PHP2Shell: two critical PHP flaws under attack, federal agencies given days to patch
CISA has ordered US civilian agencies to fix a pair of remote code execution bugs in PHP by October 29 after researchers caught attackers probing servers before patches existed.
Key points
- Attackers began hitting the PHP2Shell flaws four days before patches were available, after disclosure details leaked online ahead of the coordinated release on October 21, 2026.
- CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on October 26, with a federal patch deadline of October 29.
- Both flaws allow remote code execution with no login required; the CVSS score isn't confirmed in available reporting, so treat any circulating figure with caution.
- PHP runs roughly 70% of websites, with more than 5.1 million PHP hosts reachable over the internet according to VirusTotal.
- Perplexity's detection lead Adel Karimi recorded exploitation against an Apache mod_php server running PHP 8.4.26 over the weekend of October 24.
Two critical bugs in PHP, the scripting language that powers most of the web, are being attacked in the wild. CISA added them to its must-patch list on October 26 and gave federal civilian agencies three days to fix them.
The pair is tracked as PHP2Shell. CVE-2026-109618 triggers when PHP runs out of memory halfway through handling a web request and leaves half-built data behind for cleanup code to trust. CVE-2026-109619 involves internal bookkeeping that keeps pointing at memory after it's been freed, so the next request a PHP worker handles can act on leftover junk.
Bottom line: an attacker who can reach the server over the network can run their own code on it. No password needed. No account.
How did this get out before the fix?
It leaked. Details of both bugs appeared online before the coordinated disclosure window closed and before patches were ready. The PHP security team pushed fixes the next day, October 21.
Security firm watchTowr, which published the technical writeup, put it bluntly: this one got away from everybody. Cloudflare, Amazon, Hadrian, Previdian, Patchstack and Hadrian all logged scanning and exploitation attempts in the window before patches shipped, though they described those early tries as unsuccessful. Amazon's threat intelligence team said probing began four days before the fix landed.
The first confirmed working exploitation came over the weekend of October 24, when Perplexity's Adel Karimi reported honeypot evidence of code execution against an Apache server running PHP version 8.4.26. We reported that confirmation in detail on 28 October.
Who is at risk?
Anyone running a public PHP server that hasn't been patched. That's a very large pool.
| Fact | Figure |
|---|---|
| Share of websites using PHP | ~70% |
| PHP hosts exposed online | 5.1 million+ |
| Hosts with an open port | ~3.8 million |
| Federal patch deadline | 29 Oct 2026 |
First reported by BleepingComputer, the CISA directive technically binds only US federal civilian agencies under Binding Operational Directive 26-04. The agency is urging every organisation to treat the deadline as its own.
What should site owners do now?
Update PHP. The patched builds have been out since October 21. Hosting providers running shared PHP should've rolled fixes already, but single-tenant servers, container images baked weeks ago, and anything built on an older long-term-support branch need checking by hand.
There's a second problem waiting. On October 23 the PHP team shared mitigation guidance for a separate remote code execution bug, CVE-2026-115560, which has no patch yet and is exploitable on servers running an unusual mix of configuration and application code. Admins should read the PHP project's advisory and apply the workaround if their setup matches.
My read: the leak is the story here. A critical PHP bug with no login requirement is bad enough on its own. One whose details were public before the fix shipped, on software running most of the web, is the kind of event that keeps incident responders working through the weekend. Webshell discoveries on unpatched hosts will keep surfacing for weeks.
