CISA Confirms Active Exploitation of Critical PHP2Shell Vulnerabilities

PHP2Shell vulnerabilities are now confirmed as actively exploited. On October 26 CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. The top move is simple: update PHP to the fixed release for your branch. That means 8.5.12 or 8.4.27 or 8.3.36 or 8.2.35. This suits every site owner and admin who runs PHP on a public server. Both flaws score 9.2 on CVSS and allow unauthenticated remote code execution. Around 70% of websites run PHP so the exposure is wide. Federal agencies must patch by October 29 and private teams should move just as fast. This guide covers what is affected and what to patch first. It also shows how to check whether attackers got in before you updated.

What Is PHP2Shell and What Did CISA Confirm?

PHP2Shell is the nickname for two critical bugs in the PHP core. Both let an attacker run commands on a web server with a crafted request. No login is needed.

CISA added both flaws to the CISA KEV catalog after receiving evidence of real attacks. CISA says the bugs reach every PHP setup that serves web requests:

• Apache with mod php (PHP treats this as the highest risk)
• PHP FPM
• php cgi
• FrankenPHP
• LiteSpeed

The proof came from honeypots. Adel Karimi at Perplexity recorded confirmed remote code execution against Apache running PHP 8.4.26. Marcus Hutchins at Expel called it the best confirmation of in the wild exploitation he had seen. One caveat matters here. Karimi used a single worker mod php setup that favors the attacker. No named real world victim is confirmed yet.

Which CVEs Are Being Exploited in the PHP2Shell Attacks?

Two CVEs sit on the CISA list:

• CVE-2026-109618: a memory corruption vulnerability. PHP describes it as remote code execution through out of memory corruption during request cleanup. CVSS 9.2.
• CVE-2026-109619: a stale internal request state vulnerability. A later request on the same worker reuses leftover global state. CVSS 9.2.

A third issue is separate. CVE-2026-115560 got its own PHP advisory on October 23. It depends on configuration and does not bypass the October 21 fixes.

How Does the PHP2Shell Attack Work?

The public exploit chain follows a clear pattern:

1. The attacker sends a huge multipart POST request that puts PHP under memory pressure.
2. The failure leaks memory in the response. Karimi saw an 800 KiB decoded cookie dump.
3. The attacker uses addresses from that dump to build a second request.
4. That request starts a shell from the Apache worker.
5. The shell pulls extra payloads with wget or curl or PHP CLI.

This maps to the MITRE ATT&CK technique Exploit Public Facing Application. The timeline is worrying. Amazon Threat Intelligence saw an attempt on October 17 which was four days before public disclosure. Details of the flaws also leaked online on October 20 ahead of coordinated disclosure. Researchers also saw signs of agentic AI during post exploitation at a European government entity. Attackers reached MFA secrets and password hashes.

Which PHP Versions and Products Are Affected?

Use this table to find your fix:

For end of life branches PHP published minimal source backports for 7.4 through 8.1. Anything older gets no fix from the project. Ask your distribution or LTS vendor if you run those versions.

Supply chain risk is real because PHP hides inside other products. Vendors including WordPress and Drupal and Craft CMS and Citrix and F5 and QNAP issued advisories. Cisco and NetApp products also appear on the Dutch NCSC tracking list. Check containers and appliances too.

Why Are the PHP2Shell Vulnerabilities Dangerous Right Now?

The exploit window has shrunk from weeks to hours. watchTowr reported attacks on October 21 which was the day the fixes shipped. Public proof of concept code and scanners are on GitHub. Censys estimates more than 32.51 million PHP services still run an affected version.

Many teams assume a plugin update or a firewall rule will help. It will not. No configuration change fully mitigates PHP2Shell. Updating PHP and restarting every PHP worker is the only complete fix. WordPress sites are exposed through the server and not through the CMS. Our PHP2Shell WordPress security guide explains this in detail.

