PHP2Shell Attacks Began Before Patches: Two Critical PHP RCE Flaws Targeted

PHP2Shell attacks began before emergency security patches became publicly available, according to Amazon Threat Intelligence. The activity targeted two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, which can potentially allow unauthenticated remote code execution on vulnerable web servers.

AWS identified an exploitation attempt on October 17, 2026, four days before PHP developers released fixes on October 21. Additional exploit attempts were detected around the disclosure window, raising concerns about how attackers obtained technical information before the coordinated security release.

Both vulnerabilities carry a CVSS v4.0 severity score of 9.2. They affect memory handling inside PHP itself, rather than a particular WordPress plugin, Drupal module or web application.

That makes the risk particularly important for organizations hosting PHP-powered websites, including WordPress, Drupal, Joomla and custom business applications.

However, reports of exploitation attempts should not be confused with verified successful compromises. AWS confirmed suspicious activity against its MadPot honeypot infrastructure, while CrowdStrike reported that successful in-the-wild exploitation had not been established in its October 23 assessment.

PHP maintainers released corrected versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should verify the PHP version actually serving web requests and update vulnerable production environments without delay.

For broader enterprise patching guidance, see our CVE and Vulnerability Exploits Security Hub.

Key Findings From the PHP2Shell Attacks

• Two critical flaws: CVE-2026-109618 and CVE-2026-109619 affect PHP’s internal request processing and memory management.
• Severity: Both are rated 9.2 under CVSS v4.0 and can potentially enable unauthenticated remote code execution.
• Early exploitation attempt: AWS identified suspicious PHP2Shell activity on October 17, four days before patches became available.
• Emergency patch release: PHP developers published fixed versions on October 21, 2026.
• Highest-risk deployment: Apache with mod_php has a demonstrated unauthenticated exploitation path, according to PHP security researchers.
• Wider exposure: PHP-FPM and other server APIs require assessment because the underlying vulnerabilities affect PHP runtime behavior.
• Important limitation: Exploit attempts and laboratory demonstrations are documented, but widespread successful real-world compromise has not been independently established.

PHP2Shell Attacks Began Four Days Before Emergency Patches

Amazon Threat Intelligence reported identifying a PHP2Shell exploitation attempt on October 17, 2026, in its MadPot threat-intelligence infrastructure.

The activity originated from an IP address associated with a commercial anonymization network while details of the vulnerabilities were still under a coordinated disclosure embargo.

The observation is significant because the PHP security team had not yet publicly released the fixes or full technical advisory.

Amazon could not determine how the actor obtained information about the vulnerability.

On October 21, AWS observed additional proof-of-concept activity as well as exploitation attempts originating from other anonymized infrastructure.

Those attempts occurred both before and after the scheduled public disclosure time of 14:00 UTC.

AWS described the post-disclosure activity as broad exploitation in the wild, indicating attackers were attempting to use the vulnerabilities against exposed systems.

However, the security company’s published analysis also stated that it was unclear whether the observed payloads would have succeeded against production environments.

This distinction is essential for accurate risk assessment.

Attempts to trigger a vulnerability, a reproducible laboratory exploit and a confirmed successful compromise represent different levels of evidence.

What Are CVE-2026-109618 and CVE-2026-109619?

PHP2Shell refers to two security vulnerabilities affecting PHP’s handling of HTTP requests and internal memory state.

Unlike application-specific bugs, these flaws exist in the runtime that executes PHP code.

That means updating a web application or installing a security plugin does not directly repair the affected PHP engine.

Researchers have demonstrated the possibility of code execution in controlled configurations.

Nevertheless, successfully developing a reliable exploit across different PHP versions, operating systems and deployment configurations can require additional technical work.

CVE-2026-109618: Memory Corruption During PHP Request Parsing

CVE-2026-109618 concerns an internal memory-management problem associated with PHP HashTable operations.

PHP uses HashTable structures to manage arrays and other collections, including values derived from incoming HTTP requests.

During request processing, a memory-allocation failure can leave an entry partially initialized while internal bookkeeping indicates that the entry exists.

Subsequent processing may then operate on memory that does not contain a properly initialized value.

