PHP2Shell Flaws Face Active Exploitation as Patches Roll Out
Summary
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Exploitation attempts are reported, and code execution has been observed on honeypots. Patches are available; eSentire reports no customer compromises found so far.
Key points
- The flaws affect PHP 8.2–8.5 releases before 8.2.35, 8.3.36, 8.4.27, and 8.5.12; older end-of-life versions also remain at risk.
- Both vulnerabilities are unauthenticated remote code execution flaws linked to errors in memory cleanup after web requests.
- eSentire identified exploitation attempts using public proof-of-concept code; researchers also reported attempts against honeypots, where attackers later recorded successful code execution.
- CISA added both CVEs to its Known Exploited Vulnerabilities catalog. eSentire says its threat hunting has found no evidence of successful compromise in customer environments so far.
- The PHP Group says updating is the only complete fix. Organizations are advised to inventory PHP installations, including bundled software and vendor appliances, and apply available vendor patches.
- For unpatchable end-of-life systems, the article recommends isolation and replacement; if compromise is suspected, isolate the server, preserve logs, and review for unusual activity.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution (RCE)
- Severity
- Critical; CVSS 9.2 for each vulnerability
- Affected Versions
- PHP 8.2 versions earlier than 8.2.35
- PHP 8.3 versions earlier than 8.3.36
- PHP 8.4 versions earlier than 8.4.27
- PHP 8.5 versions earlier than 8.5.12
- PHP 8.1 and older
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Apply the temporary mitigations provided by the PHP Group; they reduce exposure but do not make an installation safe.
- Isolate end-of-life PHP instances that cannot be patched and plan their replacement.
MITRE ATT&CK
CVE
CVE-2026-109618Vendor / Product unavailablePHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP, each rated 9.2 on the CVSS severity scale.CVE-2026-109619Vendor / Product unavailablePHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP, each rated 9.2 on the CVSS severity scale.