Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP patches PHP2Shell flaws as exploitation attempts spread

3 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP2Shell patches are out for supported PHP branches as vendors report broad exploitation attempts, including pre-disclosure probing.

PHP shipped fixes on October 21 for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2. The engine bugs can let an unauthenticated attacker execute code on reachable web servers; patched builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sucuri says PHP 7.4, 8.0, and 8.1 get emergency source backports only, while Infosecurity Magazine says 8.1 and earlier have no official patches. Amazon reports a MadPot attempt on October 17 and now calls exploitation broad. SecurityWeek cites WatchTowr saying sprayed proof-of-concept code does not achieve code execution, and reports do not confirm successful compromise of production systems. Wiz says at least one bug affects PHP back to 5.4.

Key facts
  • Calif, OpenAI, and Wiz found both bugs with AI during coordination.
  • Chainguard published fixed images at 07:41 UTC on October 21.
  • Public disclosure and patches came at 1400 UTC on October 21.
  • CISA and the UK NCSC told operators to patch or go offline.
  • Cloudflare reported exploit attempts rising from thousands to millions.
  • Censys counted about 1.57 million unpatched hosts on October 21.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Amazon MadPot logged a PHP2Shell exploitation attempt. · The Hacker News
  2. Oct 20, 2026Vulnerability details leaked before the planned disclosure. · SecurityWeek
  3. Oct 21, 2026Chainguard published patched images at 07:41 UTC. · The Register
  4. Oct 21, 2026PHP disclosed the flaws and shipped fixes at 1400 UTC. · Hacker News
  5. Oct 21, 2026Censys counted about 1.57 million unpatched hosts. · SecurityWeek

What each outlet adds

beyond the shared facts
  • The RegisterPHP blames Chainguard for publishing fixes hours early.
  • Sucuri BlogReports emergency source backports and highest risk on mod_php.
  • The Hacker NewsNames the October 17 source address and ELLIO’s first sighting.
  • SecurityWeekWatchTowr says sprayed PoCs do not achieve code execution.
  • BleepingComputerNCSC advice and PHP saying early public PoCs were not functional.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPAmazonCloudflareOpenAIPHP Foundation
Products
MadPotPHPWordPressDrupalJoomla
Malware
PHP2Shell
Organizations
Amazon Web ServicesWizCalifOpenAIPHP FoundationDutch National Cyber Security CentreUniversity of ViennaBeelzebubEllioRecorded FutureAmazonCISA
Countries
FranceNetherlandsAustriaUnited StatesUnited KingdomAustraliaChinaRussia
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 9d ago The RecordFirst report

    PHP says AI review revived critical bugs first flagged in 2024

    Cloudflare saw exploitation attempts Wednesday, while the foundation says Chainguard published the fix before coordinated disclosure.

  2. · 9d ago Canadian Centre for Cyber Security

    Critical PHP use-after-free bugs allow unauthenticated code execution

    CVE-2026-109618 and CVE-2026-109619, called php2shell, have fixes for PHP 8.2 through 8.5; a PoC exists but no active attacks are confirmed.

  3. · 9d ago oss-security

    PHP team reportedly rejects claimed PHP 8.2–8.5 RCE

    Canonical was told the Mastodon-reported issue is unrelated and not a real vulnerability.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV