose all installations serving web requests, with Apache mod_php presenting the highest risk.²⁴⁶

CVE-2026-109618 allows remote code execution through memory corruption during out-of-memory handling, while CVE-2026-109619 enables remote code execution through stale global state surviving after freed request memory.⁴ In addition to code execution, researchers demonstrated that an attacker can read live memory from the PHP worker process to capture passwords, authentication tokens, API keys, and certificates belonging to other requests without prior code execution.⁶

According to CrowdStrike, an attack exploiting the flaws “leaves virtually no digital traces,” with worker processes returning HTTP 200 responses and leaving only an isolated memory-limit fatal error in web server logs.²

Following an advance disclosure leak on October 20, 2026, and early exploit attempts observed against Amazon honeypots dating back to October 17, 2026, the PHP team moved the release forward and shipped patches in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, at 13:30 UTC.²⁴⁶⁸ Government cybersecurity agencies, including CISA and the UK NCSC, issued alerts urging organizations to immediately patch exposed systems or disconnect them from the internet.²⁵

Confirmation ladder

Attacker claimNot reached
A threat actor says it did this. No independent confirmation.
Trusted source reportedOctober 21, 2026
A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.
Company acknowledgedOctober 20, 2026
The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.
Follow-upOctober 21, 2026
Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.

Timeline

October 17, 2026

An unidentified threat actor attempts to exploit the unpatched vulnerabilities against an Amazon MadPot honeypot service from an Australian IP address.²

What the attackers didTrusted source reported
Reported October 20, 2026

The PHP security team posts an advance notice announcing an upcoming emergency out-of-cycle security release.⁸¹⁰

Company or authority statementCompany acknowledged
October 20, 2026

Leaked posts circulate details and CVE identifiers for two critical unpatched PHP remote code execution vulnerabilities scheduled for disclosure on Thursday.⁸

What the attackers didTrusted source reported
October 21, 2026, at 2 a.m. UTC

Amazon detects the earliest proof-of-concept exploit attempts across anonymized infrastructure.²

What the attackers didTrusted source reported
October 21, 2026, at 8:36 a.m. UTC

ELLIO sensors detect the first exploit requests less than an hour after Chainguard published built container images containing the fix.²

What the attackers didTrusted source reported
October 21, 2026, at 13:30 UTC

The PHP team releases patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 along with source backports for unsupported branches.⁴

What the company didCompany acknowledged
Reported October 21, 2026

CISA publishes an alert urging organizations to inventory and immediately patch vulnerable PHP installations or take them offline.⁵

Company or authority statementFollow-up

Attack analysis

Attack vector: Sending an unauthenticated HTTP request triggering memory corruption during request parsing
An unauthenticated remote attacker can trigger the vulnerabilities against exposed PHP endpoints before any application-level code executes, exploiting memory management or error handling in the runtime.²⁴⁶
Attack model: Pre-authentication remote code execution and process memory extraction
Attackers can achieve remote code execution across web servers running PHP or read sensitive data directly from live worker memory without authentication.²⁴⁶
Data exposed: Process worker memory including passwords, session tokens, API keys, and certificates
Researchers demonstrated that an attacker can read live memory from the PHP worker process holding credentials and tokens from concurrent or prior requests.⁶
Scale: All web servers running unpatched PHP 7.x and 8.x, powering an estimated 70% of websites
Cloudflare noted that PHP is used by almost 70% of websites, and internet scans identified hundreds of thousands of publicly accessible servers running legacy or unsupported versions.²⁸
Dwell time: At least 4 days of pre-disclosure zero-day targeting
Amazon detected exploit targeting against its honeypot infrastructure on October 17, 2026, four days before coordinated public disclosure on October 21, 2026.²

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromExploiting unauthenticated vulnerabilities in public-facing PHP web server endpoints²⁴⁶
Command and Scripting InterpreterATT&CK IDT1059TacticExecutionMapped fromUnexpectedly launching command shells or downloading files from PHP worker processes²⁵
Data from Local SystemATT&CK IDT1005TacticCollectionMapped fromReading passwords, authentication tokens, and API keys directly from PHP worker memory⁶
ProxyATT&CK IDT1090TacticCommand and ControlMapped fromRouting exploit traffic through commercial anonymization networks and proxies²

