PHP2Shell Exploitation: Two Critical PHP Flaws Explained

The Latest Update

Insikt Group has published a TTP Instance for PHP2Shell covering public proof-of-concept (PoC) exploits, observed exploit activity, and recommended mitigations. As of 7 PM UTC on October 21, 2026:

• Patch status: PHP released fixed versions on October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
• Exploitation status: While there are some reports of emerging exploitation attempts targeting PHP2Shell, the available reporting does not establish the full extent of successful exploitation or confirmed compromises (1, 2).
• PoC status: Publicly available repositories claim to provide PHP2Shell proof-of-concept (PoC) exploits, although their effectiveness and relationship to the confirmed vulnerabilities vary. For example, security researcher J4ck3LSyN published two alleged PoCs but subsequently invalidated the cached-pointer UAF theory underlying their proposed exploitation sequences.

How It Started

On October 20, 2026, the PHP security team announced an out-of-band security release for October 21 at 14:00 UTC to fix two critical vulnerabilities, both rated 9.2 under CVSS v4.0. PHP initially withheld technical details and affected versions pending coordinated disclosure, warning that the release could be accelerated if vulnerability details leaked or exploitation emerged.

Ahead of the scheduled release, watchTowr reported reproducing CVE-2026-109618 and assessed that both vulnerabilities could enable remote code execution (RCE). Technical information subsequently leaked before coordinated disclosure, prompting heightened concern about potential exploitation. PHP shipped the fixes on October 21, alongside a PHP Foundation post about the release, which addressed the emergency release and improvements to PHP's security processes.

The “PHP2Shell” name comes from Wiz Research, which found the flaws with Calif and OpenAI and reported them to PHP in August. Wiz’s write-up covers the discovery and root cause in depth.

The Vulnerabilities

Both CVEs are memory-safety vulnerabilities involving PHP's handling of request memory during initialization, error handling, and cleanup. According to Wiz, out-of-memory (OOM) failures and stale internal state can expose freed or partially initialized memory, potentially enabling memory disclosure, memory corruption, and remote code execution (RCE).

• CVE-2026-109618: An OOM-related vulnerability involving partially initialized request memory. Wiz identified a use-after-free (UAF) in the session upload-progress unserializer and a related flaw that can disclose PHP worker memory. Wiz demonstrated unauthenticated RCE against WordPress, Drupal, and Joomla.
• CVE-2026-109619: A stale-state vulnerability involving PHP globals that retain references to freed request memory. Wiz identified a UAF involving fatal-error backtraces and a separate OPcache type-confusion flaw. Wiz demonstrated unauthenticated RCE against Drupal and WordPress.

The vulnerabilities affect PHP itself rather than a particular website application. Some exploitation paths involve PHP's session upload-progress functionality, which VirusTotal notes has existed since PHP 5.4.0 and is enabled by default. Because exploitation depends on the PHP runtime, server configuration, and reachable execution paths, even websites with secure application code may be vulnerable.

PHP identified the following affected and patched versions. Older, unsupported PHP branches are not covered by these release-specific fixes and should not be presumed unaffected.

Reports of Active Exploitation

Following the disclosure of the PHP2Shell vulnerabilities, multiple sources reported exploitation activity in the wild:

• Patchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on October 21, ahead of PHP's security release.
• Cloudflare CTO Dane Knecht reported observing early attacks targeting the vulnerabilities. Cloudflare subsequently deployed web application firewall (WAF) protections against known exploit vectors.

Although these reports indicate early exploitation activity, publicly available evidence remains insufficient to establish the extent of successful compromise or characterize the techniques used in observed attacks.

Public Proof-of-Concept Exploits

Numerous public GitHub repositories have emerged around PHP2Shell, including projects advertising proof-of-concept (PoC) exploits, vulnerability-testing tools, and defensive resources. Several claim to target CVE-2026-109618 and CVE-2026-109619 through memory-corruption techniques intended to crash vulnerable servers or achieve remote code execution (RCE). However, some rely on invalidated exploitation theories, and the existence of publicly available code does not establish that it successfully exploits either vulnerability.

