PHP2Shell: two critical vulnerabilities in PHP that affect millions of web sites

The 20-21 October 2026, were released publicly two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that permitten Remote Code Execution (RCE) without authentication. Gravity is maximum: CVSS 9.2/10. The vulnerabilities affect PHP versions 5.4 to 8.5, which potentially encompasses millions of websites across the web. What is more alarming: the active exploitation was observed in the nature from the October 21, 2026, just hours after the disclosure to the public. For organizations that are running PHP in production in the whole of Latin america, this represents an immediate threat. The critical question is not ‘what could be attacked?’ but ‘how do we know if WE are ALREADY being attacked at this time?’

What are they exactly CVE-2026-109618 and CVE-2026-109619?

These are two vulnerabilities that are distinct in the core of PHP, but both allow the same thing: execution of arbitrary code on the server without requiring authentication.

CVE-2026-109618: memory corruption Vulnerability (Out-of-Memory Handling)

PHP processes requests to HTTP. When a request arrives, PHP stores it in memory for processing. The vulnerability occurs in how PHP handles cases where the memory is exhausted. Instead of fail cleanly, PHP stops data of the request partially initialized. Then, routines cleanup of the code tries to process that state of memory corruption, and that corruption exists a path to execution of arbitrary code.

CVE-2026-109619: Vulnerability (use-after-free (Stale Global State)

PHP maintains references to global data requests. When the backing memory (the underlying memory where that data is stored) is released, those references are pointing to memory that is no longer valid. If an attacker can manipulate what happens in this freed memory, it can corrupt the references global and achieve RCE.

Both vulnerabilities are critical because:

1. Do not require authentication: Anyone on the internet can exploit them
2. Remote: exploited remotely via HTTP
3. Complete agreement: RCE = total control of the server = data theft, installation of malware, shutdown, etc

Why does this matter? The real impact

Potential reach

• PHP feed 77% of all web sites with server known (according to W3Techs, October 2026)
• Potentially 2+ million websites vulnerable if they run PHP 5.4-8.5 without patching
• Includes: WordPress (64% of CMS), Drupal, Magento, Laravel, Symfony, and countless custom applications

Evidence of active exploitation

• 17 October: Amazon Threat Intelligence detected attempts of exploitation in MadPot telemetry (4 days PRIOR to disclosure)
• October 21: WatchTowr observed exploitation through its global network of honeypots
• October 21: Cloudflare reported signs of exploitation in real traffic trying to evade their protections
• 23 of October: Dozens of organizations government/company took the sites offline to patch emergency

This means: there is Already attacking in nature by exploiting these vulnerabilities NOW.

Impact in different types of organizations

E-commerce: Access to customer data, card numbers, personal information
Banks/Fintech: Access to trading systems, financial data
Government: Access to public services, sensitive information
Hospitals: Access to patient records, management systems
Corporations: Access to source code, intellectual property, communications

How does one solve this?

The reality is uncomfortable: there is no mitigation configurational complete. PHP Foundation is explicit: ‘no configuration change fully mitigates these vulnerabilities.’

Available options (in order of effectiveness):

Option 1: Patching immediately (The real solution)

• PHP 8.5.12 or higher
• PHP 8.4.27 or higher
• PHP 8.3.36 or higher
• PHP 8.2.35 or higher
• Older versions (5.4-8.1): No patches available – you must migrate

This requires:

• Validate that the new versions are compatible with apps
• Run test suite full
• Deploy to staging, validation, deploy to production
• For many organizations: 2-5 hours of work

Option 2: access Restriction (Interim measure)

• If you CAN’T patch immediately: limited access to the internet in systems vulnerable
• Example: Only local access, behind VPN-restricted
• This REDUCES risk but does NOT eliminate it (if there is internal access, it is still vulnerable)

Option 3: Web Application Firewall (WAF) rules (Interim measure)

• WatchTowr and Cloudflare have published rules temporary
• Detect and block attempts at exploiting known
• Effective against exploits to the public, but attackers can adjust
• It is not a permanent solution

Timeline recommended:

• Today: Identify all systems that run PHP vulnerable
• Today+1 hour: Apply WAF rules if you can’t patch immediately
• Today+2 hours: Begin testing of patches in staging
• Today+4-6 hours: Deploy patches to production
• Check: to Confirm which patches have been applied and systems work

How do I know if I’m being attacked?

Without automatic monitoring, it is almost impossible to know. The signs could be:

• Unusual behavior of the server (high CPU, high memory)
• New files in web directories
• Logs of Apache/Nginx with requests HTTP suspects
• Outgoing traffic unexpected
• Changes in rates of application error

But all of these signs may ALSO be caused by other problems. No automatic correlation of events, it is difficult to distinguish ‘attack PHP2Shell’ ‘server under load’.

