What happened
Two critical vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, allow unauthenticated remote code execution through specially crafted HTTP requests. Both are rated 9.2 on CVSS. They were found by researchers from Calif, OpenAI and Google-owned Wiz.
The flaws sit in PHP's memory management and error handling, parts of the runtime that nearly every request touches. The PHP Foundation says this is what made them serious and hard to fix without breaking compatibility. Because the issues can be triggered before application security checks run, every reachable PHP endpoint is at risk: static forms, login routes and health checks included. The exposure is independent of the CMS, framework or plug-ins in use.
Patches shipped on 21 Oct in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release was pulled forward by a day after the CVE IDs and mitigation advice leaked online on 20 Oct, and after Chainguard published built images containing the fix ahead of embargo.
Timeline
- 17 Oct: Amazon's MadPot honeypot records the first exploit attempt, from a commercial anonymisation IP, while the flaws are under embargo.
- 20 Oct: CVE IDs and details leak online. PHP Foundation moves the release forward.
- 21 Oct about 02:00 UTC: Amazon flags the earliest PoC attempt, with more over the next six hours.
- 21 Oct about 08:36 UTC: ELLIO sees its first request, shortly after Chainguard published fixed images.
- 21 Oct: Patches released. Cloudflare counts thousands of attempts before announcement, rising to millions.
- 23 Oct: Sophos, Arctic Wolf and others report attempts to drop a Mirai variant called Potassium.
Am I affected?
You are affected if you run any PHP release in the 7.x or 8.x series that is not patched. According to VulnCheck, VirusTotal and Censys, more than 1 million PHP servers were unpatched as of 21 Oct, and VulnCheck saw over 2.6 million internet-facing PHP hosts, nearly all vulnerable. More than 700,000 run PHP 3.x to 7.3 and nearly 400,000 run 7.4, 8.0 or 8.1, all end of life with no upstream fix.
PHP powers a large share of the web, including WordPress, Drupal, Joomla and Magento, so forgotten and shadow installations are a real risk.
What to do now
- Update to a fixed version immediately: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CISA and the UK NCSC both urge this now.
- If you cannot patch at once, take the server offline or put it behind a WAF rule, as NCSC advises.
- Restrict what a web-facing PHP process can launch, access or connect to. ThreatLocker notes this is a backstop, not a substitute for patching.
- If you run an end-of-life branch with no fix, plan migration or removal now, and isolate the host.
- Inventory every PHP installation you own, including those bundled in OS distributions and historic systems.
How to hunt
- Watch for PHP processes unexpectedly launching command shells or downloading files, as the FBI advises.
- Note that successful attacks leave almost no trace. CrowdStrike says worker processes stay stable, responses return HTTP 200, and application logs record nothing, because no application code runs. The one server-side clue is a single memory-limit fatal in the web server error log, often dismissed as noise.
- Check for connections to the Mirai Potassium infrastructure reported by Sophos: 134.199.154[.]64 (C2, TCP 50792), the loader at 92.118.112[.]100, and sources 85.11.167[.]243, 217.60.242[.]76 and 45.198.224[.]169.
- Block or alert on the C2 domain thunder.godofthunder[.]st.
What does not help
Do not assume you are safe because current PoCs fail. WatchTowr and Sophos report that circulating exploits mostly do not work, crash the target or only test timing. But SOCRadar found a 'one-click' exploit for PHP 8.4.26 under Apache mod_php, and work on defeating ASLR is progressing. Reliable exploitation is a matter of time. Do not rely on PoC failure, patch.
Sources
- PHP2Shell Exploitation Started Days Before Patches, SecurityWeek, 22 Oct
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed, The Hacker News, 22 Oct
- Amazon says PHP2Shell exploitation began 4 days before patches, BleepingComputer, 22 Oct
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware, The Hacker News, 23 Oct
