PHP2Shell stopped being a warning and became a confirmed attack on Monday, October 26, 2026. That is the day CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog and told federal civilian agencies to fix both by October 29, according to The Register. Five days earlier, the PHP project had shipped emergency patches for the language behind a huge share of the web, and some sites went dark while operators updated. If your enterprise runs a public website, a customer portal, a CMS, or a vendor appliance with a web console, PHP2Shell is your problem this week.
This guide covers what is confirmed, where PHP hides inside real networks, and how to contain the risk in 72 hours. It comes from ibm/SEIMless, home of Exodus QRN, because the most durable fixes live in the network, not only in the patch queue.
Quick answer
What is PHP2Shell? PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2, that let an unauthenticated attacker execute code on a web server with a crafted request. PHP released fixes on October 21, 2026 (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35), and CISA now lists both flaws as exploited.
Key takeaways
- CISA’s KEV listing on October 26 turns PHP2Shell from “patch soon” into “patch now” for every organization.
- Exploitation attempts began about four days before disclosure, so the patch window was effectively negative.
- The hard part is the runtime blind spot: few enterprises can list every place PHP executes.
- Egress control, segmentation and detection limit the damage when a patch lags.
What PHP2Shell Is and Why CISA’s KEV Listing Changes the Conversation
PHP2Shell names two flaws in the PHP engine itself, not in a plugin or a theme. Both carry a CVSS v4.0 score of 9.2 and allow remote code execution without a login, as Tanium’s incident write-up explains. Per operational notes tracked by CERT-EU and mirrored in the NCSC-NL repository, PHP describes CVE-2026-109618 as code execution through out-of-memory corruption during request cleanup, and CVE-2026-109619 as code execution through stale request-owned state reused by a later request on the same worker. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code even runs.
Fixed releases arrived on October 21, a day early because details leaked before the scheduled disclosure. The NSA warned that flaws like these often give attackers a direct path to the server file system or database.
The KEV listing matters because CISA only adds a vulnerability when it has evidence of real exploitation. The deadline binds federal agencies, but CISA also urged everyone else to prioritize the fixes. It is the logic behind risk-based vulnerability management: exploitation evidence outranks raw CVSS scores.
PHP2Shell Timeline: 68 Days From AI Discovery to the Exploited List
From first discovery to the KEV listing took 68 days, and the public part took five.
| Date (2026) | Event |
| Aug 19–24 | Wiz finds the first flaw, then reports the bugs to the PHP security team (timeline per FourWeekMBA) |
| Sep 21 | PHP acknowledges the reports and starts coordinated fix work |
| Oct 17 | Amazon Threat Intelligence records the first exploitation attempts, four days before disclosure (BleepingComputer) |
| Oct 21 | PHP ships fixed releases; CISA and NSA issue alerts; Cloudflare switches on WAF protections about nine hours earlier (HackerNoon) |
| Oct 22 | New York DFS tells regulated entities to patch immediately (DFS industry letter) |
| Oct 23 | PHP publishes an advisory on a separate, configuration-dependent flaw, CVE-2026-115560 (The Register) |
| Oct 24 | A researcher records 35 successful shell executions on honeypots (honeypot report) |
| Oct 26 | CISA adds both CVEs to KEV (CISA alert); federal deadline Oct 29 |
Black October: Why AI Discovery Compresses Your Patch Window
PHP2Shell arrived inside a cluster of disclosures that security people now call “Black October.” The headline detail is how the bugs were found. According to OpenAI, the security firm Calif used the GPT-5.6 Sol model to identify one of the flaws as part of OpenAI’s Patch the Planet initiative, while Wiz independently found and reported both. The bugs had reportedly sat in PHP for about 14 years.
That is a milestone for defenders and a warning in the same breath. Former CISA Director Chris Krebs told CNBC on October 23 that roughly 3% of all critical vulnerabilities ever discovered were found in the past month, as 24/7 Wall St reported. Discovery is scaling faster than most patch programs can. Our earlier analysis of the record 1,413-patch Tuesday called this the patch-volume paradox, and PHP2Shell is its sharpest example yet: a bug that took 14 years to surface took hours to weaponize.
The practical lesson is that your safe window now starts before the advisory. If Amazon saw probing on October 17, then “we patch within 30 days” is no longer a policy. It is a bet. CISA’s warning about botnets and VPN infrastructure used by state-linked actors shows how fast scanning at scale follows any public proof of concept.