Technologies

PHP
PHP 7.x
PHP 8.x
PHP 8.2
PHP 8.3
PHP 8.4
PHP 8.5
Apache mod_php
PHP-FPM
php-cgi
FrankenPHP
LiteSpeed

Vulnerabilities

CVE-2026-109618Exploited in attacks

CVSS score9.8 NVD9.2 PHP security teamNVD record

Memory corruption during out-of-memory error handling via longjmp() enabling pre-authentication remote code execution.^1245689

AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches
CVE-2026-109619Exploited in attacks

CVSS score8.1 NVD9.2 PHP security teamNVD record

Stale global state referencing freed request memory enabling pre-authentication remote code execution.^1245689

AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches

Indicators Addresses linked to the attackers. Values are defanged and not linked.

IP address103.216.220[.]92Anonymized IP address geolocated to Australia used in pre-disclosure honeypot exploit attempt on October 17, 2026²
IP address31.223.184[.]166IP address observed launching exploit attempts against honeypots on October 21, 2026²
IP address37.19.200[.]5IP address observed launching exploit attempts against honeypots on October 21, 2026²
IP address134.209.159[.]64IP address observed launching exploit attempts against honeypots on October 21, 2026²
IP address103.114.163[.]188IP address observed launching exploit attempts against honeypots on October 21, 2026²
IP address95.217.98[.]37IP address observed launching exploit attempts against honeypots on October 21, 2026²

Blast radius

Attacker

UnattributedPre-authentication remote code execution and process memory extraction

Way in

PHPVendor of affected product · Company acknowledged

Reason: The PHP project’s core runtime contains two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
How they got in: Sending an unauthenticated HTTP request triggering memory corruption during request parsing
Affected products: PHP, PHP 7.x, PHP 8.x, PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5, PHP-FPM, php-cgi
Vulnerabilities used: CVE-2026-109618 · CVSS score 9.8 Exploited in attacks

CVE-2026-109619 · CVSS score 8.1 Exploited in attacks
Sources: ^124568910

Other companies in the coverage

A
AmazonReporter or researcher

Amazon’s Threat Intelligence team reported detecting pre-disclosure exploit attempts against its MadPot honeypot service.²
C
CloudflareReporter or researcher

Cloudflare observed early exploit attempts and deployed emergency WAF rules to protect customer sites.²⁶⁷⁹
O
OpenAIReporter or researcher

OpenAI co-discovered the vulnerabilities and released a Codex detection skill for defenders.²⁶⁹
C
ChainguardMentioned only

Chainguard published fixed container images prior to the scheduled disclosure time.²
C
CrowdStrikeReporter or researcher

CrowdStrike provided technical telemetry analysis demonstrating that attacks leave virtually no server logs.²
C
Cybersecurity and Infrastructure Security AgencyReporter or researcher

CISA issued an emergency alert advising organizations to immediately apply PHP security patches.²⁵

TPCRM perspective

Supply chain angle

Risk typeCritical third-party runtime vulnerability in web infrastructure

Dependency: Web runtime engine. Organizations and cloud vendors run PHP to serve web applications, APIs, content management systems, and hosting platforms.²⁴⁶
Party: First party if it is your own company; third party if you use PHP directly; fourth party through a supplier that uses it.
Exposure path: A supplier hosting web endpoints on vulnerable versions of PHP can be remotely compromised or have sensitive request data read from memory without any vulnerability in their own application code.⁴⁶
Assets at risk: Underlying server file systems, databases, web sessions, authentication credentials, and corporate API keys handled by supplier web applications.²⁶
You are exposed if: A company or its vendors expose internet-facing services powered by unpatched PHP 7.x or 8.x runtimes.²⁴⁶

Mitigations Published in vendor and government guidance, with the source of each

Update PHP runtime installations immediately to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply backported distribution patches.⁴⁵⁶

Source: PHP security advisory · Vendor
Isolate internet-facing applications running PHP from public networks or take unsupported installations offline until updates are applied.⁴⁵

