Key points
- PHP released emergency updates on October 21 for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale.
- The NSA and CERT-EU advised organizations to take unpatched, internet-facing PHP applications offline or isolate them from public networks.
- Approximately 48.5% of PHP websites run on versions that have reached upstream end of life and do not receive routine security updates.
Two memory-safety flaws in the PHP engine, collectively known as PHP2Shell, allow attackers to execute code on web servers without logging in. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS v4.0 scale. PHP has confirmed an exploit for Apache’s mod_php in which an unauthenticated request triggers the attack before any application code executes. Other configurations, such as PHP-FPM, have different exploitation requirements but remain at risk.
By the numbers
- 9.2: The CVSS v4.0 severity rating for both CVE-2026-109618 and CVE-2026-109619.
- 69.3%: The share of websites using PHP as their server-side language, according to W3Techs data from October 21.
- 48.5%: The estimated portion of PHP websites running on branches that no longer receive routine security updates from the PHP project.
What the figures mean
The severity scores reflect the critical nature of the remote code execution flaws. With nearly seven out of ten websites relying on PHP, the attack surface is vast. The fact that almost half of these sites run on end-of-life versions complicates the patching process significantly. Organizations using older PHP branches must weigh compatibility issues against the risk of remote code execution. The widespread adoption of PHP makes this a systemic risk for the broader web infrastructure.
View the original post on X
View the original post on X
What to watch
Cloudflare reported observing active attack traffic targeting these vulnerabilities, with attackers modifying payloads to evade detection. Security researcher Andrew Case noted the severity of the situation ahead of the patch release. The scramble to patch is ongoing while adversaries test their options. Agencies like the NSA and CERT-EU have urged immediate action, including taking systems offline if patching is not immediately possible. This indicates active interest from attackers in exploiting these flaws.
Infection and persistence in general
Teams usually monitor web server access logs for unusual request patterns or failed memory allocations that may indicate exploitation attempts. Analysts should check for unexpected process spawns or new files created in web directories, which often signal successful remote code execution. Persistence mechanisms might include web shells or backdoors planted by attackers to maintain access. Investigating system integrity and reviewing recent changes to server configurations helps identify compromise indicators. Regular audits of running processes and network connections are essential for detecting lateral movement.
What to do and how to stay safe: PHP
- Verify your PHP version against the patched releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and apply updates immediately.
- Take internet-facing PHP applications offline or isolate them from public networks if you cannot patch them immediately.
- Monitor web server logs for signs of exploitation, such as unusual requests or payload modifications attempting to evade protections.
- Review your infrastructure for any PHP-FPM, Apache mod_php, or other affected configurations to ensure comprehensive coverage.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by the PHP2Shell vulnerabilities?
All installations serving web requests are at risk, with affected paths reaching back to PHP 5.4, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Is there a fix available for these vulnerabilities?
Yes, PHP released emergency patches on October 21 for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which address both CVE-2026-109618 and CVE-2026-109619.
What do the NSA and CERT-EU recommend for organizations that cannot patch immediately?
They advise taking affected systems offline or isolating applications from public networks until they can be fully mitigated with the latest patches.