This inconsistency creates a memory-corruption condition that can potentially be exploited.

The attack surface is important because affected parsing operations can occur before the intended web application begins executing its business logic.

As a result, application-level authentication checks do not necessarily protect a vulnerable runtime from requests that reach the affected code path.

Researchers have demonstrated exploitation under controlled conditions, but real-world exploit reliability depends on the target environment.

CVE-2026-109619: Use-After-Free and Stale PHP State

CVE-2026-109619 concerns memory-lifecycle problems involving persistent PHP worker state and request processing.

PHP web servers commonly reuse worker processes to handle multiple requests efficiently.

Although request-specific variables should be cleaned up between requests, some internal structures can persist or interact with longer-lived process state.

Researchers identified conditions in which stale references or improperly managed state could result in use-after-free behavior.

A use-after-free vulnerability occurs when software continues interacting with memory after it has been released.

Depending on surrounding conditions, the resulting corruption can cause a crash or potentially enable more serious exploitation.

CrowdStrike’s technical analysis describes several underlying memory-safety problems associated with the two PHP2Shell CVEs.

These findings explain why simple server-side input validation is not a complete mitigation for a runtime-level defect.

Updating PHP itself is the necessary permanent remediation.

Which PHP Versions Are Vulnerable to PHP2Shell?

The PHP development team released fixes across four supported release branches on October 21, 2026.

Administrators should confirm not only the displayed version number but also whether an operating-system distributor has backported the security fixes.

For example, enterprise Linux distributions may maintain security-patched packages whose version strings differ from the versions published directly by the PHP project.

A package should not be classified as vulnerable solely because its displayed upstream version is older, without checking the distributor’s security advisory.

However, unsupported PHP installations without verified patches should be treated as urgent migration priorities.

Why WordPress, Drupal and Joomla Websites Are Exposed

PHP powers many content-management systems and business applications.

WordPress, Drupal and Joomla all rely on PHP to execute server-side application logic.

Because PHP2Shell affects the underlying interpreter, a website can remain exposed even when its CMS core, themes and plugins are updated.

This distinction is particularly important for shared hosting and managed WordPress environments where website owners may not directly control the PHP version.

Administrators should review the runtime configuration supplied by their hosting provider.

A vulnerable PHP runtime can affect multiple applications sharing the same server or worker environment.

However, simply using WordPress does not prove that a website is vulnerable.

Exposure depends on the actual PHP runtime version, security backports and deployment configuration.

Our separate WP2Shell WordPress vulnerability guide covers a different security issue. Despite the similar names, WP2Shell and PHP2Shell should not be confused or treated as the same vulnerability.

Apache mod_php vs PHP-FPM: Which Servers Face the Greatest Risk?

The PHP security team identified Apache deployments using mod_php as a particularly serious exposure scenario.

With mod_php, PHP runs inside Apache worker processes.

Researchers demonstrated that a crafted request could reach affected PHP runtime code during request initialization, before normal application logic executes.

This makes ordinary application-level protections insufficient as a standalone fix.

PHP-FPM uses a different architecture in which a pool of PHP worker processes handles requests forwarded by a web server such as Nginx or Apache.

PHP-FPM remains relevant to the vulnerabilities, but exploit development and reliability can differ from mod_php deployments.

Other supported PHP server interfaces should also be reviewed against the official advisory.

Security teams should avoid assuming that Nginx automatically protects PHP applications simply because PHP is running through PHP-FPM.

The correct approach is to identify the PHP engine actually processing requests and verify that its package contains the security fixes.

PHP2Shell Disclosure Timeline: From Discovery to Emergency Release

The coordinated disclosure involved PHP maintainers and multiple security research organizations.

PHP maintainers originally planned a coordinated security release for October 22.

However, information about the vulnerabilities began circulating before the expected announcement.

That prompted the team to move the release forward to October 21.

The incident demonstrates the difficulty of coordinating emergency security updates when exploit research, public speculation and vendor preparation occur simultaneously.

What AWS Detected Before PHP2Shell Patches Were Released

AWS identified the earliest reported attempt in its MadPot infrastructure on October 17.