How is it related to the automatic management of incidents?

This incident PHP2Shell illustrates why teams need detection and automated response to threats:

Management manual:

1. Attacker exploits PHP2Shell server (time unknown)
2. Installs backdoor, malware, begins exfiltration of data
3. Weeks later, someone discovers anomalous behavior
4. Research, discovery of breach
5. Damage control, user notification, legal costs,

With automatic detection smart:

1. Attacker tries to exploit PHP (same time)
2. System detects HTTP request suspect (1 second)
3. [24Brains validates**: pattern known PHP2Shell attack (10 seconds)
4. Scale automatically to security team (15 seconds)
5. Immediate response: isolation of the server, investigation, and mitigation in minutes
6. Breach potential prevented

Difference: weeks of data theft vs. detention in minutes.

How can you help 24Cevent?

Although 24Cevent is incident management, IT, the principles apply directly to detection of security threats:

1. Automatic detection of patterns of attack

24Cevent can monitor the logs of Apache/Nginx, looking for patterns of exploitation PHP2Shell known. When it detects a match, the alert immediately.

You don’t expect the attacker finish your operation. What you’re seeing in the first few seconds.

2. Automatic correlation to identify compromi

If you notice:

• HTTP Request suspicious +
• Change file in the web directory +
• CPU spike in server +
• Outgoing traffic anomalous

No correlation = 4 alerts disjointed = confusion.

With correlation smart = 1 incident: ‘Likely PHP2Shell’exploitation attempt on server-prod-01’.

3. 24Brains running automatic validation

When it detects a suspected attack, 24Brains can automatically:

• Run the scan file integrity (are there any backdoors?)
• Review logs of access (what requests were successful?)
• Validate PHP version (what is parchada?)
• Collect forensic evidence (timestamps, IPs attackers)

Everything in seconds, without waiting for an engineer to investigate manually.

4. Scaling auto-immediately

At the time you are confirming attack:

• Minute 0: Notification to security engineer on-call
• Minute 1: If you do not respond, scale, security manager
• Minute 2: Active run book server ‘committed’ (network isolation, forensic analysis)
• Minute 5: If you are still researching, it notifies compliance/legal

Don’t wait for someone to check email. It is automatic.

5. Notification-channel context

In place of generic email, 24Cevent notified automatically:

• Security engineer: ‘PHP2Shell’exploitation detected on server-prod-01. Request IP: 203.0.113.45. Suspicious files found: /var/www/shell.php. Action: server isolated from the network.’
• Manager of IT: ‘Security incident detected. 1 server affected. ETA response 5 minutes.’
• CEO: ‘Security incident on production server. No user data exfiltration detected yet. Forensics in progress.’

Each person gets the right message in the right channel at the right time.

6. Complete traceability for forensic analysis

Since the first byte malicious until resolution:

• 14:23:15 UTC: Malicious HTTP request detected (PHP2Shell payload)
• 14:23:16 UTC: Request pattern correlated as known attack
• 14:23:20 UTC: 24Brains validation: PHP version vulnerable, payload suspicious
• 14:23:25 UTC: Incident escalated, security team notified
• 14:23:30 UTC: File integrity check: backdoor found at /var/www/shell.php
• 14:24:00 UTC: Server isolated from the network
• 14:25:00 UTC: Forensic analysis begins
• 15:00:00 UTC,: Root cause confirmed, that attacker IP identified, mitigation complete

For lawyers, regulators, auditors: this is a test of rapid response and systematic.

Frequently asked questions

How many web sites in the world are really vulnerable?
Unknown exact, but potentially millions. Only ~25% of the web has been updated to PHP 8.0+ according to statistics from W3Techs. Many sites legacy still running PHP 5.6 or 7.x.

Is it enough to WAF rules to be safe?
No. Are interim measures. Protect against exploits to the public, but attackers sophisticated can evade. Patching is the only real solution.

What if my site is behind a WAF, am I protected?
Partially. WAF blocks requests to known attack, but does not protect against zero-day or variants not documented. Patch is still required.

What happens if I can’T patch for days?

• Implements WAF rules
• Limited access to the internet if possible
• Implements monitoring aggressive changes of files
• Prepare rapid response plan if attack is detected
• Plans window maintenance ASAP

How this affects only PHP?
No. It is a reminder that ANY language/framework can have critical vulnerabilities. Always keep systems patched.

Sources

• Critical Vulnerabilities in PHP (PHP2Shell) – Cyber Security Agency of Singapore
• PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619 Fixes – WatchTowr
• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws – The Hacker News
• Black October: why bugs discovered by OpenAI tech are creating a cyber emergency – Axios
• Critical PHP web security flaws spark a global alarm – CNBC