PHP2Shell Threat Intel Report: PHP Remote Code Execution Flaws (CVE-2026-109618 & CVE-2026-10961)

What happened

The PHP project issued emergency security updates to address two critical pre-authentication remote code execution vulnerabilities in the PHP core runtime, collectively dubbed PHP2Shell.²⁴⁶

Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws are rated 9.2 on the CVSS scoring system and were discovered by researchers from Calif, Wiz, OpenAI, and Quarkslab.²⁶⁹ The vulnerabilities impact every PHP release from the 7.x and 8.x series and expose all installations serving web requests, with Apache mod_php presenting the highest risk.²⁴⁶

CVE-2026-109618 allows remote code execution through memory corruption during out-of-memory handling, while CVE-2026-109619 enables remote code execution through stale global state surviving after freed request memory.⁴ In addition to code execution, researchers demonstrated that an attacker can read live memory from the PHP worker process to capture passwords, authentication tokens, API keys, and certificates belonging to other requests without prior code execution.⁶

According to CrowdStrike, an attack exploiting the flaws “leaves virtually no digital traces,” with worker processes returning HTTP 200 responses and leaving only an isolated memory-limit fatal error in web server logs.²

Following an advance disclosure leak on October 20, 2026, and early exploit attempts observed against Amazon honeypots dating back to October 17, 2026, the PHP team moved the release forward and shipped patches in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, at 13:30 UTC.²⁴⁶⁸ Government cybersecurity agencies, including CISA and the UK NCSC, issued alerts urging organizations to immediately patch exposed systems or disconnect them from the internet.²⁵

Confirmation ladder3

1. Attacker claimNot reached

   A threat actor says it did this. No independent confirmation.

2. Trusted source reportedOctober 21, 2026

   A credible third party reported it: a security vendor, a mainstream outlet, or a government or CERT advisory. The company has not acknowledged it.

3. Company acknowledgedOctober 20, 2026

   The affected company itself confirmed or acknowledged it, for example in a statement or a regulatory filing.

4. Follow-upOctober 21, 2026

   Coverage after the company acknowledged it: further statements, arrests, charges, fines or lawsuits. It never raises the verification.

Timeline7

1. October 17, 2026

   An unidentified threat actor attempts to exploit the unpatched vulnerabilities against an Amazon MadPot honeypot service from an Australian IP address.²

   What the attackers didTrusted source reported

2. Reported October 20, 2026

   The PHP security team posts an advance notice announcing an upcoming emergency out-of-cycle security release.⁸¹⁰

   Company or authority statementCompany acknowledged

3. October 20, 2026

   Leaked posts circulate details and CVE identifiers for two critical unpatched PHP remote code execution vulnerabilities scheduled for disclosure on Thursday.⁸

   What the attackers didTrusted source reported

4. October 21, 2026, at 2 a.m. UTC

   Amazon detects the earliest proof-of-concept exploit attempts across anonymized infrastructure.²

   What the attackers didTrusted source reported

5. October 21, 2026, at 8:36 a.m. UTC

   ELLIO sensors detect the first exploit requests less than an hour after Chainguard published built container images containing the fix.²

   What the attackers didTrusted source reported

6. October 21, 2026, at 13:30 UTC

   The PHP team releases patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 along with source backports for unsupported branches.⁴

   What the company didCompany acknowledged

7. Reported October 21, 2026

   CISA publishes an alert urging organizations to inventory and immediately patch vulnerable PHP installations or take them offline.⁵

   Company or authority statementFollow-up

Attack analysis

Attack vector

Sending an unauthenticated HTTP request triggering memory corruption during request parsing

An unauthenticated remote attacker can trigger the vulnerabilities against exposed PHP endpoints before any application-level code executes, exploiting memory management or error handling in the runtime.²⁴⁶

Attack model

Pre-authentication remote code execution and process memory extraction

Attackers can achieve remote code execution across web servers running PHP or read sensitive data directly from live worker memory without authentication.²⁴⁶

Data exposed

Process worker memory including passwords, session tokens, API keys, and certificates

Researchers demonstrated that an attacker can read live memory from the PHP worker process holding credentials and tokens from concurrent or prior requests.⁶

Scale

All web servers running unpatched PHP 7.x and 8.x, powering an estimated 70% of websites

Cloudflare noted that PHP is used by almost 70% of websites, and internet scans identified hundreds of thousands of publicly accessible servers running legacy or unsupported versions.²⁸

Dwell time

At least 4 days of pre-disclosure zero-day targeting

Amazon detected exploit targeting against its honeypot infrastructure on October 17, 2026, four days before coordinated public disclosure on October 21, 2026.²

