PHP2Shell flaws patched amid broad exploitation and site takedowns

PHP patched two critical RCE flaws on October 21 after pre-disclosure attacks; Amazon now calls exploitation broad, while confirmed compromises remain unproven.

PHP released emergency fixes on October 21, 2026, for CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. Both are rated 9.2 and can allow unauthenticated remote code execution through PHP memory and request handling. Amazon Threat Intelligence says a MadPot honeypot saw an attempt on October 17, proof-of-concept activity around 0200 UTC on October 21, and broad exploitation after disclosure; Cloudflare logged millions of attempts. The PHP team said early public proof-of-concepts were not functional, and Amazon says it is unclear whether pre-disclosure attempts would work on real systems. Wordfence reports more than 74,000 attempts and no confirmed compromises; the UK government knows of no confirmed public-sector compromise, though 32 services were taken unavailable as a precaution.