PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Original title: PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
Public proof-of-concept code targets two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, each scored CVSS v4.0 9.2. They can allow unauthenticated remote code execution with web server privileges and affect PHP itself, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sophos’s October 22 update says customer telemetry showed scanning and a small number of failed attempts, not confirmed compromises, and that a Potassium payload was blocked.
Unconfirmed: Sophos withdrew an earlier claim of successful exploitation; reported researcher successes may depend on lab conditions.
- CVE-2026-109618 is tied to out-of-memory handling; CVE-2026-109619 to stale request state and use-after-free.
- Fixes are not automatic; administrators need the upstream release or an equivalent vendor package.
- Blocked activity involved Potassium, described as a likely Mirai-derived botnet variant.
- Sophos linked 134.199.154.64 and 117.55.202.115 to Potassium command-and-control infrastructure.
- If patching must wait, Sophos suggests taking exposed apps offline or requiring network-layer authentication.
Impact: Unauthenticated remote code execution with web server privileges
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
- 1.Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or the equivalent vendor package.
- 2.Inventory bundled PHP runtimes in appliances and hosted services and confirm vendor fixes.
- 3.If patching is delayed, remove exposed apps from the internet or require network-layer authentication.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.0.0.1 | logic referencing public DNS services 8.8.8.8, 1.1.1.1, and 1.0.0.1. These legitimate resolvers are not malicious indicators th |
| ipv4 | 1.1.1.1 | ith fallback logic referencing public DNS services 8.8.8.8, 1.1.1.1, and 1.0.0.1. These legitimate resolvers are not malicious |
| ipv4 | 117.55.202.115 | stributed denial-of-service attacks. Sophos also associated 117[.]55[.]202[.]115 with Potassium command-and-control infrastructure. So |
| ipv4 | 134.199.154.64 | pted command-and-control address, opens a TCP connection to 134[.]199[.]154[.]64, and sends an HTTP request. Before accepting the retr |
| ipv4 | 8.8.8.8 | tnames, with fallback logic referencing public DNS services 8.8.8.8, 1.1.1.1, and 1.0.0.1. These legitimate resolvers are not m |
From the original article
2 min read at gbhackers.com
Public proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4. 0 scores of 9.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.