php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.

Points clés :

1. CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution.
2. Amazon Threat Intelligence observed an exploitation attempt on October 17, four days before public disclosure. It says php2shell "is now seeing broad exploitation attempts in the wild." On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog.
3. On October 21, 2026, PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches will not receive official releases, but the PHP security team published minimal source backports for PHP 7.4 through 8.1.

Contexte

Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026.

FAQ

When were these PHP vulnerabilities first disclosed?

On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to the PHP Foundation, the release was originally scheduled for October 22 and was moved up by a day after the CVE identifiers leaked. On October 21, the PHP security team published its security advisory and released patches.

A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR of Calif.io, which has since published a technical writeup. The PHP Foundation credited Calif, OpenAI and Wiz, among others, for their research and responsible disclosure. Calif and Wiz have both said they used AI models in their research.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

— The PHP Foundation (@ThePHPF) October 20, 2026

What are CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 and CVE-2026-109619 are critical remote code execution (RCE) vulnerabilities in PHP. CVE-2026-109618 stems from how PHP handles out-of-memory (OOM) errors. If memory runs out while PHP's internal request data is only partially initialized, the cleanup that follows can treat that data as valid. CVE-2026-109619 is a use-after-free flaw. Leftover state from one request points to freed memory, and a later request handled by the same worker can then use it. According to PHP, both can be exploited by an unauthenticated remote attacker. PHP's advisory for CVE-2026-109619 also lists memory disclosure as a confirmed impact.

PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs.

CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. According to the PHP Foundation, the CVE identifiers that circulated before the release came with an incorrect CVSS score of 10.0.

Which PHP versions are affected?

According to Calif's technical writeup, the earliest affected code path it found dates to PHP 5.4.0. The PHP security team released the following fixed versions:

According to PHP, Linux distributions and LTS vendors received the patches in advance. If you use distribution packages, check your vendor's advisories.

On October 26, PHP released updated Windows builds, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, that fix a separate vulnerability in their bundled Brotli library, CVE-2026-111497. The PHP source and runtime versions are unchanged. For details, see our Brotli2Shell FAQ.

How widespread is PHP, and how many hosts are potentially affected?

According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Calif says it confirmed pre-authentication remote code execution against specific versions of popular PHP applications, including WordPress, Drupal, Joomla and Magento. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP.

Has exploitation been observed in the wild?

On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its mitigations as new attack vectors appear. watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts against both.

Amazon Threat Intelligence said it observed a php2shell exploitation attempt against its MadPot honeypot network on October 17, four days before public disclosure. It said it is unclear how the attacker obtained exploit information. More attempts followed on October 21, with payloads and infrastructure that Amazon says suggest multiple actors. Amazon says it is unclear whether any of the October 21 attempts would have succeeded against real-world systems. It also says php2shell "is now seeing broad exploitation attempts in the wild." It recommends starting investigations from at least October 17, not from the disclosure date.

On October 24, security researcher Adel Karimi reported successful exploitation against three honeypot servers running PHP 8.4.26. The exploit requests started shells that ran attacker commands. The report says the activity is consistent with CVE-2026-109618, and that it does not show use of CVE-2026-109619. It also says the traffic closely matches a family of publicly available proof-of-concept exploits. The honeypots used a single-worker Apache mod_php setup that was intentionally favorable to the exploit, and the report says the results are not a measure of how reliably the exploit works on other setups.

On October 26, Dream Research reported finding artifacts of a campaign that chained a custom php2shell exploit with CVE-2026-46300, a Linux kernel privilege escalation flaw known as Fragnesia that we covered in a separate FAQ. According to Dream, the attacker gained root access on 24 internet-facing firewalls from an unnamed vendor, then used the same chain on an internal firewall management server reached through one of them. Some of these systems "appeared to belong to a US government-affiliated environment." Dream said the php2shell exploit was not a public one and needed precise memory offsets for each version of the firewall software. Dream has not named the vendor or the affected versions, and Tenable has not independently confirmed this activity.

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show up.

This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.

— Dane Knecht 🦭 (@dok2001) October 21, 2026

Is there a proof-of-concept (PoC) available?

Code claiming to exploit these vulnerabilities is circulating publicly, but we have not verified that any of it works against CVE-2026-109618 or CVE-2026-109619. Unverified exploit code is sometimes laced with malware, so treat it with caution. The PHP Foundation said the PHP security team inspected PoCs that appeared after the leak but "did not identify any functional exploits at the time of release/public disclosure."

Since then, on October 26, Trail of Bits said it confirmed that php2shell exploits work against pre-patch releases of PHP 8.2 through 8.5, and its demo showed a shell on MediaWiki, Symfony, Laravel and phpBB.

Are patches or mitigations available?

Oui. The PHP security team released fixed versions on October 21 (see the table above). For end-of-life branches, it published minimal source backports for PHP 7.4 through 8.1, for those who build from source. If you run another end-of-life version, upgrade to a supported release or ask your distribution or LTS vendor.

The PHP security team says updating is the only complete fix. For organizations that cannot update immediately, PHP's advisory lists configuration changes that reduce exposure to specific attack paths but do not make an installation safe. For CVE-2026-109618, PHP lists setting memory_limit=-1 in a way applications cannot override. For CVE-2026-109619, it lists setting session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. PHP says to restart every PHP worker after these changes. PHP also suggests a container or cgroup memory limit as an availability boundary, though it says this is not a complete mitigation either.

