PHP2Shell flaws in PHP core exploited, CISA adds both CVEs to KEV

What happened

PHP shipped emergency releases on October 21, 2026 for two flaws in the language runtime itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and allow remote code execution without authentication. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

CVE-2026-109618 lives in out-of-memory handling: PHP aborts a request with longjmp(), which can leave request memory uninitialized for the cleanup code that runs next. CVE-2026-109619 is global state that keeps pointing into request memory after it has been freed, so the next request on the same worker acts on stale data. Coordinated disclosure was set for October 22, but the CVE details and a proof of concept leaked, so the PHP Foundation moved the release up a day. Amazon says its MadPot honeypot logged an attempt from 103.216.220[.]92 on October 17, four days before the patches, and saw attempts from multiple actors on October 21, the day the fixes shipped. CISA added both CVEs to its KEV catalog on October 26.

Why it matters

There is no login to bypass and no vulnerable endpoint to find: any reachable PHP script on an affected server is enough, regardless of CMS or framework. CrowdStrike says a successful attack leaves almost nothing behind beyond a single memory-limit fatal in the web server error log. The pool of targets is huge and old. VulnCheck counts 2,608,039 internet-facing PHP hosts, and Modat says 79% of the 4.38 million PHP services it found run branches PHP no longer supports.

Who is affected

PHP rates Apache mod_php as highest risk; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also in scope.

What to do now

1. Inventory every PHP install, starting with internet-facing hosts and anything running PHP as an Apache module.
2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package), then restart all PHP workers.
3. Take hosts on PHP 8.1 or older offline if they cannot be upgraded now, as CISA advises.
4. If you cannot patch today, block multipart requests the application does not need and do not use RLIMIT_AS or RLIMIT_DATA, which trigger the vulnerable path. PHP says no setting fully mitigates the bugs.
5. Hunt for PHP worker processes spawning shells or downloading tools, and for scanners using the user agent php2shell-scan/109618.

What we don't know yet

• How the actor behind the October 17 probe got exploit details while the bugs were under embargo.
• Who is behind the post-release exploitation; no attribution has been made public.
• Whether PHP-FPM can be exploited end to end: PHP's advisory says source analysis suggests it, but no complete exploit has been shown.