PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public

TL;DR

Attackers are now exploiting PHP2Shell, a pair of critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Amazon saw the first attempt on October 17, four days before disclosure, and multiple public proof-of-concept exploits appeared on October 21. Admins should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

Why It Matters

PHP powers an estimated 75% to 80% of websites, including WordPress, Joomla and Drupal sites. VirusTotal estimates put exposed PHP hosts at over 5.1 million. Both flaws need no login, and they affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Exploited in the wild, with public PoC code

In its Amazon Threat Intelligence report on PHP2Shell exploitation, Amazon traced the earliest attempt to its MadPot honeypots on October 17. The traffic came from an anonymized IP address. However, it remains unclear how the actor got exploit details during the embargo.

Next, the earliest proof-of-concept exploits surfaced around 02:00 UTC on October 21, about 12 hours before the embargo lifted. More PoCs appeared within hours of the patch, and Amazon “saw them used against our sensors almost immediately.” Varied payloads suggest multiple actors. Amazon concludes that “PHP2Shell is now being broadly exploited in the wild.”

Cloudflare saw the same surge. In a post on X about PHP2Shell attack volumes, CEO Matthew Prince reported thousands of attempts before the announcement. That “jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

How the Attack Works

Researchers from Calif, OpenAI and Wiz found the bugs. Both share one root cause: PHP can leave its memory corrupted when a request ends abnormally.

• CVE-2026-109618: a chain of weaknesses triggers out-of-memory corruption, leading to code execution as the web worker account.
• CVE-2026-109619: stale global state enables a heap use-after-free, memory disclosure and remote code execution.

The PHP team rates mod_php highest risk. There, “an unauthenticated request can trigger the attack before any application code runs.”

Affected Versions

All PHP 8.2 to 8.5 releases before the fixed versions are affected. PHP 8.1 and older no longer get official updates. Still, the PHP team released minimal source backports for PHP 7.4, 8.0 and 8.1.

Patch and Mitigation Steps

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every worker.
• For legacy versions, ask your distribution or LTS vendor for backports.
• If patching must wait, set memory_limit=-1 and a low post_max_size.
• Disable session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces.
• Consider blocking multipart uploads after testing the impact.
• Hunt for compromise starting from October 17, including unexpected processes and file changes.

These steps reduce exposure but do not fully block PHP2Shell. With public exploits spreading fast, patching remains the only complete fix.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.