PHP patches PHP2Shell after pre-disclosure exploit attempts

PHP patched two critical pre-auth RCE flaws on October 21 after Amazon logged exploitation attempts four days earlier.

Two PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell and scored CVSS 9.2, can allow unauthenticated remote code execution. Amazon Threat Intelligence says a MadPot honeypot logged an attempt on October 17, during an embargo, from an anonymization-network address; Amazon says it is unclear whether pre-disclosure attempts would have worked on real systems. Details leaked on October 20, and PHP released fixes on October 21 for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon and others then called exploitation broad, while WatchTowr says sprayed proof-of-concept code does not achieve code execution. Sucuri reports emergency source backports for PHP 7.4, 8.0 and 8.1; Infosecurity Magazine says 8.1 and earlier receive no official patches. CMS or application updates do not fix a vulnerable runtime.