The observed activity came from anonymized infrastructure, making attribution uncertain.

On October 21, Amazon recorded additional proof-of-concept activity before the public patch release.

Later attempts involved multiple apparent sources and different payload approaches.

Amazon’s publication describes some indicators of compromise associated with this activity.

However, the listed IP addresses include shared anonymization infrastructure and should not automatically be treated as dedicated malicious servers.

Defenders should correlate these indicators with suspicious request patterns, timestamps and server behavior before drawing conclusions.

AWS also recommended reviewing POST requests involving the PHP_SESSION_UPLOAD_PROGRESS string as one relevant hunting signal.

The presence of this string is not, by itself, proof that exploitation succeeded.

It must be evaluated alongside other evidence such as unusual request patterns, worker crashes and unexpected process execution.

Did PHP2Shell Attacks Successfully Compromise Websites?

The public evidence supports active exploitation attempts and successful laboratory demonstrations.

It does not establish widespread successful compromise of real production websites.

AWS reported activity against honeypot infrastructure and described broad exploitation attempts following disclosure.

CrowdStrike, in an October 23 technical assessment, reported that it had not observed successful exploitation in the wild or identified a broadly reliable weaponized exploit.

Bitdefender similarly stated that its own telemetry had not recorded PHP2Shell exploitation attempts as of its October 22 publication.

These findings are not necessarily contradictory.

Different vendors monitor different systems, networks and customer environments.

One organization can observe attack attempts while another observes none within its own visibility.

Likewise, a controlled laboratory demonstration does not mean an attacker can reliably compromise every vulnerable server configuration.

The responsible conclusion is that exploitation attempts are documented, the vulnerability is critical and administrators should patch urgently without assuming every attempt resulted in code execution.

How to Check Your PHP Version and Exposure

Administrators should verify the runtime actually serving application traffic.

1. Check PHP on the Server

For a command-line PHP installation, run:

php -v

This shows the CLI PHP version, which may differ from the PHP version used by Apache or PHP-FPM.

Do not treat a patched command-line result as proof that every web-serving PHP runtime is patched.

2. Identify Running PHP Services

On a Linux server using systemd, inspect installed PHP services:

systemctl list-units --type=service --all | grep -Ei 'php|apache|httpd|nginx'

Review the configuration for the active virtual host and the worker pool serving each website.

3. Review Installed PHP Packages

On Debian or Ubuntu systems:

dpkg-query -W 'php*' 2>/dev/null

On RHEL-compatible systems:

rpm -qa | grep -Ei '^php|php-'

Check your operating-system vendor’s advisories to confirm whether backported fixes are included.

4. Identify the PHP Version in Containers

For a Docker container running PHP, identify the application container and run:

docker exec <container-name> php -v

Replace the placeholder with the actual container name.

Remember that running containers do not automatically receive patches when a newer image is published.

Rebuild and redeploy workloads with corrected base images, then verify the version inside the replacement container.

5. Confirm Every Production Environment

Check development, staging and production deployments separately.

Pay particular attention to older background services, administrative applications and forgotten containers that continue receiving HTTP traffic.

How to Patch PHP2Shell on Production Servers

The PHP project has emphasized that updating PHP is the only complete remediation.

Temporary filtering, application plugins and WAF rules may reduce certain attack opportunities but should not replace the security update.

Update to a Fixed PHP Release

For supported branches, use the appropriate security release:

• PHP 8.5.12 or newer.
• PHP 8.4.27 or newer.
• PHP 8.3.36 or newer.
• PHP 8.2.35 or newer, with attention to branch support status.

Use your approved package repository or hosting provider’s documented update process.

On managed hosting, confirm that the hosting provider has deployed the relevant security fixes to the web-serving PHP runtime.

Restart Affected PHP Worker Processes

After updating the packages, restart or roll affected services through the organization’s normal maintenance process.

Processes that remain running with the old runtime may not immediately benefit from newly installed files.

For containerized workloads, replace existing containers with new images that include the corrected PHP version.

Verify the Effective Version After Deployment

Run the relevant version checks again and confirm that active requests are being handled by patched workers.