Techniques Attacker behaviour described in the articles, mapped to MITRE ATT&CK

• Exploit Public-Facing ApplicationATT&CK IDT1190TacticInitial AccessMapped fromExploiting unauthenticated vulnerabilities in public-facing PHP web server endpoints²⁴⁶
• Command and Scripting InterpreterATT&CK IDT1059TacticExecutionMapped fromUnexpectedly launching command shells or downloading files from PHP worker processes²⁵
• Data from Local SystemATT&CK IDT1005TacticCollectionMapped fromReading passwords, authentication tokens, and API keys directly from PHP worker memory⁶
• ProxyATT&CK IDT1090TacticCommand and ControlMapped fromRouting exploit traffic through commercial anonymization networks and proxies²

Technologies

• PHP
• PHP 7.x
• PHP 8.x
• PHP 8.2
• PHP 8.3
• PHP 8.4
• PHP 8.5
• Apache mod_php
• PHP-FPM
• php-cgi
• FrankenPHP
• LiteSpeed

Vulnerabilities

• CVE-2026-109618Exploited in attacks
  CVSS score9.8 NVD9.2 PHP security teamNVD record

  Memory corruption during out-of-memory error handling via longjmp() enabling pre-authentication remote code execution.^1245689

  AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches

• CVE-2026-109619Exploited in attacks
  CVSS score8.1 NVD9.2 PHP security teamNVD record

  Stale global state referencing freed request memory enabling pre-authentication remote code execution.^1245689

  AffectedPHP 8.5 prior to 8.5.12, 8.4 prior to 8.4.27, 8.3 prior to 8.3.36, 8.2 prior to 8.2.35, and unsupported 7.x and 8.1 branches

Indicators Addresses linked to the attackers. Values are defanged and not linked.

• IP address103.216.220[.]92Anonymized IP address geolocated to Australia used in pre-disclosure honeypot exploit attempt on October 17, 2026²
• IP address31.223.184[.]166IP address observed launching exploit attempts against honeypots on October 21, 2026²
• IP address37.19.200[.]5IP address observed launching exploit attempts against honeypots on October 21, 2026²
• IP address134.209.159[.]64IP address observed launching exploit attempts against honeypots on October 21, 2026²
• IP address103.114.163[.]188IP address observed launching exploit attempts against honeypots on October 21, 2026²
• IP address95.217.98[.]37IP address observed launching exploit attempts against honeypots on October 21, 2026²

Blast radius

Other companies in the coverage6

• A
  AmazonReporter or researcher

  Amazon’s Threat Intelligence team reported detecting pre-disclosure exploit attempts against its MadPot honeypot service.²

• C
  CloudflareReporter or researcher

  Cloudflare observed early exploit attempts and deployed emergency WAF rules to protect customer sites.²⁶⁷⁹

• O
  OpenAIReporter or researcher

  OpenAI co-discovered the vulnerabilities and released a Codex detection skill for defenders.²⁶⁹

• C
  ChainguardMentioned only

  Chainguard published fixed container images prior to the scheduled disclosure time.²

• C
  CrowdStrikeReporter or researcher

  CrowdStrike provided technical telemetry analysis demonstrating that attacks leave virtually no server logs.²

• C
  Cybersecurity and Infrastructure Security AgencyReporter or researcher

  CISA issued an emergency alert advising organizations to immediately apply PHP security patches.²⁵

Sources10

1. 1
   php2shell: CVE-2026-109618 / CVE-2026-109619 ResearchGitHub (ikow) · October 21, 2026

   Seed research repository referencing the CVE identifiers and PoC research.

2. 2
   Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · October 22, 2026

   Details honeypot exploitation attempts four days prior to disclosure and technical telemetry characteristics.

3. 3
   ‘PHP2Shell’ Bugs Signal Red Alert for Security IndustryDark Reading · October 21, 2026

   Covers security industry reaction to leaked details and active exploit attempts.

4. 4
   2026-018: Critical Vulnerabilities in PHPCERT-EU · October 21, 2026

   CERT-EU technical security advisory detailing the flaw mechanics, affected versions, and temporary mitigations.

5. 5
   Critical Vulnerabilities in PHP Require Immediate PatchingCISA News & Events · October 21, 2026

   CISA alert urging immediate inventorying and patching of vulnerable PHP installations.

6. 6
   PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · October 21, 2026

   Comprehensive reporting on the emergency release, technical differences across runtimes, and worker memory leakage.

7. 7
   PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’tThe Hacker News · October 21, 2026

   Analysis of proposed configuration workarounds and defensive limitations prior to patching.

8. 8
   PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · October 21, 2026

   Early reporting on the embargo leak, initial CVSS ratings, and advance security notice.

9. 9
   Cloudflare deploys protections against php2shell vulnerabilityCloudflare Blog · October 21, 2026

   Cloudflare blog post detailing coordinated disclosure and WAF protection deployment.

10. 10
    Upcoming Critical PHP Security ReleasePHP · October 20, 2026

    Official advance notice published by the PHP project.