StoryExploit / PoCcriticalExploited in the wild

PHP patches PHP2Shell; scans continue without confirmed compromise

8 sources · 12 articlesFirst reported Oct 22, 2026 · 20:40 UTCUpdated Oct 24, 2026 · 22:27 UTC (21h ago)1

What's new

October 24: a community backport covers unsupported PHP 5.4–5.6. October 23: Red Hat says default RHEL 7 php-5.4.16 is vulnerable to CVE-2026-109619.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical RCE bugs on October 21; exploit attempts continue, but no successful compromise is confirmed.

PHP issued emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell and each scored CVSS 9.2. The unauthenticated remote-code-execution flaws affect PHP serving web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and have been present since PHP 5.4. Fixed upstream releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 7.4, 8.0, and 8.1 need distributor fixes or an upgrade. Sophos’s October 22 revision found scanning and a small number of failed attempts, not confirmed compromises, and blocked a Potassium payload described as a likely Mirai variant. Cloudflare reported attempts rising to millions by October 22, while Censys still counted over 34.4 million vulnerable services on October 23.

Key facts

Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
CVE-2026-109618 is an out-of-memory cleanup flaw; CVE-2026-109619 is a use-after-free.
Red Hat says default RHEL 7 php-5.4.16 is vulnerable to CVE-2026-109619.
Censys counted over 34.4 million vulnerable PHP services on October 23.
CISA had not added either CVE to KEV as of October 23.
Qualys says about 71% of observed instances run end-of-life PHP 5.4 through 8.1.

Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 17, 2026AWS reported an exploit attempt before public fixes. · CSO Online
Oct 21, 2026PHP released emergency fixes after the embargo moved early. · CSO Online
Oct 22, 2026Sophos revised telemetry to failed attempts, not compromises. · GBHackers
Oct 23, 2026Censys counted over 34.4 million vulnerable services. · Security Affairs
Oct 23, 2026Red Hat VEX data flagged default RHEL 7 php-5.4.16. · oss-security
Oct 24, 2026Community patch posted for PHP 5.4, 5.5, and 5.6. · oss-security

What each outlet adds

beyond the shared facts

CERT/CC Vulnerability NotesNames both bug types, reporters, and limited 7.4–8.1 backports.
CSO OnlineChainguard broke the embargo; AWS saw an October 17 attempt.
Security AffairsCensys exposure count and bugs present since PHP 5.4.
SecurityWeekUK outages, Qualys EOL share, and CISA KEV status.
oss-securityUnofficial EL and PHP 5.4–5.6 backports plus Red Hat correction.

CVEs: CVE-2026-109618 CVE-2026-109619

Vendors: PHP The PHP Foundation Red Hat
Products: PHP
Malware: Potassium Mirai
Organizations: Cloudflare Censys Sophos VulnCheck Arctic Wolf Cisco Talos Chainguard AWS Calif Hunt.io SOCRadar Qualys
Countries: United Kingdom Ukraine

Coverage

oldest first · one row per article · UTC

Oct 22, 20:40 UTC · 2d ago oss-securityFirst report
Unofficial PHP2Shell fix backported to EL6 and EL7 PHP 5
The EL7 package becomes php-5.4.16-48.el7.php2shell.1; those Enterprise Linux releases will not get a vendor update.
Oct 22, 22:23 UTC · 2d ago CERT/CC Vulnerability Notes
PHP before 8.2.35 and related releases allows remote code execution
Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.
Oct 23, 00:43 UTC · 2d ago CSO Online
PHP2Shell critical RCE bugs exploited as disclosure embargo collapsed
Cloudflare’s CEO said attempts reached millions after the October 21 release, which came 24 hours early.
Oct 23, 07:40 UTC · 2d ago The Hacker News
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
Oct 23, 09:41 UTC · 2d ago GBHackers
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
Oct 23, 10:52 UTC · 2d ago Security Affairs
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
Oct 23, 12:45 UTC · 2d ago SecurityWeek
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
Oct 23, 13:00 UTC · 2d ago Cyber Security News
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
Oct 23, 13:05 UTC · 2d ago oss-security
Red Hat says default RHEL 7 PHP 5.4.16 is vulnerable to CVE-2026-109619
An October 23 note says updated RHSB-2026-013 and VEX data reverse an earlier PHP 5 risk claim.
Oct 23, 13:08 UTC · 2d ago oss-security
PHP 8.2–8.5 stale-state RCE cited again (CVE-2026-109619)
The follow-up only links CrowdStrike's blog and gives no patch or attack details.
Oct 23, 13:10 UTC · 2d ago oss-security
PHP 8.2–8.5 OOM RCE cited again (CVE-2026-109618)
Christian Fischer's October 23 reply only links a CrowdStrike blog about PHP RCE zero-days.
Oct 24, 22:27 UTC · 21h ago oss-security
Unofficial patch targets PHP2Shell OOM in PHP 5.4–5.6
The community backport covers unsupported PHP 5.4, 5.5, and 5.6 for CVE-2026-109618 and CVE-2026-109619.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-109619 +1 related CVE CVE-2026-109618	Use-after-free RCE in PHP via stale request globals	9.2	100%	PoC ×13	4d ago