Opens in a new window Opens an external website Opens an external website in a new window This website uses cookies to improve your viewing experience. To find out more about the cookies we use, see our Cookie Policy Manage Preferences Storage Preferences Summarize This Page ChatGPTClaudePerplexityGoogle AI Summarize This Page ChatGPTClaudePerplexityGoogle AI Deception is moving at machine speed.…
PHP has various global state that temporarily points into request memory
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
Shortly after the leak, PHP released an advisory saying an upcoming security release was scheduled that would address the two vulnerabilities. The PHP security team ranks both flaws critical severity (with a CVSS v4.0 rating of 9.2). PHP said its emergency updates would occur Wednesday, October 21 at 10am ET (and that it may ship even earlier if technical details go public or exploitation starts).
Researchers at watchTowr confirmed the vulnerabilities are real and said they reproduced CVE-2026-109618. As of the publication of this blog on October 20, Huntress has not seen in-the-wild exploitation of these vulnerabilities in our partner environments.
The impacted and fixed versions are not yet confirmed. Reporting suggests PHP versions 5 through 8 may be affected, and that only currently supported branches will get a fix. That would leave end-of-life PHP versions exposed with no patch at all.
What you should do right now: inventory every PHP install you own (including the ones hiding inside vendor software), plan to patch the moment fixes drop, and isolate end-of-life PHP from the internet.
Acknowledgments:Special thanks to Lindsey Welch and Ben Nahorney for their contributions to this investigation and writeup.
Background
On the morning of October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were headed for public disclosure. The post was taken down, but not before screenshots made their way around social media. Within a few hours, our good friends over at watchTowr confirmed the leak, writing that the vulnerabilities were real and that "we were all supposed to wait until Thursday at 11am ET."
Shortly thereafter, the PHP security team posted an advance notice of an upcoming security release addressing two critical vulnerabilities, both with a CVSS v4.0 rating of 9.2. The team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargo, and noted it reserves the right to release even sooner "should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."
PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood. When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.
Huntress is monitoring developments related to these vulnerabilities and will update this blog as new information becomes available.
What are CVE-2026-109618 and CVE-2026-109619?
The flaws exist in PHP, the popular programming language running behind a huge number of websites. PHP is designed primarily for web development and is widely supported by hosting providers.
Here's what we know about the PHP vulnerabilities so far (and what we don't):
What we know: Both vulnerabilities are rated critical by the PHP security team. Public reporting describes them as remote code execution in PHP's core, which would mean an attacker could get the server to run commands of their choosing.
What it affects: PHP has not published affected versions yet. Reports have pointed to versions 5, 6, 7, and 8 being impacted, and some researchers have said they expect fixes only for currently supported PHP 8 branches. In its official release, however, PHP said that impacted and fixed versions (along with full details of the flaws) will be published with the October 21 security release.
How it works: No technical root cause has been published. We currently don't yet know which part of PHP is involved, whether it's reachable over a plain web request, or whether it depends on a particular configuration. We'll update this post when the advisory and researcher writeups are public.
Why "php2shell"? That's the name circulating among researchers. If you've followed this space for any amount of time, you know a name like that usually means one thing: someone sends a request to your website, and gets a shell on your vulnerable server.
Technical Details
With no public technical details yet, we can't show you the exploit. What we can do is tell you what we're looking for and what our own telemetry says about where the risk lives.
What exploitation will probably look like
Florian Roth, who released a free tool called process-watcher (a Linux-based process monitoring tool aimed at detecting exploitation) put it well: exploitation of these bugs will most likely show up as suspicious child processes spawned by PHP. At Huntress, that lines up with what we see in nearly every PHP intrusion we work.
In practice, that means a PHP worker process like php-fpm, php-cgi, php-cgi.exe, httpd, or apache2 would launch something abnormal:
Shells like sh, bash, cmd.exe, or powershell.exe
Interpreters like python or perl
Download or networking tools like curl, wget, nc, or certutil.exe
It's worth taking a closer look at command lines that include reverse shell patterns:
/dev/tcp/
fsockopen
mkfifo
It's also worth looking at quick reconnaissance commands like whoami, id, uname -a, or ipconfig run straight from the web server.
Attacker PHP abuse: what we've seen recently
Even before this leak, Huntress regularly catches attackers abusing PHP applications.
One pattern from a recent Huntress incident that occurred last week is a good preview of what php2shell exploitation could look like. In this incident, a PHP FastCGI process repeatedly ran a one-liner that wrote a small PHP file with random marker strings into the first writable temp directory it could find, before executing and then deleting it. If none of the directories were writable, it would print !notwrtbl! to flag that.
While this pattern isn't related to php2shell, it's a good example of PHP spawning things it shouldn't.
