Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP2Shell patches follow pre-disclosure RCE attempts on PHP servers

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two critical PHP flaws, PHP2Shell, are patched on supported branches after exploitation attempts began October 17, with real-world success still unconfirmed.

Two unauthenticated remote-code-execution bugs in the PHP engine, CVE-2026-109618 and CVE-2026-109619, both scored CVSS v4.0 9.2 and nicknamed PHP2Shell, affect web servers running PHP. Calif, OpenAI and Wiz found them using AI models; at least one flaw reaches back to PHP 5.4, according to Wiz. Supported fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sucuri reports emergency source backports for 7.4, 8.0 and 8.1, while Dark Reading and Infosecurity Magazine say older branches have no official upstream patches. Amazon says a honeypot saw an attempt on October 17 and calls exploitation broad after the October 21 disclosure; whether attempts succeeded on real systems is not confirmed, and WatchTowr says sprayed proof-of-concept code does not achieve code execution.

Key facts
  • CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale worker state.
  • Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • Amazon recorded a MadPot attempt on October 17 from 103.216.220.92.
  • Chainguard published patched images at 07:41 UTC on October 21, before the coordinated release.
  • Censys counted about 1.57 million unpatched hosts on October 21; VulnCheck counted 2,608,039 PHP hosts.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Amazon MadPot honeypot records a PHP2Shell attempt · WIRED
  2. Oct 20, 2026Both issues leak before the planned disclosure · SecurityWeek
  3. Oct 21, 2026Chainguard publishes patched images at 07:41 UTC · The Register
  4. Oct 21, 2026ELLIO sees its first request at 8:36 UTC · The Hacker News
  5. Oct 21, 2026Embargo lifts at 1400 UTC and patches ship · Hacker News
  6. Oct 21, 2026Censys counts about 1.57 million unpatched hosts · SecurityWeek

What each outlet adds

beyond the shared facts
  • The RegisterPHP blames Chainguard for shipping fixes more than six hours early.
  • Sucuri BlogReports emergency source backports for PHP 7.4, 8.0 and 8.1.
  • The Hacker NewsNames the October 17 source IP and ELLIO’s first sighting.
  • SecurityWeekWatchTowr says sprayed PoCs do not achieve code execution.
  • Latent SpaceNames GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas in discovery.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPAmazonCloudflareOpenAIPHP Foundation
Products
MadPotPHPWordPressDrupalJoomla
Malware
PHP2Shell
Organizations
Amazon Web ServicesWizCalifOpenAIPHP FoundationDutch National Cyber Security CentreUniversity of ViennaBeelzebubEllioRecorded FutureAmazonCISA
Countries
FranceNetherlandsAustriaUnited StatesUnited KingdomAustraliaChinaRussia
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Cisco Security AdvisoriesFirst report

    Critical PHP RCE flaws affect Cisco products, Cisco says

    CVE-2026-109618 and CVE-2026-109619, dubbed PHP2shell, are fixed in a PHP Foundation release announced October 21.

  2. · 9d ago Dark Reading

    PHP patches two critical unauthenticated RCE flaws

    CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV