PHP2Shell: Critical PHP RCE

Key Findings

• CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, are flaws in the PHP interpreter itself. Every application on an affected build inherits the exposure regardless of framework, CMS or plugins.

• The PHP security team scored both at 9.2 on CVSS v4.0. A remote attacker with no credentials can run code as the web server worker account. PHP2Shell also includes an unauthenticated path that discloses live worker memory without executing any code.

• Exploitation started before the patch. Amazon Threat Intelligence recorded an attempt against its MadPot honeypots on October 17, four days ahead of disclosure, and now describes PHP2Shell as broadly exploited in the wild.

• Working exploits exist. Calif and Wiz each demonstrated pre-authentication RCE against current application releases. Most publicly circulating proof-of-concept code crashes workers rather than achieving execution, so attacker capability in the wild is unknown.

• Patching is the only complete fix. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4, 8.0 and 8.1. PHP states its interim settings do not make an installation safe.

• Exploitation attempts and the memory-disclosure path leave almost no web telemetry. Workers stay up, responses return HTTP 200 and application logs stay clean because no application code runs. Code execution does leave host artifacts. Hunting starts at October 17, not at the disclosure date.

Exploitation Status

No victim has been publicly named, no incident report with post-exploitation detail has been published, and no tracked threat actor has been attributed. The traffic observed so far looks opportunistic and multi-sourced rather than targeted.

• Amazon Threat Intelligence: first attempt October 17 from a commercial anonymization network, additional attempts from around 02:00 UTC on October 21, and an assessment of broad exploitation in the wild. Amazon cannot say whether the October 21 attempts would have succeeded against real systems.
• watchTowr: exploitation observed through its honeypot network from October 21, with the caveat that circulating public proof-of-concept code does not achieve RCE.
• Patchstack: says it has confirmed multiple active exploitation incidents. No technical detail published yet, so these are not independently verifiable.
• Cloudflare: attempt volume across its network rose from tens of thousands in the 45 minutes after the announcement, to hundreds of thousands within two hours, to millions by October 22. CTO Dane Knecht states WAF rules for the known exploit vectors are live for all customers including the free tier.
• VulnCheck: at least one Chinese IP address attempted unsuccessfully to deploy a web shell.
• Huntress: no in-the-wild exploitation observed across its partner base as of October 21.
• Neither CVE appears in the CISA Known Exploited Vulnerabilities catalog as of the morning of October 22.
• Exposure remains enormous. VulnCheck, VirusTotal and Censys placed more than one million internet-facing PHP servers on unpatched releases as of October 21. Censys counted roughly 1.58 million hosts reporting an identifiable PHP version out of 2.58 million internet-facing hosts, with approximately 1.57 million of those unpatched, and tracks close to three million internet-facing PHP hosts as of October 22. Treat that ratio as an upper bound. Version-banner scanning overcounts, because distribution packages carrying the fix keep the original upstream version number.
• The UK National Cyber Security Centre is advising organizations to take offline any system that cannot be fixed promptly.

Howler Cell assesses with high confidence that exploitation attempts against internet-facing PHP are now routine, and with moderate confidence that a publicly documented compromise with post-exploitation evidence, and a KEV listing, follow within days. Vendor reports of confirmed incidents already exist. What does not yet exist is a published case with technical detail. Patch under emergency change.

Attack Chain

The chain below is a request-parsing chain. Steps 2 through 4 complete before any application code executes, which is why application-layer authentication does not stop it.

Step 1: Target identification.

Any internet-facing host serving PHP. There is no authentication to bypass, no session to steal and no specific vulnerable endpoint to discover. PHP rates Apache mod_php highest risk because a working exploit was demonstrated there and it runs before any application code. On PHP-FPM, exploitation is possible but depends more on the application.

Step 2: Crafted request delivery.

A multipart/form-data POST carrying upload-progress fields, or a body with no usable Content-Length, sent to any endpoint whether or not that endpoint accepts uploads. PHP parses it during request setup.

Step 3: State corruption in the worker.

CVE-2026-109618: memory exhaustion interrupts PHP mid-initialization and cleanup then processes partially initialized request data. CVE-2026-109619: session or decoder state from an interrupted request survives and a later request on the same worker consumes it. Wiz also identified an OPcache type confusion where a partially persisted script leaves stale shared metadata that another worker resolves to a pointer of the wrong type.

Step 4: Outcome fork.

Code execution as the web worker account, or memory disclosure. The disclosure primitive returns an attacker-sized region of live worker memory through a malformed PHPSESSID response cookie, including passwords, tokens and API keys, with no code execution and without the application ever calling session_start().

Step 5: Post-exploitation.

Web shell written to the web root, shell or script interpreter spawned from the PHP worker process, cron entries and accounts created by the worker account, then lateral movement. A web server compromised this way often has network reach to application databases and internal services.

Figure 1: PHP2Shell attack chain with detection break points A through E.

Affected and Fixed Versions

Distribution packages often keep the original upstream version number. Confirm the fix by searching the package changelog for the CVE identifiers rather than relying on php -v. The finders trace the oldest affected code to PHP 5.4.0.

Patch Analysis

Howler Cell compared the official PHP 8.5.11 and 8.5.12 source releases, focusing on the request-memory and session-handling changes in Zend/zend_alloc.c and ext/session/session.c.

For CVE-2026-109618, 8.5.11 can enter fatal-error handling the moment an allocation exceeds the configured limit. That interruption can land while request data is only partly initialized, and ordinary cleanup then runs over inconsistent internal state. 8.5.12 defers out-of-memory handling, separates soft and hard memory limits, and terminates the worker without ordinary cleanup when safe recovery is not possible.

Figure 2: CVE-2026-109618. Immediate bailout in 8.5.11 against deferred out-of-memory handling in 8.5.12.

For CVE-2026-109619, 8.5.11 begins multipart upload-progress processing before normal request initialization and without first clearing session globals. 8.5.12 adds an early call to php_rinit_session_globals plus additional session-initialization checks, so a new request cannot consume session or decoder state left behind by a previous interrupted request.

Figure 3: CVE-2026-109619. Session globals are now cleared before upload processing begins.

Detection and Hunting

The detection problem with PHP2Shell is silence. Worker processes remain stable, responses return HTTP 200 and application logs record nothing, because no application code ran. Often the only server-side trace is a single memory-limit fatal in the web server error log, which most teams treat as noise. Signatures catch the known payload shapes, and attackers are already varying payloads around them. The table below maps each break point in Figure 1 to what is actually observable.

Updating PHP is the only complete fix. The settings below follow the interim guidance in the PHP advisory. They narrow specific attack paths, and PHP states plainly that they do not make an installation safe. Apply them in php.ini, the FPM pool or the web server configuration so they take effect before request parsing, then restart every PHP worker.

What To Do Now

1. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install a distribution package carrying the fix. Handle internet-facing Apache mod_php servers first.
2. Inventory every PHP runtime in the environment, including the ones nobody owns: appliances, hosting panels, container base images and build pipelines.
3. Where patching cannot happen immediately, apply the interim settings above and restart all PHP workers.
4. Enable WAF or CDN protections for these CVEs as a stopgap only, and do not count them as remediation.
5. Hunt from October 17 forward on any host that was internet-reachable and unpatched, using the break points in the detection table.
6. Rotate credentials, tokens and API keys reachable by the web worker account where the disclosure path cannot be ruled out.
7. Take end-of-life PHP without a vendor backport off the public internet until it can be upgraded.

Do not run public proof-of-concept code outside an isolated lab. Roughly 100 repositories referencing PHP2Shell appeared within a day of disclosure. Quality varies, some only reproduce a crash, and JFrog has documented fake proof-of-concept code and prank malware published to GitHub under the PHP2Shell name. For exposure testing, Searchlight Cyber released php2shell-scanner as open-source tooling on October 22.

Appendix A. Indicators of Compromise

Source: Amazon Threat Intelligence MadPot telemetry. AWS warns that the identified addresses include shared anonymization infrastructure and are not exclusive to this activity. Investigate observations involving these addresses rather than blocking them.

Howler Cell has identified no published file hashes for this activity as of this time. Payloads are request-borne, and the post-exploitation artifacts reported so far are commodity web shells and reverse shells rather than a distinct malware family.

Appendix B. References

• PHP security advisory, October 21, 2026: https://www.php.net/archive/2026.php#2026-10-21-5
• PHP advance notice, October 20, 2026: https://www.php.net/archive/2026.php#2026-10-20-1
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• Amazon Threat Intelligence, PHP2Shell exploitation prior to public disclosure in MadPot: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
• Calif, php2shell: https://calif.io/php2shell/
• Wiz Research, PHP2Shell: https://www.wiz.io/blog/php2shell-php-rce
• watchTowr, PHP2Shell FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
• CERT-EU Security Advisory 2026-018

Update Log