Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP2Shell patches follow pre-disclosure probes and broad attack attempts

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical engine flaws after an October 17 probe; exploitation attempts are now widespread, with real-world success unconfirmed.

Amazon Threat Intelligence says a PHP2Shell exploit attempt hit its MadPot honeypot on October 17, 2026, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. Both flaws, scored 9.2, can allow unauthenticated remote code execution in the PHP runtime. The PHP Foundation advanced disclosure after an October 20 leak and released October 21 fixes for 8.5.12, 8.4.27, 8.3.36, and 8.2.35; 8.1 and earlier get no official patches. Amazon and Cloudflare report attempts rising to millions after disclosure, though WatchTowr and the PHP team say early public proof-of-concepts were not functional, and confirmed compromises remain unestablished. UK agencies urged patching or disconnection; 32 government services were reported unavailable as a precaution, with no confirmed public-sector compromise.

Key facts
  • Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Infosecurity Magazine says exposure reaches PHP 5.4; The Hacker News cites 7.x and 8.x.
  • Amazon recorded the October 17 attempt from 103.216.220.92.
  • Cloudflare reported attempts rising from thousands to millions after disclosure.
  • Amazon says no configuration-only workaround fully addresses both CVEs.
  • Calif and Wiz independently found the bugs during about two months of coordination.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Amazon MadPot recorded a PHP2Shell exploit attempt. · The Hacker News
  2. Oct 20, 2026Vulnerability details leaked before planned disclosure. · Infosecurity Magazine
  3. Oct 21, 2026PHP released patches; embargo lifted at 1400 UTC. · Hacker News
  4. Oct 21, 2026ELLIO recorded its first request at 8:36 UTC. · The Hacker News
  5. Oct 22, 2026Baroness Lloyd said 32 UK services were unavailable. · The Register

What each outlet adds

beyond the shared facts
  • The Hacker NewsNames the October 17 source address and ELLIO’s first-request time.
  • Latent SpaceAttributes independent discovery to Calif and Wiz using AI tools.
  • SecurityWeekWatchTowr says sprayed proof-of-concept code does not achieve code execution.
  • Infosecurity MagazineSays PHP 8.1 and earlier receive no official fixes.
  • The RegisterReports precautionary UK outages and no confirmed public-sector compromise.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPAmazonCloudflareOpenAIPHP FoundationCiscoAWSUbuntuRed HatGoogle Cloud
Products
MadPotPHPWordPressDrupalJoomla
Victims
UK governmentOffice for Budget Responsibility
Organizations
Amazon Web ServicesWizCalifOpenAIPHP FoundationDutch National Cyber Security CentreUniversity of ViennaBeelzebubEllioRecorded FutureAmazonCISA
Countries
FranceNetherlandsAustriaUnited StatesUnited KingdomAustraliaGermanyBelgiumFinland
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 8d ago The Hacker NewsFirst report

    PHP2Shell exploit attempt hit Amazon honeypot before disclosure

    CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.

  2. · 8d ago oss-security

    PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)

    Christian Fischer’s October 21 oss-security note points to a PHP.net archive entry and states no fixed version.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV