Critical remote code execution vulnerabilities in PHP core (PHP2Shell)
Tracked as CVE-2026-109618 and CVE-2026-109619. Two critical flaws in the PHP interpreter allow unauthenticated remote code execution and are already under active exploitation.
What has happened?
Two critical flaws in the PHP interpreter ("PHP2Shell") allow unauthenticated remote code execution. Fixes were released on 21 October 2026 and the flaws are being actively exploited.
How does it affect you?
Any website, portal, or API running on PHP 5.4 to 8.5.11 can be taken over, whatever application is built on it. Exploitation began before disclosure, so exposed servers may already be compromised.
What should you do?
Patch internet-facing PHP servers within 24 to 48 hours (Apache mod_php first), apply interim mitigations where you cannot, and review exposed systems for compromise.
How can we help?
Saint Fox can identify exposed PHP assets, verify patching, and carry out compromise assessments and configuration reviews.
What even happened?
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities in the core PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as “PHP2Shell”. Both flaws can allow an unauthenticated remote attacker to execute arbitrary code on a web server running a vulnerable version of PHP. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory.
Vulnerability details
Threat activity: how the disclosure unfolded
watchTowr, Hadrian, Cloudflare, and Patchstack report exploitation in the wild through the session upload-progress path. Cloudflare has reported attempts to evade its protective rules.
Initial waves appear opportunistic (web shells and cryptominers). Media reporting indicates ransomware operators are also using these flaws for initial access.
How it affects you
The flaws sit in the PHP runtime. Every PHP-based application is therefore exposed if it runs on an affected interpreter, including:
This applies even if the application code itself is fully up to date.
Affected and fixed versions
Note on distribution packages. Linux distributions (Red Hat, Ubuntu, Debian, SUSE, Alpine, and others) often backport fixes without changing the upstream version number. For distribution-managed PHP, check the full package version against the relevant distribution vendor's security advisory. Do not rely on the version string reported by PHP.
Deployments at risk
Any installation where PHP serves web requests is at risk. Exploitability varies with server configuration and application behavior. The following should be prioritized:
Potential business impact
Server takeover
An attacker can run commands as the webserver user, install web shells, and pivot into internal networks.
Data exposure
Access to application databases and files, including customer, patient, or financial records.
Credential theft
Memory disclosure can leak passwords, session tokens, and API keys.
Ransomware and service disruption
Ransomware deployment and cryptominers.
Regulatory consequences
Reportable incidents under CERT-In directions and sector regulators, and personal-data breach obligations under the DPDP Act, 2023.
Implication
Compromise may predate both the advisory and the patch. Any internet-facing PHP server that was running a vulnerable version on or after 17 October 2026 should be treated as potentially compromised until reviewed.
Saint Fox can carry out this review through a compromise assessment and dedicated threat hunting engagement.
What you should do
Follow the checklist below to reduce your exposed attack surface and recover any compromised assets.
Inventory all PHP runtimes
Include parallel PHP branches, containers and base images, hosting panels, appliances, and serverless/PaaS workloads. The version returned by php -v may belong to a different installation from the one serving web traffic.
Patch, internet-facing first
Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply your distribution's fixed package. Prioritize Apache mod_php, then PHP-FPM and other web SAPIs.
Rebuild container images
Pull patched PHP base images, rebuild application images, and redeploy.
Restart every PHP worker
Restart PHP-FPM pools, Apache, LiteSpeed, and any long-running workers so that no process continues on the old build.
Plan for end-of-life versions
Systems on PHP 8.1 or earlier need a vendor-backported build or an upgrade. Until then, apply the interim mitigations and restrict access.
Compromise assessment
Complete a compromise assessment of exposed systems.
Rotate credentials
Rotate credentials and secrets held on internet-facing PHP hosts that were unpatched, such as database passwords, API keys, cloud access keys, and application secrets.
Invalidate sessions
Invalidate active user sessions on affected applications where feasible.
Revert interim mitigations
Revert temporary configuration changes once the patched runtime is confirmed.
Interim mitigations
Updating PHP is the only complete fix. The following measures help reduce exposure to the known attack paths but do not make an unpatched installation safe. Each change must be applied at the server level (php.ini, FPM pool, or webserver configuration) and every PHP worker must be restarted.
PHP 8.5 only
PHP-FPM
Regulatory note (India). Under CERT-In's Directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within 6 hours of being noticed. Sector regulators (RBI, SEBI, IRDAI) may impose additional reporting obligations as required.
Key takeaways
Critical risk
Two severe flaws (CVE-2026-109618 and CVE-2026-109619), each rated CVSS v4.0 9.2.
Actively exploited
Exploitation began before disclosure and is now widespread. Public exploits are available.
Broad impact
Every PHP 5.4 to 8.5.11 environment is at risk, whatever application runs on it.
Patch urgently
Patch internet-facing servers immediately and review exposed systems for signs of compromise.
How we can help you
As a CERT-In empanelled and ISO/IEC 27001 certified organization, Saint Fox can support your response at every stage.
External exposure assessment
Identify your internet-facing PHP assets, the PHP versions and SAPIs in use, and which systems are vulnerable for prioritized patching.
Patch verification
Authenticated validation that fixes or vendor backports have been applied and that the running workers use the patched runtime.
Interim mitigation support
Review and apply the PHP, webserver, and WAF hardening for systems that cannot be patched immediately, without disrupting the application.
Compromise assessment
Log review, web-shell hunting, and host triage for systems exposed during the exploitation window, with evidence preserved for any incident report.
Threat hunting
Ongoing, hypothesis-led hunting across your web, endpoint, and network telemetry for PHP2Shell activity, such as web shells, unusual PHP child processes, and suspicious outbound traffic, delivered through our Managed Detection & Response service.
Incident response and CERT-In reporting
Containment guidance and support in preparing incident reports to CERT-In and sector regulators within the required timelines.
Vulnerability management
Continuous discovery, prioritization, and tracking of vulnerabilities across your estate, so critical issues like PHP2Shell are flagged early and remediated within agreed timelines. Includes early-warning advisories on emerging threats.
VAPT and red teaming
Post-remediation testing of your PHP applications and internet-facing estate to confirm the fix holds. Red team exercises to test whether an attacker could pivot from a compromised web server into your internal network.
This advisory reflects information publicly available as of 22 October 2026. The situation is evolving; Saint Fox will issue updates as material information becomes available. This advisory is provided for information purposes and does not constitute an assessment of any specific environment.
Need help responding to PHP2Shell?
Saint Fox can find your exposed PHP assets, verify patching, apply interim mitigations, and run a compromise assessment if you need one.