Do not rely only on a successful package-manager transaction.

Monitor web application health, error rates and request-processing behavior following deployment.

Handle Unsupported PHP Versions

Systems using end-of-life PHP versions should be migrated to maintained releases wherever possible.

Some vendors may provide limited security backports for older branches, but those packages must be verified against official advisories.

If immediate patching is impossible, reduce exposure and isolate vulnerable services while planning an urgent supported upgrade.

PHP2Shell Threat Hunting: What Security Teams Should Monitor

Because the vulnerabilities involve memory-management behavior inside PHP workers, detection requires more than searching for a single malicious URL.

Suspicious HTTP Requests

Review unusual POST requests, abnormal session-upload activity and request sequences associated with server errors or worker termination.

AWS specifically identified the PHP_SESSION_UPLOAD_PROGRESS string as one useful investigation clue.

PHP Worker Crashes

Correlate unexpected PHP-FPM or Apache worker crashes with preceding HTTP requests.

A worker crash may result from ordinary application defects or resource pressure, so it is not automatically an indicator of PHP2Shell exploitation.

Unexpected Child Processes

Investigate instances where web-server or PHP worker processes unexpectedly launch shells, scripting interpreters or administrative tools.

Prioritize activity that deviates from approved application behavior.

File and Credential Changes

Review unexpected modifications to application directories, scheduled tasks, credentials and server configuration.

If evidence suggests successful compromise, apply the organization’s incident-response process rather than assuming that updating PHP alone removes any attacker persistence.

Correlated Logs

Combine web access logs, error logs, PHP runtime logs, process telemetry and network observations.

Individual indicators may be inconclusive, while correlated evidence can provide stronger confidence.

Can a Firewall or WordPress Security Plugin Stop PHP2Shell?

A web application firewall can help filter some suspicious requests, but it cannot guarantee complete protection against all possible PHP2Shell exploitation paths.

The vulnerabilities exist inside PHP rather than within an individual CMS plugin.

Likewise, patching WordPress core or removing a vulnerable theme does not correct the affected runtime.

Organizations should continue using layered defenses, including least-privilege PHP workers, access controls, network segmentation and security monitoring.

However, these measures complement rather than replace the required PHP update.

Where an exposed application cannot be patched promptly, restricting public access or temporarily disabling the service may be necessary while remediation is completed.

Confirmed vs Unknown: PHP2Shell Exploitation

Confirmed by Official Advisories and Research

• PHP2Shell includes CVE-2026-109618 and CVE-2026-109619.
• Both vulnerabilities are critical and can potentially enable unauthenticated remote code execution.
• PHP released emergency patches on October 21, 2026.
• AWS identified an exploitation attempt dating to October 17.
• Additional attempts were observed around and after the patch release.
• Researchers demonstrated code execution in controlled environments.
• Apache with mod_php presents a particularly serious demonstrated exposure scenario.
• The vulnerabilities affect the PHP runtime, not one specific CMS plugin.

Unknown or Not Universally Established

• That every observed exploit attempt successfully executed code.
• The total number of production websites compromised.
• The identity of the actor responsible for the earliest attempt.
• How the October 17 actor obtained technical information before disclosure.
• That every proof-of-concept repository contains a reliable working exploit.
• That one WAF signature blocks all potential attack paths.
• That every older PHP version string indicates an unpatched system despite possible vendor backports.

CyberUpdates365 Analysis

PHP2Shell demonstrates how vulnerabilities in widely deployed software runtimes can create risks across thousands of otherwise unrelated applications.

Because these weaknesses exist inside the PHP interpreter, organizations cannot assume that application-level updates alone are sufficient.

A fully updated WordPress installation may still depend on an outdated PHP runtime supplied by its hosting environment.

The incident also highlights the importance of coordinated vulnerability disclosure.

AWS observed attempted exploitation several days before the fixes were released, although the investigation has not established how attackers obtained the relevant information.

That makes public disclosure dates an incomplete starting point for incident investigations.

Administrators reviewing suspicious logs should consider whether activity began before the official release date.

Another important lesson concerns exploitability.