On the Linux side, most internet-facing PHP lives on web servers and shared hosting, which are not closely monitored. An exposed Linux web server without endpoint detection is the type of system where PHP flaws can be exploited quietly and remain unnoticed.
Proof of Concept
We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing. A short exploitation video was briefly posted online and then removed. Once fixes are shipped, we expect technical details and proof-of-concept code to follow quickly, and we'll update this post.
What should impacted organizations do?
The fixes aren't out yet, so the goal right now is to be ready to patch the minute they land. In the meantime, there are several things you can do to shrink your exposure.
Inventory every PHP install. Start with your web servers, and then go hunting for the less obvious locations: vendor appliances and Windows software that bundle php.exe or php-cgi.exe, control panels like cPanel and Plesk, and anything running WordPress, Drupal, Joomla, or Magento.
Plan your patch window for Wednesday, October 21 at 10am ET. Patch internet-facing systems first. Watch the official PHP announcement for the fixed version numbers, and check your Linux distribution and hosting provider for backported packages.
Identify any end-of-life PHP environments. If you're running PHP 5, 7, or 8.0/8.1, you may not get a fix at all. Upgrade, take it off the internet, or put it behind a VPN or web application firewall (WAF) until you can.
Keep an eye on what PHP spawns. Alert on PHP worker processes launching shells, interpreters, or download tools. On Linux servers without endpoint detection, Florian Roth's process-watcher is a free, quick way to get this visibility today. Start it in observe mode.
If you find something, isolate the server, and preserve web server and PHP logs. Look for webshells and new files in your web root, along with new cron jobs, scheduled tasks, and accounts.
What is Huntress doing?
Hunting across our fleet. We captured a baseline of normal PHP behavior across our partner endpoints before the release. Once fixes and technical details drop, we'll compare against it to spot new activity quickly.
Detections are already in place. Huntress already detects web server processes spawning shells and common webshell activity on Windows and Linux. Our SOC is on alert for PHP-related activity.
Watching the patch drop. Our Adversary Tactics team is tracking the release and researcher analysis in real time, and we'll update this post with indicators and detection guidance as they become available.
Our platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security Operations Center (SOC).
Breaking Down Ransomware Attacks and How to Stay Ahead
No endpoint is immune. Ransomware is hitting businesses of every size, and double extortion has become the default. Here's how to break down what these attacks actually look like to stay ahead. Read the Blog
OpenClaw AI agents pose a security risk in Microsoft tenants because they're often granted broad, high-impact cloud permissions that an attacker could immediately inherit if the agent is compromised. Learn why proactive application hygiene, which includes continuous monitoring and trimming unnecessary permissions, is essential for managing this identity-based threat. Read the Blog
EDR Evasion: How Threat Actors Bypass Endpoint Security
Learn how threat actors evade endpoint visibility, hide execution, and abuse legitimate tools, and how Huntress Managed EDR helps you investigate and respond. Learn More
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates. Read the Blog
Learn about the Advanced Encryption Standard (AES), a top-tier encryption protocol trusted for safeguarding sensitive data. Explore its history, functionality, features, and practical applications. Learn More
CMMC isn't just another compliance checkbox — it's a market shift that will sort MSPs into winners and losers. If the EMR mandate taught you anything, it's that early movers win. Read the Blog
Operational Resilience: Turning Your Incident Response Plan Into Muscle Memory
An incident response plan only works if it's tested. Learn the 5 pillars of operational resilience and how to turn your plan into muscle memory before an attack hits. Read the Blog
Learn what Software as a Service (SaaS) is, how it works, and key cybersecurity considerations for secure SaaS implementation in your organization. Learn More
Breaking Down Ransomware Attacks and How to Stay Ahead
No endpoint is immune. Ransomware is hitting businesses of every size, and double extortion has become the default. Here's how to break down what these attacks actually look like to stay ahead. Read the Blog
OpenClaw AI agents pose a security risk in Microsoft tenants because they're often granted broad, high-impact cloud permissions that an attacker could immediately inherit if the agent is compromised. Learn why proactive application hygiene, which includes continuous monitoring and trimming unnecessary permissions, is essential for managing this identity-based threat. Read the Blog
EDR Evasion: How Threat Actors Bypass Endpoint Security
Learn how threat actors evade endpoint visibility, hide execution, and abuse legitimate tools, and how Huntress Managed EDR helps you investigate and respond. Learn More
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates. Read the Blog
Learn about the Advanced Encryption Standard (AES), a top-tier encryption protocol trusted for safeguarding sensitive data. Explore its history, functionality, features, and practical applications. Learn More
CMMC isn't just another compliance checkbox — it's a market shift that will sort MSPs into winners and losers. If the EMR mandate taught you anything, it's that early movers win. Read the Blog
Operational Resilience: Turning Your Incident Response Plan Into Muscle Memory
An incident response plan only works if it's tested. Learn the 5 pillars of operational resilience and how to turn your plan into muscle memory before an attack hits. Read the Blog
Learn what Software as a Service (SaaS) is, how it works, and key cybersecurity considerations for secure SaaS implementation in your organization. Learn More
Breaking Down Ransomware Attacks and How to Stay Ahead
No endpoint is immune. Ransomware is hitting businesses of every size, and double extortion has become the default. Here's how to break down what these attacks actually look like to stay ahead. Read the Blog
OpenClaw AI agents pose a security risk in Microsoft tenants because they're often granted broad, high-impact cloud permissions that an attacker could immediately inherit if the agent is compromised. Learn why proactive application hygiene, which includes continuous monitoring and trimming unnecessary permissions, is essential for managing this identity-based threat. Read the Blog
Summarize This Page
ChatGPT
Claude
Perplexity
Google AI
Huntress Platform One managed platform across endpoint integrity, identity resilience, and operational readiness.