Insikt Group's TTP Instance examines two PoC scripts published by security researcher J4ck3LSyN:

• poc0_109618.py: Originally intended to exploit CVE-2026-109618 through PHP's session upload-progress functionality, using a proposed memory-corruption technique to execute commands on a vulnerable server.
• poc1_109619.py: Originally intended to exploit CVE-2026-109619 through a related technique involving successive chunks of an uploaded file, similarly attempting to achieve remote code execution.

J4ck3LSyN subsequently invalidated the cached-pointer vulnerability theory underlying these proposed exploitation techniques but separately reported reproducing another memory-safety issue without demonstrating RCE.

Other publicly available repositories advertise PHP2Shell exploits, vulnerability-testing scripts, and demonstration environments. Some continue to describe the invalidated cached-pointer technique, while others claim to use different exploitation methods. At the time of this publication, Insikt Group has not independently tested J4ck3LSyN’s PoCs or other publicly available PoCs for accuracy or effectiveness.

Scale and Exposure

Two independent internet scans show how much PHP is exposed, but they count differently. Modat counts PHP services that report a readable version and were seen in the 10 days before October 20. VirusTotal counts IP addresses as of October 21, including PHP servers it identifies through signals other than a version string, such as the application, session cookies, and framework headers.

• Modat: 4,384,302 PHP services on 1,886,612 unique hosts. About 79% of services with a readable version run a branch PHP no longer supports, and PHP 7.4, end of life since 2022, accounts for 878,761 services, more than any supported branch.
• VirusTotal: About 5.1 million IP addresses running PHP, of which only about 1.1 million disclose a version, so roughly four in five hide it. Among those that disclose their version, about 758,000 run an end-of-life branch from 5.4 to 8.1, compared with about 272,000 on a supported branch, and PHP 7.4 alone accounts for about 187,000.

Neither scan counts confirmed vulnerable hosts, but both point the same way: most exposed PHP runs on end-of-life branches that will not receive an official fix. Scans that rely on version strings miss most of the exposed surface, and running the latest release was no protection: VirusTotal counted about 85,000 IP addresses on the September 24 releases, the newest available before the fix.

Why This Matters

• Millions of servers could be exposed: VirusTotal identified approximately 5.1 million IP addresses running PHP, highlighting the potentially widespread reach of these vulnerabilities.
• Even secure PHP applications are at risk: The flaws can allow unauthenticated remote code execution in PHP itself, even when the application running on top of it has no vulnerabilities.
• Secrets can leak without code execution: Wiz showed that the memory disclosure flaw can expose passwords, authentication tokens, API keys, and certificates from other requests.
• The patch window collapsed: Details leaked hours before the release, and security researchers reported exploitation attempts before fixed versions were available (1, 2).
• Many servers run outdated PHP versions: VirusTotal found that most PHP servers disclosing their versions were running end-of-life branches that no longer receive regular upstream security updates.
• Compromise can spread past the web server: VirusTotal found about 394,000 PHP hosts that also expose Secure Shell (SSH), about 233,000 that expose MySQL, and about 68,000 that expose remote desktop protocol (RDP).
• Logs may show little: Exploitation happens below the application layer, so application logs may record limited context.

Timeline of Events

The disclosure of the PHP2Shell vulnerabilities unfolded over several weeks, beginning with their discovery in August 2026 and culminating in an emergency security release on October 21, 2026. However, vulnerability details became publicly accessible ahead of the coordinated release, prompting defensive preparations and reports of exploitation activity before patches became available.

The following timeline outlines key developments associated with the discovery, coordinated disclosure, early exploitation reports, and Recorded Future's response.