Security telemetry shows that attackers attempted to use PHP2Shell, while technical research indicates that reliable code execution can depend on the target’s runtime configuration and memory state.

These observations support urgent patching without requiring exaggerated claims of universal compromise.

For DevOps teams, inventory accuracy is critical.

Organizations may operate multiple PHP releases across virtual machines, managed hosting, container images and background services.

Updating one package or redeploying one website does not necessarily fix all exposed instances.

Security teams should therefore verify the runtime that serves each production application, check approved vendor patches and confirm that workers have been restarted or replaced.

Finally, the attack reinforces the need for incident-response readiness.

If unexpected PHP worker crashes, suspicious HTTP requests or unauthorized processes were observed during the relevant period, administrators should investigate those events separately from the patch deployment itself.

The central lesson is that PHP runtime patching, accurate deployment inventory and evidence-based threat hunting must work together to reduce PHP2Shell exposure.

Research Evidence

• Vulnerability name: PHP2Shell.
• Critical CVEs: CVE-2026-109618 and CVE-2026-109619.
• Severity: CVSS v4.0 9.2.
• Earliest AWS-observed attempt: October 17, 2026.
• Emergency fixes: Released October 21, 2026.
• Patched branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Most clearly demonstrated risk: Unauthenticated code execution against vulnerable Apache mod_php configurations.
• Other affected deployment types: PHP-FPM and additional PHP server APIs require assessment.
• Original research participants: Calif, OpenAI, Wiz Research and PHP maintainers.
• Threat telemetry: Amazon Threat Intelligence and other security providers.
• Successful laboratory exploitation: Demonstrated by researchers.
• Widespread confirmed compromises: Not established in the reviewed evidence.
• Permanent remediation: Install a verified PHP security fix.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name given to two critical memory-safety vulnerabilities in PHP that can potentially allow unauthenticated remote code execution on vulnerable web servers.

Which CVEs are associated with PHP2Shell?

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Both were addressed in PHP’s October 21, 2026 emergency security release.

Were PHP2Shell attacks observed before patches?

Yes. Amazon Threat Intelligence reported an exploitation attempt on October 17, four days before the official PHP patch release.

Has successful exploitation in the wild been confirmed?

Exploitation attempts and laboratory code execution are documented. The reviewed evidence does not establish widespread successful compromises of production websites.

Does PHP2Shell affect WordPress websites?

WordPress websites running affected PHP runtimes may be exposed. Updating WordPress alone does not repair vulnerabilities inside PHP itself.

Which PHP versions fix PHP2Shell?

The official fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with verified distributor security backports where applicable.

Does using Nginx or PHP-FPM automatically prevent exploitation?

No. Exploitability differs across configurations, but PHP-FPM and other runtime deployments still require assessment and patch verification.

What should administrators do immediately?

Identify active PHP runtimes, apply supported security fixes, restart or replace affected workers, validate production versions and investigate suspicious activity during the disclosure window.

Final Takeaway

PHP2Shell is a critical PHP runtime security issue involving CVE-2026-109618 and CVE-2026-109619.

AWS documented an exploitation attempt four days before emergency patches became available, followed by additional attempts around the October 21 release.

Although successful laboratory exploitation is established, widespread successful real-world compromise has not been confirmed by the reviewed evidence.

Administrators should upgrade vulnerable PHP installations to patched versions, confirm the runtime serving production websites and investigate relevant suspicious activity.

The immediate priority is to patch PHP itself. Updating a CMS, deploying a WAF rule or reviewing plugin security is not a substitute for correcting the vulnerable runtime.

Securing enterprise applications against remote code execution?

Our related technical report examines another critical application-server vulnerability and the importance of identifying affected versions before attackers exploit exposed services.

Read: Apache Tomcat Security Flaws and Enterprise Patching Guidance →

Official Sources

• PHP Security Team — October 21, 2026 Security Advisory
• AWS Threat Intelligence — PHP2Shell Exploitation Before Disclosure
• Wiz Research — PHP2Shell Vulnerability Research
• CrowdStrike — PHP2Shell Exploitability and Attack Observations
• Bitdefender — PHP2Shell Technical Advisory