Athena Engine The agentic AI that investigates every alert alongside our SOC analysts.
Managed EDR Get full endpoint visibility, detection, and response.
Managed ITDR Protect your Microsoft 365 and Google Workspace identities and email environments.
Managed SIEM Managed threat response and robust compliance support at a predictable price.
Managed SAT Empower your teams with science-backed security awareness training.
Managed ISPM Continuous Microsoft 365 and identity hardening, managed and enforced by Huntress experts.
Managed ESPM Proactively secure endpoints against attacks.
API and Integrations
Support Documentation
Phishing
Business Email Compromise
Ransomware
Infostealers
Living off the Land
Initial Access & RaaS
The Product Lab Shape the next big thing in cybersecurity together.
Fireside Chat Real people. Real perspectives. Better conversations.
Tradecraft Tuesday No products, no pitches – just tradecraft.
_declassified Exposing hidden truths in the world of cybersecurity.
The Huntress SOC 24/7 Security Operations Center
Reviews Why businesses of all sizes trust Huntress to defend their assets
Case Studies Learn directly from our partners how Huntress has helped them
Community Get in touch with the Huntress Community team
MSPs Join our partner community to deliver expert-led managed security.
Resellers Partner program designed to grow your cybersecurity business.
Tech Alliances Driving innovation through global technology Partnerships
Microsoft Partnership A Level-Up for Your Business Security
Our Story We're on a mission to shatter the barriers to enterprise-level security.
Newsroom Explore press releases, news articles, media interviews and more.
Meet the Team Founded by former NSA Cyber Operators. Backed by security researchers.
Careers Ready to shake up the cybersecurity world? Join the hunt.
John Hammond
#### Hot Takes and Cyber Predictions for 2022 What cybersecurity trends will we see in this new year? In this blog, we share some hot takes and predictions for 2022. Learn More
#### Huntress Threat Advisory: Widespread SonicWall SSLVPN Compromise Huntress has observed a spike in compromises of SonicWall SSLVPN devices across multiple customer environments. Learn More
#### AI Signal Triage: How Huntress Cuts Noise Before It Hits the Analyst Learn how Huntress' AI signal triage and AI-powered SOC triage cut noise before it reaches human analysts. And discover why that matters for response times. Learn More
#### Abusing Trusted Applications with Nested Execution Recently, my co-founders gave a talk at DerbyCon 7.0 on evading common persistence enumeration tools. Evasion using trusted applications has been a hot topic of discussion within the infosec community and is one of the techniques they covered in their presentation. However, very little discussion exists on why these matter or the steps researchers take to find “hosting” applications. Learn More
#### From Overhyped to OH $#!T: Traversing the Tragic Quadrant with Doris Doris searched for ChatGPT and ended up in a BEC scam. See how ClickFix, a stolen session cookie, and a hidden inbox rule chain into an OH $#!T moment. Learn More
#### Critical Vulnerabilities: WS_FTP Exploitation Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild. Learn More
#### Brute Force or Something More? Ransomware Initial Access Brokers Exposed Discover how a seemingly simple brute force attack led to the uncovering of a suspected ransomware-as-a-service operation. This ecosystem appears to be leveraged by initial access brokers, driving an illicit and complex network of cybercrime. Learn More
#### Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest Go inside Huntress and the FBI’s five-year pursuit of Silk Typhoon, from 88,000 Exchange backdoors to an arrest and a wider fight against cybercrime. Learn More
Blog Post
Blog Post
Blog Post
Cybersecurity 101
Blog Post
Cybersecurity 101
Blog Post
Blog Post
Cybersecurity 101
Platform
Awards
Contact Us
Akamai Blog