Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP ships PHP2Shell fixes as attacks continue without confirmed breaches

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP patched two critical RCE flaws on October 21; attacks continue without confirmed compromises, and PAN-OS hotfixes remain pending.

The PHP Foundation issued emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, unauthenticated memory-corruption flaws that can allow remote code execution through crafted HTTP requests. Versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected; both bugs are scored CVSS 9.2. Cloudflare reported attempts rising into the millions, Wordfence logged more than 74,000 related attempts, and Censys still counted over 34.4 million vulnerable services on October 23. Sophos, Wordfence and others say telemetry shows scanning and failed attempts, not confirmed compromises, including blocked Potassium payloads. Palo Alto said on October 24 that several PAN-OS branches are exposed through management interfaces, with hotfixes not yet available and no known attacks on its products.

Key facts
  • Fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • Both flaws score CVSS v4.0 9.2 and date to PHP 5.4.
  • Wordfence logged more than 74,000 attempts and reports no confirmed compromises.
  • Censys counted over 34.4 million vulnerable PHP services on October 23.
  • Palo Alto estimates earliest PAN-OS hotfixes on October 26; none are available yet.
  • VulnCheck says a private exploit bypasses ASLR on x86-64 PHP 8.4.26.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026AWS reported an exploit attempt before public disclosure. · CSO Online
  2. Oct 20, 2026CVE identifiers circulated and Calif briefly posted a video. · CSO Online
  3. Oct 21, 2026PHP released emergency fixes after an early image publication. · CSO Online
  4. Oct 22, 2026Sophos revised its alert to failed attempts, not compromises. · GBHackers
  5. Oct 23, 2026Censys still counted over 34.4 million vulnerable services. · Security Affairs
  6. Oct 24, 2026Palo Alto confirmed PAN-OS exposure; hotfixes not yet available. · Cyber Security News

What each outlet adds

beyond the shared facts
  • CERT/CC Vulnerability NotesNames bug types, fixed versions, and OpenAI, Wiz and Calif reporters.
  • CSO OnlineDetails the broken embargo and an October 17 AWS attempt.
  • WordfenceReports more than 74,000 intercepted attempts and no confirmed compromises.
  • The RegisterVulnCheck’s private ASLR-bypass exploit works on PHP 8.4.26 x86-64.
  • Cyber Security NewsPalo Alto confirms PAN-OS impact and says product hotfixes are pending.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPThe PHP FoundationPHP FoundationPalo Alto Networks
Products
PHPWordPressDrupalJoomlaMediaWikiPAN-OSPanoramaCortex XCOREWildFire
Malware
PotassiumMirai
Organizations
CloudflareCensysSophosVulnCheckArctic WolfCisco TalosChainguardAWSCalifHunt.ioSOCRadarQualys
Countries
United KingdomUkraine

Coverage

oldest first · one row per article · UTC
  1. · 20d ago Cyber Security NewsFirst report

    Gcore Makes Enterprise Security Bundle Free for Public Agencies

    Gcore offers WAAP Enterprise plan free to government agencies until December 31, 2026, blocking php2shell attacks.

  2. · 20d ago GBHackers

    Gcore offers free WAAP Enterprise to public agencies

    Gcore provides free WAAP protection against php2shell vulnerabilities to government agencies until December 31, 2026.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV