PHP2Shell flaws draw broad exploit attempts; UK services go offline
First merged summary.
Critical PHP bugs CVE-2026-109618 and CVE-2026-109619 are patched on supported branches amid widespread exploit attempts and precautionary UK outages.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2, allow unauthenticated remote code execution. Fixes released October 21 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with no official patches for 8.1 and earlier; Infosecurity Magazine says exposure reaches PHP 5.4, while The Hacker News says PHP 7.x and 8.x. Amazon says MadPot logged an October 17 attempt and later broad exploitation, and Cloudflare reported millions of attempts, but SecurityWeek cites WatchTowr saying sprayed proof-of-concept code does not achieve code execution. Baroness Lloyd said 32 UK government services are unavailable and four partly down, with no confirmed public-sector compromise.
- CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale global state.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Amazon logged an October 17 MadPot attempt from 103.216.220.92.
- Disclosure moved to 1400 UTC on October 21 after a proof-of-concept leak.
- The NCSC sent 50,000 warnings urging patches or disconnection.
- Censys counted about 1.57 million unpatched hosts on October 21.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon MadPot logged a PHP2Shell exploit attempt. · The Hacker News
- Oct 20, 2026Vulnerability details leaked before planned disclosure. · Infosecurity Magazine
- Oct 21, 2026Proof-of-concept activity began around 0200 UTC. · The Register
- Oct 21, 2026ELLIO saw its first request at 08:36 UTC. · The Hacker News
- Oct 21, 2026PHP lifted the embargo and released patches at 1400 UTC. · Hacker News
What each outlet adds
beyond the shared facts- Dark ReadingNames both bug mechanisms and says WatchTowr recreated them.
- The Hacker NewsGives the October 17 source address and ELLIO's first sighting.
- SecurityWeekSays sprayed PoCs fail and cites Censys's unpatched-host count.
- The RegisterReports UK outages, NCSC warnings, and a Chainguard embargo dispute.
- Infosecurity MagazineSays flaws reach PHP 5.4 and cites PHP's website share.
Coverage
oldest first · one row per article · UTC- · 4d ago
Dark ReadingFirst report
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
- · 3d ago
Hacker News · security
AWS bulletin lists PHP runtime flaws CVE-2026-109618 and CVE-2026-109619
A WAF rule named PHP2Shell blocks POSTs that pair PHPSESSID with PHP_SESSION_UPLOAD_PROGRESS.
- · 3d ago
Hacker News · security
Author says public PHP2shell PoCs fail on stock PHP
The post says GitHub proofs need an existing local-file-inclusion bug and that model-written exploits fail on vanilla PHP.
- · 3d ago
Exploit-DB
Exploit-DB lists PHP2Shell RCE for PHP after v5.4
The listing covers remote code execution in PHP core versions after v5.4 as CVE-2026-109618.
- · 3d ago
Okta Security
Okta cloud unaffected by PHP2Shell; Access Gateway needs patch
Okta is still investigating CVE-2026-109618 and CVE-2026-109619, with on-prem remediation unfinished.
- · 3d ago
The Hacker News
PHP2Shell exploit attempt hit Amazon honeypot before disclosure
CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.
- · 3d ago
oss-security
PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)
Christian Fischer’s October 21 oss-security note points to a PHP.net archive entry and states no fixed version.
- · 3d ago
SecurityWeek
PHP2Shell exploitation began days before the patches
Amazon says probing started October 17; CISA urges PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- · 3d ago
Infosecurity Magazine
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
- · 3d ago
Amazon saw PHP2Shell exploitation on October 17, before disclosure
MadPot recorded attempts four days before CVE-2026-109618 and CVE-2026-109619 were disclosed, and Amazon says exploitation is now broad.
- · 3d ago
Help Net Security
Searchlight releases php2shell-scanner for two PHP RCE bugs
The open-source scanner forces a PHP out-of-memory condition instead of trusting version banners.
- · 3d ago
The Register · Security
PHP2Shell flaws drew millions of exploit attempts, some before disclosure
Amazon saw a honeypot hit on October 17, four days before patches, and Cloudflare has since logged millions of attempts.
- · 3d ago
PHP2Shell vulnerabilities patched by multiple vendors
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619 allowing unauthenticated remote code execution.
- · 3d ago
BleepingComputer
Amazon says PHP2Shell exploitation began four days before patches
CVE-2026-109618 and CVE-2026-109619 allow remote code execution; Amazon now calls them broadly exploited.
- · 3d ago
Akamai Blog
Akamai discloses PHP2Shell vulnerability CVE-2026-109619
Upload progress feature in PHP enables remote code execution per CVE-2026-109619.
- · 3d ago
Cyber Security News
Attackers probed PHP2Shell flaws days before the October 21 patches
Amazon honeypots logged attempts against CVE-2026-109618 and CVE-2026-109619 from October 17; AWS later said exploitation was widespread.
- · 3d ago
Security Affairs
PHP2Shell attacks started four days before public disclosure
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; AWS saw broad exploitation and no full config-only workaround.
- · 3d ago
SOCRadar
PHP2Shell exploit tooling found on exposed attacker server
The available SOCRadar page gives the finding in the title but no IOCs, versions, or victim details.
- · 3d ago
PHP2Shell takes 32 UK government services offline
AWS says the two critical PHP bugs were exploited four days before disclosure; no public-sector compromise is confirmed.
- · 3d ago
Gcore Makes Enterprise Security Bundle Free for Public Agencies
Gcore offers WAAP Enterprise plan free to government agencies until December 31, 2026, blocking php2shell attacks.
- · 3d ago
GBHackers
Gcore offers free WAAP Enterprise to public agencies
Gcore provides free WAAP protection against php2shell vulnerabilities to government agencies until December 31, 2026.
- · 3d ago
Horizon3.ai
PHP2Shell exploitability depends on the runtime, Horizon3 says
Horizon3 validated CVE-2026-109618 and CVE-2026-109619 only under preconditions it is still mapping.
- · 3d ago
Unofficial backports posted for EOL PHP RCE flaws
Source patches cover unauthenticated RCE CVE-2026-109618 and CVE-2026-109619, rated CVSS 4.0 9.2, where vendors will not fix.
- · 3d ago
PHP team aware of CVE-2026-109619, no new plans
A mailing-list reply says the team knows the PHP 8.2–8.5 stale-global-state report and has no new plans.
- · 3d ago
PHP developer says discussed crash is not the RCE
Jakub Zelenka calls it an unrelated crash in one component under an unlikely scenario.
- · 3d ago
Tribus posts Wiz php2shell link in PHP RCE thread
The October 22 oss-security note contains only a link to Wiz’s php2shell PHP RCE blog.
- · 3d ago
Fleury links PHP CVE-2026-109618 and CVE-2026-109619
The October 22 reply says the two CVEs were found together and points to calif.io/php2shell.
- · 2d ago
oss-security reply on PHP CVE-2026-109619 points past comics
Emmanuel Fleury’s October 22 note only tells readers to skip comics and read the written ending.
- · 2d ago
Wiz: PHP flaws back to 5.4 allow RCE or memory reads
Wiz says unauthenticated attackers can run code or read process memory that may hold passwords and tokens.
- · 2d ago
Poster says PHP 5.4.0 and newer hit by CVE-2026-109619 RCE
An oss-security reply widens the stale-global-state flaw beyond the subject’s PHP 8.2–8.5 range.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |