Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP2Shell probed before patches as UK services go offline

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers probed critical PHP remote-code bugs four days before October 21 patches; broad attempts continue, with real compromises unconfirmed.

Amazon’s MadPot honeypot logged a PHP2Shell attempt on October 17, four days before disclosure of CVE-2026-109618 and CVE-2026-109619. Both score CVSS 9.2 and can allow unauthenticated remote code execution in PHP itself; PHP says CVE-2026-109619 also discloses memory. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while Infosecurity Magazine says PHP 8.1 and earlier get no official patches. Amazon and Cloudflare report broad attempts after the October 21 fixes, but success on real systems is unconfirmed. The Register reports 32 UK government services unavailable and four partly down after precautionary work, with no confirmed public-sector compromise.

Key facts
  • Earliest MadPot attempt came from 103.216.220.92 on October 17.
  • Embargo lifted at 1400 UTC on October 21; PoCs appeared about 0200 UTC.
  • Calif and Wiz independently found the bugs during private coordination.
  • Cloudflare saw attempts rise from thousands to millions after disclosure.
  • No configuration-only workaround fully addresses both CVEs.
  • WatchTowr says sprayed proof-of-concept code does not achieve RCE.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026MadPot records the first PHP2Shell exploit attempt. · GBHackers
  2. Oct 20, 2026Vulnerability details leak before planned disclosure. · Infosecurity Magazine
  3. Oct 21, 2026ELLIO sees its first request at 08:36 UTC. · The Hacker News
  4. Oct 21, 2026PHP patches ship as the embargo lifts at 1400 UTC. · Hacker News
  5. Oct 21, 2026Censys counts about 1.57 million unpatched hosts. · SecurityWeek

What each outlet adds

beyond the shared facts
  • The RegisterReports UK outages and Chainguard’s pre-embargo patched builds.
  • Latent SpaceAttributes discovery to Calif and Wiz using AI tools.
  • Infosecurity MagazineSays PHP 8.1 and earlier receive no official fixes.
  • SecurityWeekAdds Censys exposure figures and WatchTowr’s ineffective-PoC assessment.
  • The Hacker NewsGives ELLIO’s first-hit time and VulnCheck’s host count.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPAmazonCloudflareOpenAIPHP Foundation
Products
MadPotPHPWordPressDrupalJoomla
Victims
UK governmentOffice for Budget Responsibility
Organizations
Amazon Web ServicesWizCalifOpenAIPHP FoundationDutch National Cyber Security CentreUniversity of ViennaBeelzebubEllioRecorded FutureAmazonCISA
Countries
FranceNetherlandsAustriaUnited StatesUnited KingdomAustraliaGermanyBelgiumFinland
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Exploit-DBFirst report

    Exploit-DB lists PHP2Shell RCE for PHP after v5.4

    The listing covers remote code execution in PHP core versions after v5.4 as CVE-2026-109618.

  2. · 9d ago Okta Security

    Okta cloud unaffected by PHP2Shell; Access Gateway needs patch

    Okta is still investigating CVE-2026-109618 and CVE-2026-109619, with on-prem remediation unfinished.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV