PHP Patches Critical PHP2Shell RCE Flaws as Wild Exploits Hit Sensors

The PHP Foundation released fixes for two critical remote code execution vulnerabilities as threat watchers detected early exploitation attempts.

Threat Times Exposure DeskOctober 21, 20261 min read

Share LinkedIn Reddit

PHP Patches Critical PHP2Shell RCE Flaws as Wild Exploits Hit Sensors — Illustration: Threat Times

Key points

Patches address CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2.
WatchTowr and others observed in-the-wild exploitation attempts targeting the flaws.
Fixes cover PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The PHP Foundation has released patches for two critical-severity vulnerabilities collectively named PHP2Shell, which allow unauthenticated remote code execution. These fixes arrive as security firms report the first in-the-wild exploitation attempts targeting the defects.

Both vulnerabilities carry a CVSS score of 9.2 and are tracked as CVE-2026-109618, an out-of-memory corruption issue, and CVE-2026-109619, a stale global state flaw. Remote code execution was confirmed on Apache servers using mod_php.

Context and Background

The PHP Foundation states that both issues reside in memory management and error handling, components touched by nearly every request. This central location made the vulnerabilities serious and difficult to resolve. Patches were included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Minimal source backports were also released for older PHP versions 7.4, 8.0, and 8.1. Proof-of-concept exploits began circulating before the fixes arrived. WatchTowr reported seeing exploitation attempts hitting its sensors around the time the patches landed, though no successful breaches were observed.

Who Is Affected

Hadrian reported seeing PHP2Shell exploited at scale a few hours before the fixes shipped. Patchstack, Cloudflare, and Vega also observed exploitation attempts earlier in the day. Vega noted that wild attempts leveraged a public proof-of-concept.

PHP maintainers warn that all installations handling web requests are potentially at risk. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The flaws affect nearly all PHP releases back to version 5.4.

What should you do?

Users who cannot patch immediately can implement measures to reduce exposure to specific attack paths. However, the PHP Foundation warns these steps do not make an installation safe. The flaws can also be exploited to read sensitive process memory containing credentials and API keys.

What to do and how to stay safe: PHP

Update PHP installations to the latest patched versions immediately if possible.
Monitor server logs for unusual activity or signs of exploitation attempts.
Restrict access to PHP endpoints that handle file uploads or session data.
Verify that older PHP versions are not running in production environments.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.