Installing updated PHP packages does not patch PHP processes that are already running. Google Cloud's guidance, which includes input from Mandiant, notes that PHP-FPM, Apache and other services that run PHP keep the vulnerable code in memory until they are restarted. The same guidance says to capture worker memory from servers that show signs of probing before restarting them, because a restart erases that evidence.

CERT-EU also recommends that organizations that cannot update right away consider isolating internet-facing applications from public networks until a fix is applied and verified.

Cloudflare has deployed WAF rules for the known exploit vectors, available to all customers including the free tier. Cloudflare describes this as a stopgap only. The rules only cover traffic routed through Cloudflare.

Are there known issues with the new PHP releases?

PHP developers confirmed a regression in PHP 8.4.27 and 8.5.12 that can crash PHP processes in some applications that use the SimpleXML extension. It is tracked as php-src issue #24488. PHP developers traced it to a separate garbage collector fix included in those releases, not to the patches for CVE-2026-109618 or CVE-2026-109619. A fix has been merged into the PHP source but, as of October 26, has not shipped in a release.

On October 23, PHP published an informational advisory about what it calls an unlikely remote code execution vector in session upload progress, tracked as CVE-2026-115560. PHP says it only occurs under an unusual combination of configuration and application code. Until its next regular bugfix release, PHP suggests setting session.upload_progress.enabled=0, the same setting its CVE-2026-109619 advisory listed as a mitigation.

Have PHP vulnerabilities been exploited before?

Oui. Before php2shell, the CISA Known Exploited Vulnerabilities (KEV) catalog included three vulnerabilities in PHP itself. Two of them are known to have been used in ransomware campaigns:

The third, CVE-2012-1823, is a PHP-CGI flaw that CVE-2024-4577 later bypassed.

Have these vulnerabilities been added to the CISA KEV catalog?

Oui. On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog, with a remediation due date of October 29 for Federal Civilian Executive Branch (FCEB) agencies.

Has Tenable Research classified these vulnerabilities as part of Vulnerability Watch?

Oui. CVE-2026-109618 and CVE-2026-109619 have been classified as “Vulnerability of Concern” as part of Vulnerability Watch.

Is Tenable affected by these vulnerabilities?

Tenable Security Center and Tenable Enclave Security include PHP. Out of caution, Tenable released stand-alone security patch SC-202610.2 for both products on October 23. It updates PHP to 8.2.35. Details are available in TNS-2026-30 for Tenable Security Center and TNS-2026-31 for Tenable Enclave Security. Tenable customers can find patch release notes in this knowledge base article. Advisories for Tenable products are published at tenable.com/security.

Has Tenable released any product coverage for these vulnerabilities?

Oui. The following Tenable Nessus plugin is available for these vulnerabilities:

Tenable has also released local checks for PHP packages from Linux distributions, including Debian, Red Hat Enterprise Linux, Fedora and Gentoo. Additional distribution plugins will be released as vendors publish their fixes.

The following Tenable One Web App Scanning plugins are available for these vulnerabilities:

The following Tenable plugins are available to identify PHP installations and unsupported versions on affected systems:

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages for CVE-2026-109618 and CVE-2026-109619 as they're released. These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Do scans need to be authenticated?

For PHP installed on hosts, credentialed or agent scans give the most complete results. Tenable Nessus plugin 369483 uses both local and remote checks. An unauthenticated scan can detect a vulnerable version only if the host exposes its PHP version over the network, so results vary by host. For web applications, Tenable One Web App Scanning plugins 115719 to 115722 work without authentication and check the PHP version the application exposes.

How can Tenable customers find affected assets?

Tenable One Vulnerability Management customers can use the Software tab in Explore to find assets running PHP. Filter by Product is equal to PHP, then compare each asset's PHP version against the fixed versions above. The tab is populated from scan results, so run credentialed or agent scans regularly to keep it current.

Customers can also use Tenable One Attack Surface Management to find public-facing assets running PHP with this query: Programming Languages contains PHP.

Tenable Cloud Security now has a dedicated view for PHP2Shell. It lists every detected instance of these vulnerabilities, and customers can filter or group results to find affected virtual machines and images, including AMIs and container images. Customers can find it under Risk > Emerging Threats.

Tenable One customers can also use Tenable Hexa AI to find assets running vulnerable PHP versions in their organization and automatically create remediation tickets.

An example Tenable Hexa AI prompt:

Find all open vulnerability findings for CVE-2026-109618 or CVE-2026-109619 on assets seen in the last 14 days.

Create remediation tickets for all systems vulnerable to CVE-2026-109618 and CVE-2026-109619. Assign the severity level as Critical and the due date as Immediate.

Customers using the Tenable Hexa AI MCP can use the PHP2Shell Tenable Skill and other open-source AI agents available on the CyberAgents Exchange. The skill is read-only and produces a php2shell exposure report in HTML and PDF, with a CSV export.

En savoir plus 

• PHP Foundation on X: Advance notice of upcoming security release
• PHP.net Security Advisory: Critical remote code execution vulnerabilities
• PHP GitHub Advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
• PHP GitHub Advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
• PHP Foundation: Today's PHP security release and how we're strengthening PHP security
• Calif: php2shell technical writeup
• Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure in MadPot
• Adel Karimi: PHP2Shell exploitation observed: packet-to-process RCE evidence
• CERT-EU Security Advisory 2026-018

Retrouvez l'équipe Research Special Operations (RSO) de Tenable sur Tenable Connect pour poursuivre les discussions au sujet des dernières cybermenaces.

En savoir plus sur Tenable Onela plateforme de gestion de l'exposition pour la surface d'attaque moderne.