Two critical flaws in the PHP interpreter itself, dubbed PHP2Shell, may let remote attackers execute code on any server running PHP. Details leaked ahead of the embargo, fixes ship today, and we are already detecting exposed targets.
What's the vulnerability?
CVE-2026-109618 and CVE-2026-109619 are two remote code execution vulnerabilities in PHP core. The PHP security team rates both CVSS v4.0 9.2 (php.net). The figure of 10.0 that circulated earlier came from the leak, not from PHP.
Because the bugs sit in the interpreter rather than in any one application, every PHP-based stack is in scope: WordPress, Drupal, Magento, Laravel and custom code alike (Patchstack). CERT-EU notes the score suggests unauthenticated remote code execution is possible (CERT-EU).
The root cause, affected component and attack path have not been published yet. One early report describes CVE-2026-109618 as a use-after-free (SecurityWeek). PHP will publish full details with the release.
Leak and exploitation status
On 20 October, a public post revealed both CVE IDs and a disclosure date of 22 October, before the embargo lifted (The Hacker News). PHP responded the same evening by pulling its security release forward to Wednesday, 21 October 2026 at 14:00 UTC (php.announce).
The leak did not describe how the flaws work, and no verified public PoC exists at the time of writing.
Reports on in-the-wild exploitation conflict. watchTowr and Huntress had seen none as of 21 October, while Patchstack reports active exploitation incidents (watchTowr, Patchstack). Either way, mass exploitation is expected soon after the patch lands.
Which versions are affected?
PHP will publish the exact affected and fixed versions with the release. Public reporting so far suggests:
- All PHP versions from PHP 5 onward may be affected (unconfirmed by PHP)
- Fixes are coming only for the supported branches: 8.2, 8.3, 8.4 and 8.5
- PHP 8.1 and older are end-of-life and will not receive a fix
The latest releases before the patch are 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Mallory counted roughly 884,000 internet-facing hosts advertising PHP 8.1 or older, which will stay exposed after today (The Hacker News).
What should you do?
Upgrade PHP as soon as the fixed releases are out at 14:00 UTC today. Until then, prepare:
- Inventory every PHP runtime you run, including containers, base images, shared hosting and forgotten staging hosts.
- Stage the upgrade for each supported branch (8.2 to 8.5) so you can roll it out within hours of release, not days.
- Plan for end-of-life runtimes. PHP 8.1 and older get no fix. Migrate them to a supported branch, or take them off the internet.
No official workaround exists. In the meantime:
- Isolate internet-facing PHP applications behind a VPN, SSO or IP allowlist where you can (CERT-EU)
- Put a WAF in front of legacy apps that cannot be upgraded quickly
- Alert on php-fpm, php-cgi, httpd or apache2 spawning shells, interpreters or download tools such as curl and wget
These measures reduce risk but do not replace the patch. If you find signs of compromise on an unpatched host, rotate the credentials it held: database passwords, API keys, application secrets and cloud tokens.
How Ethiack helps
Ethiack's continuous testing now detects php2shell across your attack surface. We identify every internet-facing PHP runtime you expose, including hosts outside your known inventory, and flag those still running vulnerable or end-of-life versions.
As technical details and fixed versions become public, we validate which assets are actually exploitable, so your team can patch the right systems first.
References
- PHP: advance notice of security release (php.net)
- PHP security release announcement (php.announce)
- CERT-EU Security Advisory 2026-018
- watchTowr: PHP RCE FAQ
- The Hacker News: PHP2Shell
- SecurityWeek: PHP2Shell mass exploitation looms
- Patchstack: PHP major vulnerability alert
Early signal first detected by Ethiack Zero. Validate your exposure before attackers do. Try Ethiack: 30-day free trial, no commitment.