Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

CISA lists both PHP2Shell flaws as exploited after emergency patches

1 source · 6 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added both PHP2Shell bugs to KEV on October 26; patches exist, while confirmed compromises remain disputed.

PHP emergency-patched CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, CVSS 9.2) on October 21 after an embargo broke early. The bugs allow unauthenticated remote code execution through crafted HTTP requests and affect PHP from 5.4 through 8.5.11; fixes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported attempts rising to millions, and Wordfence logged more than 74,000. Wordfence, Security Affairs and SecurityWeek say successful compromise is unconfirmed, while Unit 42 told The Hacker News attackers reached a European government entity. On October 26 CISA added both CVEs to KEV, due October 29; ransomware use is unknown.

Key facts
  • Fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • Google says affected versions run from PHP 5.4 through 8.5.11.
  • Censys counted over 34.4 million vulnerable services on October 23.
  • VulnCheck says an ASLR-bypass exploit works on PHP 8.4.26 x86-64.
  • Branches 8.1 and earlier need distributor fixes or an upgrade.
  • PHP workers must be restarted after a fixed release is installed.
Analyze CVE-2026-109619 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026AWS reported an exploit attempt before public disclosure. · CSO Online
  2. Oct 20, 2026CVE IDs circulated and Calif briefly posted a proof of concept. · CSO Online
  3. Oct 21, 2026PHP issued emergency patches after the embargo moved early. · CSO Online
  4. Oct 22, 2026Cloudflare saw exploitation attempts rise to millions. · Security Affairs
  5. Oct 25, 2026Researcher won a Bitcoin challenge and released a proof of concept. · Cyber Security News
  6. Oct 26, 2026CISA added both CVEs to KEV, due October 29. · CISA

What each outlet adds

beyond the shared facts
  • The RegisterVulnCheck’s private exploit hits PHP 8.4.26; ARM64 RCE is not functional.
  • WordfenceMore than 74,000 attempts intercepted, with no confirmed compromises.
  • CSO OnlineChainguard published fixed images about six hours before the revised embargo.
  • SecurityWeekUK said 32 services were down; Qualys found about 71% on end-of-life PHP.
  • The Hacker NewsUnit 42 says a European government entity was compromised within two hours.
CVEs
CVE-2026-109619CVE-2026-109618CVE-2026-115560
Vendors
PHP GroupPHPThe PHP FoundationPHP Foundation
Products
PHPWordPressDrupalJoomlaMediaWiki
Threat actors
Lazarus Group
Malware
PotassiumMirai
Victims
European government entity
Organizations
CISACloudflareCensysSophosVulnCheckArctic WolfCisco TalosChainguardAWSCalifPalo Alto Networks Unit 42CYFIRMA
Countries
North KoreaUnited StatesJapanSouth KoreaThailandIndonesiaAustraliaTaiwanIndiaSingaporeUnited Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 8d ago oss-securityFirst report

    PHP developer says discussed crash is not the RCE

    Jakub Zelenka calls it an unrelated crash in one component under an unlikely scenario.

  2. · 8d ago oss-security

    Tribus posts Wiz php2shell link in PHP RCE thread

    The October 22 oss-security note contains only a link to Wiz’s php2shell PHP RCE blog.

  3. · 8d ago oss-security

    Fleury links PHP CVE-2026-109618 and CVE-2026-109619

    The October 22 reply says the two CVEs were found together and points to calif.io/php2shell.

  4. · 8d ago oss-security

    oss-security reply on PHP CVE-2026-109619 points past comics

    Emmanuel Fleury’s October 22 note only tells readers to skip comics and read the written ending.

  5. · 8d ago oss-security

    Wiz: PHP flaws back to 5.4 allow RCE or memory reads

    Wiz says unauthenticated attackers can run code or read process memory that may hold passwords and tokens.

  6. · 8d ago oss-security

    Poster says PHP 5.4.0 and newer hit by CVE-2026-109619 RCE

    An oss-security reply widens the stale-global-state flaw beyond the subject’s PHP 8.2–8.5 range.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-115560
——PoC ×11—