Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

PHP2Shell flaws allow unauthenticated RCE; wild attacks reported

Original title: PHP2Shell: No login, no app code, no warning. What next?

The Register · Securityby Tanium ()7 min read1
Read at theregister.com
Part of a story covered by 21 sourcesCISA lists exploited PHP2Shell flaws; agencies must patch by Oct. 29Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.

PHP patched two core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, after details leaked before an embargo. An unauthenticated attacker who can reach a PHP endpoint over HTTP can run code; every earlier release is affected. watchTowr says it saw exploitation in honeypots on October 21, and Tenable relays Cloudflare’s CTO reporting early attacks. Neither CVE is in CISA’s KEV catalog, and reliable public exploits remain scarce.

Unconfirmed: watchTowr and a relayed Cloudflare statement report early attacks, while Patchstack mostly sees probing and no public IoCs exist.

Key facts
  • CVE-2026-109618 is multipart-parser memory corruption, with RCE validated on mod_php.
  • CVE-2026-109619 is a use-after-free after a fatal error, affecting mod_php and PHP-FPM.
  • VulnCheck says code execution works on ARM64 and on x86 with ASLR off.
  • PHP published source backports for 7.4, 8.0 and 8.1 but no official releases.
  • Tanium says its software and cloud services do not use PHP.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated remote code execution via a crafted web request

ProductAffectedFixed in
PHPEvery release before 8.5.12, 8.4.27, 8.3.36 and 8.2.358.5.12, 8.4.27, 8.3.36, 8.2.35
What to do
  1. 1.Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  2. 2.Treat 7.4, 8.0 and 8.1 source backports as a stopgap and plan an upgrade.
  3. 3.Review web server and PHP-FPM logs for worker crashes and unusual multipart requests.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phpphp2shellremote-code-executionmod-phpphp-fpm
Vendors
PHP
Products
PHP-FPMmod_php
Organizations
watchTowrCISATenableCloudflareVulnCheckRed HatTaniumCERT-EUPatchstack

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV

From the original article

7 min read at theregister.com

PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium

The Register · Security

By Tanium · theregister.com

Read the full article at The Register · Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.