---
title: PHP2Shell (CVE-2026-109618/109619) now broadly exploited in the wild, Amazon says, with a first attempt on Oct 17, four days before disclosure; patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | ctxsec
url: https://ctxsec.com/items/php-critical-security-release-oct-21-leaked-rce
description: "Update Oct 21, 11:55 AM ET: PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical unauthenticated RCE bugs. PHP says every installation serving web requests is at risk (FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php highest risk and a demonstrated pre-application exploit. Cloudflare reported early attacks this morning. Update, restart every worker, and check your distro for backported packages."
status: "confirmed (php.net, CISA alert Oct 21); Amazon Threat Intelligence: broadly exploited in the wild, first attempt Oct 17 (pre-disclosure). Added to CISA KEV Oct 26, last updated Oct 27, 2026, 12:40 AM ET"
published: 2026-10-22
updated: 2026-10-27T00:40:00-04:00
---

> Update Oct 21, 11:55 AM ET: PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical unauthenticated RCE bugs. PHP says every installation serving web requests is at risk (FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php highest risk and a demonstrated pre-application exploit. Cloudflare reported early attacks this morning. Update, restart every worker, and check your distro for backported packages.

[← Cybersecurity News](/news) · [markdown](/items/php-critical-security-release-oct-21-leaked-rce.md)

confirmed (php.net, CISA alert Oct 21); Amazon Threat Intelligence: broadly exploited in the wild, first attempt Oct 17 (pre-disclosure). Added to CISA KEV Oct 26

2026-10-22 · updated

Oct 27, 2026, 12:40 AM ET

### PHP2Shell (CVE-2026-109618/109619) now broadly exploited in the wild, Amazon says, with a first attempt on Oct 17, four days before disclosure; patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

**Update Oct 27:** a complete working exploit is now public ([Steal My Bitcoin PoC](/items/php2shell-steal-my-bitcoin-won-public-end-to-end-poc)), and Palo Alto Networks lists PAN-OS management interfaces as affected, with some hotfixes due by Oct 30 ([PAN-OS item](/items/pan-os-php2shell-brotli-hotfix-rollout-mgmt-ui)).

**Update Oct 26:** CISA has added both flaws to its Known Exploited Vulnerabilities catalog with a federal deadline of Oct 29. See [the KEV item](/items/cisa-kev-php2shell-cve-2026-109618-109619-due-oct-29).

**Update Oct 22:** Amazon Threat Intelligence (CISO CJ Moses) says its **MadPot** honeypots saw a PHP2Shell exploitation attempt on **Oct 17**, four days before the embargo lifted (Oct 21 14:00 UTC), from an IP on a commercial anonymization network. More attempts from other anonymized infrastructure followed from Oct 21 02:00 to 08:00 UTC, with payloads that suggest several actors. After the patch, new PoCs appeared within hours, and Amazon says **PHP2Shell is now being broadly exploited in the wild**. Amazon says it's unclear whether the pre-disclosure attempts would have worked against real systems. Datadog Security Labs independently reproduced CVE-2026-109618 and reports multiple reports of active exploitation plus broad untargeted scanning. It isn't in CISA KEV yet.

**Do now:** patching is the only complete fix (php.net, AWS and Datadog all agree; `session.upload_progress.enabled=0` and `memory_limit` changes only reduce exposure). Start any investigation from **Oct 17**, not the disclosure date. See the [hunt](/hunting#hunt-php2shell-itw-since-oct-17).

**Update Oct 21, ~4:00 PM ET:** [CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) issued an alert urging immediate patching of CVE-2026-109618/109619 and saying it has **not observed exploitation as of publication**, while urging defenders to take EOL PHP offline if they cannot patch. The [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) published a post-mortem: the OOM issue was first seen after a 2024 Quarkslab/OSTIF audit; Calif, OpenAI and Wiz reported full RCE paths from Aug 11; disclosure moved up a day after CVE IDs leaked Oct 20; the Foundation says it monitored circulating PoCs and found none functional at release time, and criticizes Chainguard for publishing patched images ~6 hours early. [Cisco Talos](https://blog.talosintelligence.com/two-critical-rces-in-php-core/) rates both CVSS v4.0 9.2, estimates ~50% of exposed PHP will not get a vendor patch (EOL branches), and as of 14:00 UTC Oct 21 had not seen in-the-wild exploitation; Snort SIDs 67359/67360 cover known paths. [SecurityWeek](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/) aggregates early sensor hits (watchTowr, Hadrian, Patchstack, Cloudflare, Vega) around patch time; watchTowr said attempts were hitting sensors but none successful yet. [Krebs](https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/) reports government sites going offline during emergency updates and cites OpenAI calling this among the most impactful recent issues. OpenAI also published a Codex skill at [openai/php2shell-checker](https://github.com/openai/php2shell-checker) to check remote or local PHP versions. Still not on CISA KEV (catalog 2026.10.21).

