Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

PHP ships PHP2Shell fixes as exploit attempts precede disclosure

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP released fixes for two CVSS 9.2 RCE bugs while sensors logged exploit attempts days before disclosure.

On October 21 the PHP project released fixes for two critical engine flaws, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell and both scored CVSS v4.0 9.2. They can allow unauthenticated remote code execution on PHP serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with risk highest for mod_php. Fixed builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; 7.4, 8.0, and 8.1 get source backports only. A leak and early Chainguard images broke the embargo. AWS says a honeypot saw an attempt on October 17 and later called exploitation broad, while WatchTowr says it has not seen successful compromise. CMS or plugin updates do not patch PHP itself.

Key facts
  • CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale global state.
  • Wiz says at least one bug affects every PHP release back to 5.4.
  • PHP 8.1 and older no longer receive routine project security updates.
  • Amazon logged an October 17 attempt from 103.216.220.92.
  • Calif, OpenAI, and Wiz reported the bugs after AI-assisted analysis.
  • WAF rules and partial mitigations do not replace a patched PHP build.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026AWS honeypot logged a PHP2Shell exploit attempt. · WIRED
  2. Oct 20, 2026Advance notice rated both flaws CVSS 9.2. · Wordfence
  3. Oct 21, 2026Chainguard published patched images at 07:41 UTC. · The Register
  4. Oct 21, 2026ELLIO saw its first exploit request at 08:36 UTC. · The Hacker News
  5. Oct 21, 2026PHP disclosed fixes a day early after a leak. · SecurityWeek

What each outlet adds

beyond the shared facts
  • SecurityWeekBug classes, August reporters, and pre-release attempts.
  • The RegisterChainguard’s early images and PHP’s blame.
  • WIREDOctober 17 AWS honeypot and broad-exploitation claim.
  • WordfenceOctober 20 rating, PHP 8.2 end of life, remirepo signing.
  • The Hacker NewsMadPot source IP, ELLIO timing, and VulnCheck host count.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHP FoundationPHPOpenAIPHP Group
Products
PHPWordPressDrupalJoomlaMagento
Malware
PHP2Shell
Organizations
WizOpenAICloudflareWatchTowrHadrianCERT-EUMalwarebytesAmazonPHP FoundationCISAChainguardCrowdStrike
Countries
AustraliaChinaRussiaNetherlandsFinland
AI models
GPT-5.6 SolGemini 4 Argon

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Ubuntu Security NoticesFirst report

    USN-8948-2 backports PHP code-execution fixes to older Ubuntu

    CVE-2026-109618 and CVE-2026-109619 can let a remote attacker run code while PHP handles requests.

  2. · 9d ago oss-security

    PHP 8.2–8.5 RCE via stale global state reported

    A mailing-list note says Fediverse reports of the fix are not yet fully confirmed.

  3. · 9d ago Hacker News · security

    PHP patches two critical remote code execution flaws

    Unauthenticated code execution was demonstrated on Apache with mod_php under default settings for the memory bug.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV