Update · October 22, 2026, 6:50 PM UTC
The National Security Agency said on October 22 that organizations should prioritize vendor patches for the PHP2Shell flaws, inventory services relying on vulnerable PHP versions, and take systems offline where an immediate update is not feasible. The Cyber Security Agency of Singapore issued a parallel alert on October 22, and Microsoft told customers to upgrade all PHP deployments, including virtual machines, containers, base images and platform runtimes, to the patched releases.
AP reported on October 22 that the FBI cyber division is warning the bugs could allow remote code execution compromising sensitive data and networks, and that some government websites in Europe and the U.S. — including the Finnish government’s — have been taken offline or partially offline while patching. No confirmed compromises have been reported.
Sansec’s technical write-up, published October 22, concludes that exploitation requires specific knowledge of each target server and particular conditions on it, making indiscriminate mass exploitation less likely than first feared. NCSC-NL updated its guidance with the same day, reiterating that all PHP installations serving web requests remain at risk.
The affected vulnerabilities are CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.
PHP shipped emergency fixes on October 21 for two critical runtime flaws collectively dubbed PHP2Shell, after attack traffic against the bugs was already hitting detection systems. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2.
The flaws allow an unauthenticated attacker to execute arbitrary system commands through a single ordinary HTTP request, without needing credentials or a vulnerable application. CrowdStrike verified that one anonymous POST request can make an Apache mod_php worker spawn a shell and run attacker-specified commands. Because the bugs sit in the PHP runtime rather than in application code, sites built on WordPress, Drupal, Joomla and other PHP-based platforms are exposed.
The release was accelerated: UVCyber said detailed technical information leaked publicly on October 20, two days ahead of a planned October 22 coordinated disclosure, prompting PHP to push out patches on October 21.
Who is affected
Every PHP installation serving web requests on a version older than the fixed releases is affected, including deployments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Cyberscoop reported that CERT-EU believes the flaws could reach every PHP version from 5 onward, extending the risk to legacy environments.
TechTarget estimated that roughly 22 million internet-facing PHP servers are at risk.
Exploitation attempts underway
Attack traffic predates the patches. Fastly said it has evidence of active attacks exploiting the flaws before public disclosure, and Kaspersky reported exploitation attempts were observed even before the emergency releases. A Wikipedia summary of vendor telemetry said Cloudflare detected early attempts and deployed temporary web application firewall rules, while watchTowr recorded in-the-wild exploitation through its honeypot network by October 21.
Government confirmation lags the vendor telemetry. The same summary reports that, as of October 21, CISA had not observed successful exploitation and that the flaws were not in the Known Exploited Vulnerabilities catalog. No attribution for any pre-disclosure exploitation has been publicly assigned.
What to do
Vendors agree that updating the PHP runtime itself is the only complete fix, and CrowdStrike cautions that configuration changes alone are insufficient because the root cause is core PHP memory corruption. The fixed versions released October 21 are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
For PHP 7.4, 8.0 and 8.1, the PHP team published minimal source backports and advises users to apply vendor backported packages or move to a supported branch, noting that upstream support for 8.1 and older has ended.
The Dutch national cyber security center has operational guidance in its php2shell GitHub repository, recommending immediate upgrades to the fixed versions or vendor backports. Malwarebytes reported that organizations are taking maintenance windows and temporarily pulling high-risk internet-facing systems offline while patching.
Fastly urged customers to urgently inventory and patch all servers running mod_php or php-fpm. CrowdStrike and Fastly both confirmed reliable end-to-end exploits against those configurations, with CrowdStrike demonstrating cross-architecture exploitation that defeats ASLR on ARM.
What remains unclear
How many servers have actually been compromised, versus merely scanned, is not yet known. Fastly also cautioned that the current patches cover only the bugs found and exploited to date, so additional flaws in the same runtime code may surface. Patch adoption across the estimated 22 million exposed servers over the coming weeks is another open question.
One Response