**Update Oct 21, 11:55 AM ET: fixes are out.** PHP published its [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and released **PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35**. The two bugs are [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) (RCE via out-of-memory handling that interrupts PHP while request data is only partly initialized) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) (RCE via request-owned state that survives after its memory is freed, so a later request on the same worker uses it). PHP says **all installations serving web requests** are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, and rates mod_php highest risk, with a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs. Linux distributions and LTS vendors got the patches in advance, so check your vendor's packages. PHP 8.1 and older get no project updates, but the PHP security team published minimal source backports for 7.4, 8.0 and 8.1. PHP lists partial stopgaps (for example `memory_limit=-1` set non-overridably, a low `post_max_size`, `session.upload_progress.enabled=0`, and on 8.5 `fatal_error_backtraces=0`) but says only updating is a complete fix. **Do now:** update, restart every PHP-FPM pool, Apache and long-running worker, and confirm the live version. See the [verify-and-stopgap tip](/tips#tip-php2shell-verify-and-stopgaps).

**Update Oct 21, 7:50 AM ET: early attacks reported.** Cloudflare CTO Dane Knecht [posted](https://x.com/dok2001/status/2112811965735202970) that PHP sites behind Cloudflare have an initial set of WAF rules for the known exploit vectors, available to all customers including free, that Cloudflare is **seeing early attacks emerging**, and that the rules are a **stopgap only**. Cloudflare's [WAF changelog](https://developers.cloudflare.com/changelog/product/waf/) lists Oct 21 emergency releases adding "Generic Rules - Anomalous Execution" rules to both the Managed and Free rulesets (the changelog doesn't name PHP). [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) notes code claiming to exploit the bugs is circulating but unverified (and may carry malware), and that PHP core developers say the only mitigation is upgrading; release manager Joe Ferguson said "ini settings won't save you". Tenable lists expected fixed versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35, reported before release; PHP has not published them yet. End-of-life branches are not expected to get fixes.

**Do now:** patch right after 14:00 UTC and restart PHP-FPM, Apache mod_php, Octane and queue workers. If you rely on Cloudflare or another WAF meanwhile, make sure your origin only accepts traffic from it, or the rules do nothing. Isolate PHP 8.1 and older.

The PHP security team posted an [advance notice](https://www.php.net/archive/2026.php#2026-10-20-1) of an **upcoming critical security release**, scheduled for **Wednesday, Oct 21, 2026 at 14:00 UTC** (10:00 AM ET). PHP says it fixes **two critical vulnerabilities, both rated CVSS v4.0 9.2**, urges all PHP users to prepare now, and reserves the right to release earlier if details become public or exploitation appears. Affected and fixed versions will only be published with the release.

On Oct 20 [watchTowr posted](https://x.com/watchtowrcyber/status/2112611507749982605) that information about the embargoed remote code execution bugs had leaked, that it can confirm they are real, and that the public date was meant to be Thursday at 11 AM ET. It gives the IDs as CVE-2026-109618 and CVE-2026-109619 (its post has a typo, "2926"). [BleepingComputer reports](https://x.com/BleepinComputer/status/2112652518505218249) that watchTowr rates them CVSS 10.0 and says they affect PHP 5 through 8; PHP itself has not confirmed affected versions. watchTowr later said it had pushed [network-level mitigations](https://x.com/watchtowrcyber/status/2112679565705314585) to its own platform clients ahead of the patch.

(As of Oct 20, 7:55 PM ET no exploitation had been reported; see the update above.)

**Do now:** inventory every PHP runtime you run (including containers, vendor appliances and shared hosting), note version and SAPI (FPM, mod_php, CGI), make sure you can rebuild or pull updated images Wednesday morning, and line up a change window right after 14:00 UTC. Old PHP 5 and 7 installs are unlikely to get official fixes, so plan to isolate them. See the prep tip.

Sources: [AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (Oct 21)](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) · [Datadog Security Labs: PHP2Shell detection, analysis and remediation](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) · [php.net security advisory, Oct 21](https://www.php.net/archive/2026.php#2026-10-21-5) · [GHSA-w8hw-w9fx-j79w (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) · [GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) · [Dane Knecht (Cloudflare CTO) on X, Oct 21](https://x.com/dok2001/status/2112811965735202970) · [Cloudflare WAF changelog, Oct 21 emergency releases](https://developers.cloudflare.com/changelog/product/waf/) · [Tenable: php2shell FAQ](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) · [php.net: Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1) · [watchTowr on X: leak confirmed, CVE IDs (Oct 20)](https://x.com/watchtowrcyber/status/2112611507749982605) · [BleepingComputer on X (Oct 20)](https://x.com/BleepinComputer/status/2112652518505218249) · [watchTowr on X: mitigations for clients](https://x.com/watchtowrcyber/status/2112679565705314585) · [CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) · [PHP Foundation: Today's PHP Security Release…](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) · [Cisco Talos: Two critical RCEs in PHP core](https://blog.talosintelligence.com/two-critical-rces-in-php-core/) · [SecurityWeek: patches land as first exploitation attempts hit sensors](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/) · [Krebs on Security: Widespread PHP Flaw May Cause Many Site Outages Today](https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/) · [OpenAI php2shell-checker (Codex skill)](https://github.com/openai/php2shell-checker) · [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [KillaBoi: StealMyBitcoin-PoC, winner's write-up and single-file PoC (GitHub, Oct 25-26)](https://github.com/KillaBoi/StealMyBitcoin-PoC) · [Palo Alto Networks: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products (updated Oct 27)](https://security.paloaltonetworks.com/CVE-2026-109618)