PHP2Shell flaws are now exploited in the wild, so update PHP now
Attackers used one of the PHP2Shell flaws to run commands on unpatched PHP servers set up as decoys, a security researcher reported on Saturday, October 24. The fix has been out since October 21, and any site that hasn't installed it is exposed to attacks that need no login.
Update, October 26, 2026: CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog on October 26, confirming they are being used in attacks. US federal civilian agencies must address them by Thursday, October 29.
What PHP2Shell is
PHP2Shell is the nickname for two vulnerabilities in PHP. CVE-2026-109618 lets out-of-memory errors corrupt PHP's internal request data. CVE-2026-109619 leaves internal state pointing at memory that a later request can reuse after that memory has been freed. Both can lead to remote code execution, and PHP rates them 9.2 out of 10 on the CVSS v4.0 scale.
The PHP team says the risk is highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any of the site's own code runs. CISA says every PHP installation that serves web requests is affected, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Attacks went from probes to working shells
When PHP released the patches, CISA had not flagged the flaws as exploited. CJ Moses, CISO of Amazon Integrated Security, wrote the same day that Amazon's honeypots had logged a PHP2Shell exploitation attempt dating to October 17, four days before the patches, and that the flaws were seeing "broad exploitation attempts in the wild." He added that it was unclear whether any of those attempts would have worked on real systems.
That changed on October 24. Adel Karimi, detection and response lead at Perplexity, published honeypot data showing 35 confirmed remote code execution events, each one an Apache worker launching a shell. The targets ran PHP 8.4.26 with mod_php. The attackers tried to contact their own servers and collect the server's username and host name. Expel threat researcher Marcus Hutchins called the data "by far the highest quality confirmation" of in-the-wild exploitation he had seen.
Karimi notes that the honeypots were set up to favor the exploit, so the data doesn't show how reliably it works on other configurations.
On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, the list of flaws it has evidence attackers are using. Under CISA's directive for US federal civilian agencies, those agencies have until October 29 to fix both flaws. CISA also marked them for forensic triage, so agencies must check affected servers for signs of compromise as well as patch them.
The fixed versions
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says updating is the only complete fix. The configuration changes it lists for servers that can't update right away only reduce the risk.
PHP 8.1 and older no longer get official updates, though the PHP team published minimal fixes for 7.4, 8.0 and 8.1. CISA advises taking servers that run those versions offline until they're upgraded. PHP 8.2 reaches end of life on December 31, 2026.
PHP has issued two smaller follow-ups since the October 21 release. On October 23, PHP advised setting session.upload_progress.enabled=0 to block an unlikely remote code execution path, CVE-2026-115560, that needs an unusual combination of settings and code. A full advisory will come with the next release. On October 26, PHP shipped rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) with Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression.
What it means for you
PHP2Shell affects PHP installations that serve web requests, not ordinary PCs and phones. The people who need to act are site owners, small businesses and IT teams.
If you run your own server, check the PHP version and update to one of the patched releases, starting with anything that faces the internet. CISA also suggests watching for PHP worker processes that start shells or download tools, and it has published a detection rule for security teams.
If your site runs on shared or managed hosting, look up the PHP version in your hosting control panel or ask your host whether it has installed the October 21 patches. A site still on PHP 8.1 or older should move to a supported release.