Source: CISA alert and CERT-EU advisory 2026-018 · Government
Set memory_limit=-1 at the web server or pool configuration level to prevent controllable out-of-memory aborts under CVE-2026-109618.⁴⁶

Source: PHP security advisory · Vendor
Set session.upload_progress.enabled=0 across php.ini or FPM pool configurations and restart all worker processes to block known session attack paths for CVE-2026-109619.⁴⁶

Source: PHP security advisory · Vendor
Deploy web application firewall rules to detect and filter suspicious request structures and multipart payloads.⁵⁷⁹

Source: Cloudflare · Security researcher
Monitor web server processes for unexpected execution of command shells, interpreters, or file download utilities.²⁵

Source: FBI and CISA · Government

Follow it in Panorays

Risk InsightsSearch “PHP”
The Supply Chain Impact tab lists your direct and indirect suppliers linked to PHP.
Cyber News and Dark Web MentionsPHP’s company page
There are 10 articles on Cyber News related to this event.
Supply ChainEach company’s page
Shows whether the company uses PHP.
Technologies CenterReporting Hub › Live Dashboards
PHP is detected on companies’ attack surface, listed as PHP.
FindingsEach company’s page
CVE-2026-109618 and CVE-2026-109619 are found on companies’ assets.
Confirm PHP runtime patchingQuestionnaire / general task · to the companies linked to PHP
Ask whether they have inventoried all systems running PHP across their infrastructure and confirmed updates to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

Sources

1
php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026
Seed research repository referencing the CVE identifiers and PoC research.
2
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026
Details honeypot exploitation attempts four days prior to disclosure and technical telemetry characteristics.
3
‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026
Covers security industry reaction to leaked details and active exploit attempts.
4
2026-018: Critical Vulnerabilities in PHPCERT-EU · October 21, 2026
CERT-EU technical security advisory detailing the flaw mechanics, affected versions, and temporary mitigations.
5
Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026
CISA alert urging immediate inventorying and patching of vulnerable PHP installations.
6
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026
Comprehensive reporting on the emergency release, technical differences across runtimes, and worker memory leakage.
7
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026
Analysis of proposed configuration workarounds and defensive limitations prior to patching.
8
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · October 21, 2026
Early reporting on the embargo leak, initial CVSS ratings, and advance security notice.
9
Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026
Cloudflare blog post detailing coordinated disclosure and WAF protection deployment.
10
Upcoming Critical PHP Security ReleasePHP · October 20, 2026
Official advance notice published by the PHP project.

PHP2Shell Threat Intel Report: PHP Remote Code Execution Flaws (CVE-2026-109618 & CVE-2026-109619)

What happened

Confirmation ladder

Timeline

Attack analysis

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Technologies

Vulnerabilities

Indicators Addresses linked to the attackers. Values are defanged and not linked.

Blast radius

Other companies in the coverage

TPCRM perspective

Supply chain angle

Mitigations Published in vendor and government guidance, with the source of each

Follow it in Panorays

Sources

Previous versions

October 24, 2026 version

What happened

Confirmation ladder

Timeline

Attack analysis

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Technologies

Vulnerabilities

Indicators Addresses linked to the attackers. Values are defanged and not linked.

Blast radius

Other companies in the coverage

TPCRM perspective

Supply chain angle

Mitigations Published in vendor and government guidance, with the source of each

Follow it in Panorays

Sources

October 23, 2026 version

What happened

Confirmation ladder

Timeline

Attack analysis

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

Technologies

Vulnerabilities

Indicators Addresses linked to the attackers. Values are defanged and not linked.

Blast radius

Other companies in the coverage

TPCRM perspective

Supply chain angle

Mitigations Published in vendor and government guidance, with the source of each

Follow it in Panorays

Sources

Subscribe to our blog

You May Be Interested In

Freezer Hacks Spread Across Europe, Exposing the Growing Cost of Third-Party Cyberattacks

WordPress Vulnerability CVE-2026-119977: What It Means for Your Vendors’ Websites

The vendor was fine. The channel wasn’t. A third-party risk view of the Claude Code incident

The Fastest and Easiest Wayto Do Business Together, Securely

The Fastest and Easiest Way
to Do Business Together, Securely