Separating Confirmed Exploitation From Noise
Good incident response depends on knowing which claims are solid. Here is what the evidence supports today.
- Confirmed: CISA considers both flaws actively exploited and has added them to KEV.
- Observed in controlled settings: On October 24, Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The activity matched CVE-2026-109618 only, on a favorable single-worker setup.
- Observed at scale: Delft University’s threat intelligence lab tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries, and 171 moved beyond probing to send exploit code or droppers.
- Walked back: Sophos revised an early assessment after concluding it had seen scanning and failed attempts, and Palo Alto Networks withdrew a claim tying the flaws to a European government intrusion.
- Not yet public: CISA has not named compromised organizations, and American Banker found no U.S. bank or credit union that had publicly reported one.
Attempts are not breaches, and officials in several countries said early on that they had not seen a successful intrusion. But Cloudflare’s CEO described attempts jumping from thousands to millions within hours, per AP coverage. Treat PHP2Shell as exploited, and avoid claiming a compromise you cannot prove.
The Runtime Blind Spot: Where PHP2Shell Hides in Your Environment
We use the term runtime blind spot for the gap between where an organization believes a runtime executes and where it actually does. PHP2Shell exposes that gap instantly, because PHP rarely lives only where the web team expects it.
- Public sites and CMS platforms built years ago by an agency and never inventoried.
- Customer, patient and partner portals that quietly share one PHP stack.
- Hosting and co-location guests where a tenant, not your team, owns the runtime. See our guide to choosing hosting and co-location.
- Vendor products that embed PHP in a management console. The NCSC-NL status list, as of October 23, tracked entries for products including Broadcom Symantec Endpoint Protection Manager, NetApp ONTAP, Cisco Expressway and Cisco ISE Portal Builder, with statuses ranging from vulnerable to under investigation.
Updating a theme or plugin will not fix an engine-level flaw, and PHP 8.1 and earlier were reported to have no official fixes. runZero’s PHP discovery guide helps find hidden installations, and NIST SP 800-218 frames the discipline of knowing what your software contains. If you cannot name every place PHP runs, you cannot say you are patched.
Why Patching Alone Is Not Enough
Patching is the only full fix, but it is rarely instant. Vendor-embedded copies wait on vendor releases, and workers must be restarted for changes to take effect, as SOCRadar’s response guide notes. Configuration mitigations are partial: disabling session.upload_progress blocks one path for CVE-2026-109619 and does nothing for CVE-2026-109618, per Tanium. Memory and request-size limits help with CVE-2026-109618, per runZero.
Edge filters are not a guarantee either. The Register reported an exploit that bypasses protections designed to stop remote code execution, and the third flaw, CVE-2026-115560, will not get an emergency fix. In the FBI breach analysis we called this the virtual-patch illusion: a WAF rule blocks the known exploit string while vulnerable code stays live.
That is why the strongest PHP2Shell programs pair patching with controls that work even when a patch is late. NIST SP 800-40 Rev. 4 supports this view by treating patching as a risk-management process, with compensating controls for assets that cannot be updated on schedule.
Network-Layer Defense Against PHP2Shell With Exodus and ibm/SEIMless
A PHP worker that starts running attacker code typically tries to call home. In the honeypot data, attackers immediately attempted outbound contact using PHP, curl and wget, per The Register. That behavior is the opening for network defenders. The table below maps each control to a PHP2Shell failure mode.
| Control | How it helps with PHP2Shell | ibm/SEIMless service |
| Default-deny egress | Stops a compromised web tier from fetching tools or reaching command servers | Exodus NxtGen Firewall |
| Zero-trust segmentation | Keeps the web tier from reaching databases, admin networks and backups (NIST SP 800-207) | Zero Trust Content Security |
| Anomaly detection | Flags unusual behavior around web servers so responders see it early | Exodus Aria ADR |
| Endpoint visibility | Spots PHP workers spawning shells or download tools | EDR for endpoints |
| Key custody | Keeps keys and secrets off the web server so a shell cannot read them | Exodus Key Management |
| Encryption of stored and moving data | Makes stolen files and intercepted links far less useful | Data at Rest and Data in Motion |
| Recovery | Restores clean systems if a web server must be rebuilt | Backup and recovery and private and hybrid cloud |
Firewall hygiene underpins all of this, and NIST SP 800-41 Rev. 1 remains the practical reference for policy design. Our piece on network edge security in 2026 explains why the perimeter decides these fights, and our immutable backups guide covers recovery. ibm/SEIMless is vendor-agnostic, so we build these layers around the systems you already run.
