StoryExploit / PoCcriticalExploited in the wild

CISA lists PHP2Shell flaws as exploited; patches remain incomplete

2 sources · 2 articlesFirst reported Oct 22, 2026 · 22:23 UTCUpdated Oct 22, 2026 · 22:24 UTC (8d ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Both PHP2Shell bugs are in CISA’s catalog after honeypot RCE was confirmed; many PHP services remain unpatched.

PHP shipped emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution bugs nicknamed PHP2Shell and scored CVSS 9.2. The flaws affect every earlier release, including code present since PHP 5.4; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while 7.4, 8.0 and 8.1 need distributor backports or an upgrade. Cloudflare’s CEO said attempts rose from thousands before disclosure to millions, and some sites went offline. Security Affairs reported no confirmed successful exploits on October 23; BleepingComputer and The Hacker News later cited a Perplexity honeypot showing working code execution. CISA added both flaws on October 26, with a federal due date of October 29 and ransomware use listed as unknown. The Register, earlier that day, said neither CVE was in the catalog.

Key facts

Fixed PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Both flaws score CVSS 9.2 and need no login.
CISA due date for federal agencies is October 29, 2026.
Known ransomware use of either CVE is listed as unknown.
Security Affairs cited over 34.4 million vulnerable services on October 23.
The Hacker News later cited Censys at over 32.51 million.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Oct 17, 2026AWS reported an exploit attempt before public disclosure. · CSO Online
Oct 21, 2026PHP issued emergency patches after the embargo moved early. · Security Affairs
Oct 22, 2026Cloudflare said exploit attempts had reached the millions. · Security Affairs
Oct 23, 2026Censys still counted over 34.4 million vulnerable services. · Security Affairs
Oct 24, 2026Perplexity reported successful honeypot remote code execution. · The Hacker News
Oct 26, 2026CISA added both PHP2Shell flaws to its catalog. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts

CSO OnlineEmbargo moved to October 21; Chainguard images published about six hours early.
Security AffairsNames fixed versions and says no confirmed successful RCE yet.
Dark ReadingOx found 97.5% of sampled instances still unpatched on October 23.
BleepingComputerDetails the Perplexity mod_php honeypot confirmation and 800 KiB dump.
The RegisterSame-day report that neither CVE was then in CISA’s catalog.

CVEs: CVE-2026-109618 CVE-2026-109619 CVE-2026-111497 CVE-2026-115560

Vendors: PHP Foundation PHP PHP Group The PHP Foundation
Products: PHP Brotli Apache mod_php PHP-FPM mod_php
Malware: Mirai Potassium
Organizations: CISA Perplexity Censys Akatsuki Legion Amazon Threat Intelligence Sophos Hunt.io Expel Cloudflare Dataminr VulnCheck Arctic Wolf
Countries: United States Ukraine

Coverage

oldest first · one row per article · UTC

Oct 22, 22:23 UTC · 8d ago CERT/CC Vulnerability NotesFirst report
PHP before 8.2.35 and related releases allows remote code execution
Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.
Oct 22, 22:24 UTC · 8d ago Wordfence
PHP2Shell attack attempts continue with no confirmed compromises
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-109618 +1 related CVE CVE-2026-109619	OOM longjmp memory flaw enabling RCE in PHP	9.2	100%	KEVPoC ×25	9d ago KEV Oct 26, 2026
CVE-2026-111497	Buffer overflow in Google Brotli decoder 1.0.3–1.2.0	9.2	83%	KEVPoC ×25	8d ago KEV Oct 27, 2026
CVE-2026-115560		—	—	PoC ×11	—