PHP2Shell Flaws Affect PHP 8.2–8.5; Exploitation Attempts Reported
Summary
Two critical PHP2Shell RCE flaws affect PHP 8.2–8.5. Exploitation attempts were reported before and after disclosure, with successful shell execution reported on three honeypots. Fixed PHP releases are available; patching and compromise investigation are advised.
Key points
- CVE-2026-109618 involves memory corruption during request initialization; CVE-2026-109619 involves access to released memory. Both could enable remote code execution.
- The article reports confirmed exploitability against Apache mod_php for both flaws and PHP-FPM for CVE-2026-109619.
- Amazon Threat Intelligence and Cloudflare reported pre-disclosure exploitation activity; SecurityWeek reported successful shell execution on three honeypots.
- Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older unsupported branches should be upgraded or receive a verified vendor backport.
- The article recommends identifying PHP deployments, installing patches, restarting affected services, and reviewing logs and systems for compromise.
- WAF rules alone are not a full remediation; the cited Zeek and Suricata detections are described as incomplete and may match benign traffic.
Article Details
- Vulnerability Types
- Memory corruption during request initialization when PHP runs out of memory
- Use-after-free involving stale references to released memory
- Severity
- Critical
- Affected Versions
- PHP 8.2
- PHP 8.3
- PHP 8.4
- PHP 8.5
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Take affected systems offline until they can be fully mitigated if immediate patching is not feasible.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSecurityWeek reported successful shell execution on three honeypot systems following PHP2Shell exploitation.T1190 · Exploit Public-Facing ApplicationAttackers attempted to exploit the PHP vulnerabilities remotely; the article reports successful exploitation against Apache mod_php and PHP-FPM deployments.
CVE
CVE-2026-109618On October 21, 2026, the PHP development team released security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.CVE-2026-109619On October 21, 2026, the PHP development team released security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.