A 72-Hour PHP2Shell Response Plan
- Hour 0–4: Name your exposure. List every internet-facing service that runs PHP, then every vendor product with a PHP-based console. Use the NCSC-NL list and your vendor portals.
- Hour 4–24: Patch what you control. Move internet-facing systems to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and restart every worker so the fix takes hold.
- Hour 4–24: Isolate what you cannot patch. Follow CISA and NSA guidance and take unpatchable systems offline, or restrict access to known sources.
- Hour 24–36: Close the exits. Block outbound connections from web servers by default and allow only named destinations.
- Hour 24–48: Hunt. Look for shells, curl or wget launched by php-fpm, php-cgi, httpd or apache2, and for unusually large multipart uploads.
- Hour 36–48: Rotate secrets. If any exposed server was reachable before patching, rotate database credentials, API keys and session secrets stored on it.
- Hour 48–60: Add temporary shields. Apply vendor WAF rules, request-size limits and PHP hardening, and label them as stopgaps, not fixes.
- Hour 60–72: Brief leadership and vendors. Report what is patched, what is isolated and what is waiting on a vendor, and ask each vendor for a written status.
Map the work to NIST CSF 2.0 functions so auditors see a framework, not a scramble, and keep evidence aligned with NIST SP 800-53 flaw-remediation controls. Our Cybersecurity Awareness Month action plan frames the same work as reduce, replace, recover.
PHP2Shell Risk in Financial Services, Healthcare and Insurance
Regulated sectors move first on PHP2Shell. New York DFS told its regulated entities on October 22 to patch immediately and pointed them to its recent heightened-threat guidance. The American Hospital Association published a same-week advisory for hospitals, and the NSA, FBI and CISA all urged rapid action.
Three questions cut through the noise. Which vendors run PHP on our behalf? Which portals hold regulated data? How fast can we prove a server is clean? Healthcare teams can anchor on the HIPAA Security Rule, and financial teams on the FFIEC IT Examination Handbook. Our post on third-party cyber risk shows how a supplier’s weakness becomes yours, and the CISA StopRansomware resources matter because web shells often precede extortion.
The Quantum Angle: Why a Web Shell Is a Harvest-Now Problem
A web shell can read configuration files, TLS private keys and encrypted archives. Attackers who copy those today can wait for stronger tools tomorrow, the pattern behind harvest now, decrypt later. The fix is to keep long-lived secrets off exposed servers. Our post-quantum migration playbook and the Executive Order 14412 deadline guide lay out the path, and NIST IR 8547 sets the transition timeline. For certificate-heavy estates, see our certificate lifecycle management guide.
Frequently Asked Questions About PHP2Shell
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 and let an unauthenticated attacker run code on a web server with a crafted request. PHP fixed them on October 21, 2026.
Is PHP2Shell being exploited in the wild?
Yes. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026, with an October 29 deadline for federal civilian agencies. CISA has not said which organizations were compromised.
Which PHP versions fix PHP2Shell?
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported branches are reported to have no official fix, so they need a supported upgrade, a vendor-supported build, or isolation.
Can a web application firewall alone protect me from PHP2Shell?
No. A WAF can reduce exposure, but researchers have reported bypasses of protections designed to stop remote code execution. Only updating PHP fully fixes the flaws, so treat WAF rules as a temporary layer.
How do I find PHP across my environment?
Start with internet-facing services, then check CMS platforms, customer portals, hosting and co-location servers, and vendor products that embed PHP in a web console. Asset discovery tools, vendor advisories and the NCSC-NL status list all help.
What should I do if I cannot patch a PHP system today?
Follow CISA and NSA guidance and take the system offline until it can be secured. If that is impossible, restrict who can reach it, block its outbound connections, enforce request-size limits, and monitor for shell or curl activity spawned by PHP workers.
Get a PHP2Shell Exposure Review From ibm/SEIMless
You do not have to rebuild your network to contain PHP2Shell. ibm/SEIMless can map where PHP runs across your sites, portals and vendor products, then close the exits with firewall, detection and encryption layers built for medium and enterprise organizations. Explore our full list of services, read our story, or browse the FAQs. For managed support, see our managed IT services.
Ready to Close Your PHP2Shell Exposure?
Talk with an ibm/SEIMless specialist about a fast exposure review and a network-layer containment plan.
Phone: 646-546-5245
Email: in**@**********ss.com
Address: One Liberty Plaza, New York, NY 10006
