Security Advisory: PHP2Shell, Two Critical PHP Remote Code Execution Flaws
PHP: Hypertext Preprocessor (PHP) has two critical remote code execution (RCE) flaws, tracked as Common Vulnerabilities and Exposures (CVE) CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated 9.2 and reportedly exploitable by unauthenticated attackers. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older get no patch.
What Happened
Technical details and proof-of-concept exploit code were disclosed on October 20, prompting PHP to accelerate patch releases by one day to October 21. A leaked exploit demonstration and unverified exploit code are circulating in the wild, and Cloudflare and watchTowr have both reported early-stage exploitation attempts.
As of October 21, neither CVE had been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. The Federal Bureau of Investigation (FBI), the United Kingdom National Cyber Security Centre (UK NCSC), and the Computer Emergency Response Team for European Union institutions (CERT-EU) have issued urgent advisories recommending immediate patching. Organizations unable to patch promptly are advised to take affected systems offline until remediation is complete.
|
CVE |
Issue |
|
CVE-2026-109618 |
Out-of-memory handling leaves request data half-built, and cleanup trusts it |
|
CVE-2026-109619 |
Use-after-free, where a later request on the same worker reuses freed request data |
Why It Matters
- PHP runs WordPress, Drupal, Joomla, portals, control panels, and vendor appliances, so you may run it without knowing, even if you write no PHP
- A compromised web server can expose credentials and lead toward systems that hold Controlled Unclassified Information (CUI).
- About 884,000 internet-facing hosts ran PHP 8.1 or older on October 20, so many have no fix
- Remediation and incident response requirements still apply under National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 requirements 3.14.1, 3.11.2, 3.6.1, and 3.6.2
- Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 requires reporting to the Department of Defense (DoD) within 72 hours of discovering an incident affecting covered defense information.
Still Unknown
- Affected versions: Researchers say PHP 5 onward, which is unconfirmed
- Exploit conditions: Unclear, so PHP says update
- Indicators of compromise: None published
What You Can Do Now
Inventory PHP everywhere
- Include content management system (CMS) platforms, control panels, containers, and vendor appliances
Patch internet-facing systems first
- Confirm fixed or backported builds with your vendor or host, then restart PHP
Isolate what you cannot patch
- For PHP 8.1 and older, upgrade, go offline, or use a virtual private network (VPN)
- Web application firewall (WAF) rules are a stopgap
Hunt back to October 17, even if patched
- Look for PHP or web server processes launching shells or download tools
- Look for new web shells, scheduled tasks, and accounts
If you find something
- Isolate the server, preserve logs, and follow our CUI incident response guide
Keep records
- Document what you inventoried and patched, and when, for your Cybersecurity Maturity Model Certification (CMMC) assessor
If a vendor goes dark
- Get written answers on whether your tenant was hit by exploitation, access, exports, or changes
- Ask for the investigation window and the data involved
- Ask whether logs are preserved
- Ask whether you need password, session, or Application Programming Interface (API) key actions
Stay safe, stay secure.
-ISI Cybersecurity Team