Key points
- Exploitation attempts began on 17 October, before the 21 October patch release.
- Two critical flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution.
- Patches are now available for PHP versions released in the last decade.
Threat actors gained early access to exploit two critical remote code execution vulnerabilities in PHP before official fixes were available. Amazon reported detecting the first attempt on 17 October, four days before patches were released. This early activity suggests attackers had access to exploit information while the flaws were still under embargo.
In plain English
The vulnerabilities, collectively known as PHP2Shell, allow an attacker to run arbitrary code on a server without authentication. This could lead to full server takeover. The flaws affect any PHP version released in the last decade, including version 5.4. PHP powers approximately 69.7% of websites with known server-side languages, including many content management systems.
The background
Security researchers from Calif, Google Cloud’s Wiz, and OpenAI’s Patch the Planet discovered the bugs in August. The PHP Foundation planned to release patches on 21 October. However, a pseudonymous user leaked details on 20 October. This leak accelerated the circulation of proof-of-concept exploits. Multiple organisations took websites offline to prepare for patching.
What changes now
Patches for CVE-2026-109618 and CVE-2026-109619 were released on 21 October. Mass exploitation attempts began shortly after the fixes were published. Amazon noted that proof-of-concept exploits appeared within hours of the embargo lifting. WatchTowr observed broad exploitation attempts, though many circulating proofs of concept failed to achieve remote code execution.
The attacker's path
Teams usually monitor for unusual outbound connections or unexpected process creation following exploitation attempts. Check whether your web servers are accepting requests from anonymised networks, as early probes often originate from such infrastructure. Verify that your incident response plans include steps for isolating compromised hosts immediately. Ensure logging captures both successful and failed authentication attempts to identify brute-force or exploit spraying activity.
Background: Incident response plans
Effective incident response relies on pre-defined roles, offline communication channels, and validated data backups. You must test your plan regularly to ensure it functions under stress, rather than relying on theoretical procedures that ignore real-world chaos.
Read the full guide: Incident Response Plans: Best Practices for Resilient Recovery
What to do and how to stay safe: PHP
- Verify that all PHP versions on your infrastructure are updated to the patched releases.
- Monitor web server logs for indicators of exploitation attempts or unusual traffic patterns.
- Isolate any servers showing signs of compromise for forensic analysis.
- Once the vendor provides an update, test it in a staging environment before deployment.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When were the PHP2Shell patches released?
Patches were released on 21 October, following a leak of details on 20 October.
Which PHP versions are affected by these vulnerabilities?
The flaws affect any PHP version released in the last decade, including version 5.4.
Did early exploitation attempts succeed?
Multiple organisations observed unsuccessful exploitation attempts before and after the patch release.