• August 19, 2026: Wiz Research discovers the first PHP vulnerability using AI-assisted research tools.
• August 20, 2026: Wiz Research confirms unauthenticated remote code execution (RCE) against Drupal.
• August 21, 2026: Wiz Research confirms unauthenticated RCE against WordPress.
• August 24, 2026: Wiz Research privately reports the vulnerabilities to the PHP security team, initiating the coordinated disclosure process.
• September 21, 2026: The PHP security team acknowledges the vulnerability reports and begins developing coordinated fixes.
• October 20, 2026: PHP announces an emergency, out-of-band security release scheduled for October 21 to address two critical vulnerabilities.
• October 20, 2026: Insikt Group publishes an initial intelligence note highlighting the upcoming PHP security updates.
• October 20, 2026: Recorded Future develops Attack Surface Intelligence signatures to identify potential exposure to CVE-2026-109618 and CVE-2026-109619.
• October 21, 2026, 02:29 UTC: An archive containing leaked vulnerability information was first submitted to VirusTotal.
• October 21, 2026, 07:34 UTC: Patchstack reports receiving notifications of multiple active exploitation incidents from hosting partners, several hours before the scheduled security release.
• October 21, 2026, 13:52 UTC: PHP releases security updates addressing both vulnerabilities, ahead of the previously announced 14:00 UTC release time.
• October 21, 2026, 17:52 UTC: Insikt Group publishes a PHP2Shell tactics, techniques, and procedures (TTP) instance to support threat detection and analysis.

Notably, reports of exploitation activity emerged before the official security release, creating a brief period during which vulnerability information was circulating publicly while affected organizations lacked an official patch. As a result, PHP users may discover exploitation attempts that occurred prior to the official patch disclosure. Threat hunters should therefore extend their lookback period for exploitation attempts to before the vulnerability disclosures were published.

Recorded Future Independent Analysis

Recorded Future's Insikt Group analyzed the PHP2Shell vulnerabilities, publicly available proof-of-concept (PoC) exploits, reported exploitation activity, and defensive measures. The resulting TTP Instance provides defenders with technical context and actionable guidance to help assess exposure, prioritize remediation, and identify potential attacks.

• Public PoCs: Multiple publicly available GitHub repositories claim to provide PHP2Shell proof-of-concept (PoC) exploits targeting CVE-2026-109618 and CVE-2026-109619. These PoCs focus on exploiting PHP memory-safety flaws to achieve remote code execution, though their effectiveness varies, and some rely on exploitation techniques that were subsequently invalidated.
• Exploit activity: Security vendors have reported emerging exploitation attempts targeting PHP2Shell, although the extent of successful exploitation remains unclear, and confirmed indicators of compromise (IoCs) remain limited. Insikt Group’s TTP Instance includes potential warning signs that defenders can monitor, such as unusual web requests, PHP errors, and suspicious server activity.

What You Need to Do Now

Organizations operating PHP-based applications should prioritize patching vulnerable systems, assessing their exposure, and monitoring for potential exploitation. Given reports of exploitation activity ahead of the coordinated security release, organizations should also investigate whether affected systems may have been compromised before patches became available.

Insikt Group recommends the following measures to mitigate the risks associated with PHP2Shell:

• Prioritize Patching and Remediation: Upgrade affected PHP deployments to the appropriate patched versions, prioritizing internet-facing applications and critical infrastructure. Organizations running unsupported PHP versions should migrate to supported releases or obtain vendor-maintained security fixes. Ensure that remediation includes PHP components embedded in third-party applications, containers, and managed services.
• Identify Exposed Assets and Validate Remediation: Inventory PHP deployments across organizational environments and assess exposure based on internet accessibility, configuration, and business criticality. Recorded Future customers should leverage Attack Surface Intelligence to identify potentially vulnerable internet-facing assets and validate remediation efforts.
• Implement Compensating Security Controls: Where immediate patching is not feasible, restrict external access to vulnerable systems and implement applicable WAF protections, request filtering, and PHP configuration hardening. Ensure that origin servers cannot be accessed directly to bypass perimeter defenses. These measures may reduce exposure to certain exploitation techniques, but should not be considered substitutes for patching.
• Monitor for Exploitation and Investigate Potential Compromise: Review web server, application, and endpoint telemetry for anomalous HTTP requests, PHP process failures, unexpected command execution, and other indicators of malicious activity. Prioritize reviewing activity beginning October 20, 2026, and investigate potentially compromised systems. Where compromise is identified, initiate incident response procedures and rotate potentially exposed credentials.

Recorded Future customers can access the Insikt Group PHP2Shell TTP Instance, Validated Intelligence Event, and Vulnerability Intelligence Cards® for CVE-2026-109618 and CVE-2026-109619 in the Recorded Future Intelligence Operations Platform. Recorded Future will continue to monitor developments related to PHP2Shell and provide updated intelligence as additional information becomes available.