CISA’s Patch Deadline for Federal Agencies

Federal Civilian Executive Branch agencies must address PHP2Shell by October 29. That is a three day patching deadline under BOD 26-04. CISA also directs agencies to follow the forensic triage requirements tied to that directive. In plain words agencies must ask whether attackers got in before the patch.

The directive covers federal agencies only. CISA still urges private companies to prioritize KEV listed flaws. Treat October 29 as your own deadline.

How to Protect Your PHP Servers Against PHP2Shell

Follow these steps in order:

1. Find every PHP install. Include old marketing sites and hosting panels and devices with PHP built in.
2. Update to the fixed version for your branch from the table above.
3. Restart all PHP workers. Restart PHP FPM and Apache so no old process stays in memory.
4. Apply interim controls only if you must wait. Set session.upload_progress.enabled to 0 for CVE-2026-109619. Lower post_max_size and enforce request limits for CVE-2026-109618. These reduce risk but do not replace the patch.
5. Handle PHP 8.1 and older. CISA says systems that cannot be patched should come offline.
6. Rebuild container images that bundle PHP.

Here is how the options compare on cost and time:

• Patch in house: usually an afternoon of work. Cheapest by far.
• Ask your host or vendor: fast but you depend on their schedule.
• Upgrade an old app stack: takes days and may need code fixes. Still cheaper than a breach.
• Take the system offline: free today but costs you traffic and leads.

If you run WordPress and want a safe upgrade path see our WordPress development services.

How to Check If Your Server Was Compromised

The key question is: “Were we exploited before we patched?” Start your review from at least October 17 and not from the disclosure date.

Run this threat hunting checklist:

• Process activity: look for shells or wget or curl spawned by php fpm or httpd or apache2.
• Error logs: check for out of memory errors and worker crashes.
• Web logs: search for oversized multipart POST requests.
• Network traffic: look for outbound connections to 162.35.99[.]94 and 15.204.59[.]70. Both addresses were tied to attacks on Karimi’s honeypots.
• Persistence: hunt for new PHP files and cron jobs and admin users and SSH keys.

Patching does not remove a backdoor. If you find signs of entry follow your incident response plan. Rotate passwords and API keys and MFA secrets. Not sure where to start? Request a free website audit from our team.

Which Industries and Compliance Frameworks Are Most Exposed?

Any business with internet facing PHP is exposed. Some sectors face extra pressure:

• Healthcare: patient data brings HIPAA duties.
• Ecommerce and payments: card data falls under PCI DSS.
• Law firms: client confidentiality is at stake.
• SaaS and IT providers: SOC 2 and ISO 27001 audits will ask for proof.
• Government suppliers: BOD 26-04 sets the tone for federal work.

Auditors will look for your asset inventory and timestamped patch records and a note that you asked whether compromise happened before remediation. Document that triage decision even if you are not a federal agency.

The message is clear. PHP2Shell vulnerabilities are no longer a warning. They are a live threat with public exploit code and a government deadline. Patch first and then hunt for signs of entry. A site that is also fast and well built is easier to maintain. Our website relaunch checklist can help you plan a cleaner rebuild.

Frequently Asked Questions

What are the PHP vulnerabilities?

PHP vulnerabilities are flaws in the language runtime or its extensions. They can crash servers or let attackers run code. The most serious are remote code execution bugs like CVE-2026-109618 and CVE-2026-109619.

What is the recent PHP vulnerability?

PHP2Shell is the latest and most serious. It covers two critical flaws fixed on October 21 and added to the CISA KEV catalog on October 26. A separate session upload progress issue named CVE-2026-115560 also got an advisory on October 23.

Is the PHP vulnerability patched?

Yes for supported branches. The fixed releases are 8.5.12 and 8.4.27 and 8.3.36 and 8.2.35. PHP 8.1 and older have no official release so ask your vendor for a backport or upgrade.

Is PHP not secure?

PHP is as secure as its version and setup. Supported releases get fast fixes. Old unsupported versions are the real danger.

Does anyone still use PHP?

Yes. About 70% of websites run it including WordPress. That wide use is why PHP2Shell matters to so many organizations.