StoryExploit / PoCcriticalExploited in the wild

PHP2Shell flaws patched, added to CISA KEV amid confirmed attacks

2 sources · 2 articlesFirst reported Oct 22, 2026 · 20:37 UTCUpdated Oct 22, 2026 · 20:40 UTC (8d ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical engine bugs on October 21; CISA added both to KEV after confirmed exploitation and widespread scanning.

PHP emergency-patched CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, on October 21 after an embargo broke. Both score CVSS 9.2 and allow unauthenticated remote code execution over HTTP; Google says versions from PHP 5.4 through 8.5.11 are affected. Fixes are in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while 8.1 and earlier have no official releases. Cloudflare’s CEO said attempts rose from thousands to millions around disclosure. Earlier vendor reports found no confirmed compromise, but BleepingComputer later cited a working Perplexity honeypot attack, and Unit 42 says a European government entity was breached. CISA added both CVEs to KEV on October 26 with a federal due date of October 29; The Register the same day said neither was listed.

Key facts

Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Both bugs are CVSS 9.2 unauthenticated remote code execution.
CISA KEV due date for both CVEs is October 29, 2026.
Censys counted over 34.4 million vulnerable PHP services on October 23.
Unit 42 says a European government entity’s hashes and MFA secrets were accessed.
PHP Foundation also warned of unpatched CVE-2026-115560 under unusual conditions.

Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 17, 2026Amazon reported an exploit attempt before public patches. · CSO Online
Oct 21, 2026PHP shipped emergency patches after the embargo broke early. · Security Affairs
Oct 22, 2026Cloudflare said exploitation attempts had reached millions. · Security Affairs
Oct 23, 2026Censys counted over 34.4 million vulnerable PHP services. · Security Affairs
Oct 25, 2026Researcher killa claimed a Bitcoin challenge using both bugs. · Cyber Security News
Oct 26, 2026CISA added both CVEs to the KEV catalog. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts

CSO OnlineChainguard images shipped about six hours before the revised embargo.
SecurityWeekUK government said 32 services were unavailable, mostly during patching.
The Hacker NewsUnit 42 describes post-exploitation at a European government entity.
BleepingComputerPerplexity honeypot showed working RCE on Apache mod_php 8.4.26.
The RegisterSame-day claim that neither CVE was in CISA’s KEV catalog.

CVEs: CVE-2026-109618 CVE-2026-109619 CVE-2026-115560

Vendors: PHP PHP Group The PHP Foundation PHP Foundation
Products: Apache mod_php PHP PHP-FPM mod_php
Threat actors: Lazarus Group
Malware: Potassium Mirai
Victims: European government entity
Organizations: Perplexity Expel Amazon Threat Intelligence Cloudflare Dataminr CISA Censys Sophos VulnCheck Arctic Wolf Cisco Talos Chainguard
Countries: North Korea United States Japan South Korea Thailand Indonesia Australia Taiwan India Singapore United Kingdom

Coverage

oldest first · one row per article · UTC

Oct 22, 20:37 UTC · 8d ago The Register · SecurityFirst report
VulnCheck exploit bypasses ASLR for PHP2Shell remote code execution
The private exploit chains a memory leak into RCE on PHP 8.4.26 with ASLR on and display_errors off.
Oct 22, 20:40 UTC · 8d ago oss-security
Unofficial PHP2Shell fix backported to EL6 and EL7 PHP 5
The EL7 package becomes php-5.4.16-48.el7.php2shell.1; those Enterprise Linux releases will not get a vendor update.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-109618 +1 related CVE CVE-2026-109619	OOM longjmp memory flaw enabling RCE in PHP	9.2	100%	KEVPoC ×25	9d ago KEV Oct 26, 2026
CVE-2026-115560		—	—	PoC ×11	—