cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

PHP Releases Emergency Fixes for PHP2Shell Vulnerabilities Amid Early Attack Reports

· Original article ↗

Summary

PHP released fixes for two critical PHP2Shell vulnerabilities after reports of early attacks. Administrators are urged to update affected installations or consider isolating internet-facing applications if they cannot patch immediately.

Key points

  • PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10.
  • Successful exploitation could allow unauthenticated code execution on affected servers with the PHP process's permissions.
  • Cloudflare's CTO reported early attacks; the article does not confirm that websites taken offline were breached.
  • Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators are urged to update promptly.
  • CERT-EU recommends identifying PHP-based applications and patching; if an immediate fix is not feasible, consider isolating internet-facing applications.
  • PHP 8.1 and older no longer receive routine security updates from the PHP project; users should check for vendor fixes or upgrade to a supported version.

Article Details

Severity
Both vulnerabilities have a severity rating of 9.2 out of 10.
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If an immediate fix is not feasible, consider isolating internet-facing applications from public networks.
  • If affected services cannot be patched immediately, consider temporarily taking them offline.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterSuccessful exploitation could allow an attacker to run malicious code on an affected server.T1491.002 · External DefacementThe article says attackers could alter website content after exploiting the vulnerabilities.T1557 · Adversary-in-the-MiddleThe article describes attackers hijacking legitimate websites to exploit their reputation, phish visitors, or serve malicious software.T1566 · PhishingHijacked websites could be used to phish visitors, according to Malwarebytes' Shahak Shalev.

CVE

CVE-2026-109618The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.CVE-2026-109619The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.

People

Dane KnechtCloudflare's chief technology officer; reported early attacks emerging and warned that firewall mitigations were only a stopgap.Shahak ShalevMalwarebytes' Global Head of Scam and AI Research; commented on the risks of attackers hijacking trusted websites.

Vendors

PHPin maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking

Products

Drupallanguage that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP isJoomlalanguage that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.Magentothat works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.PHPin maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily takingWordPressis a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize

Related Articles