PHP2Shell Exploit Attempts Surge as Most Identified Servers Remain Unpatched
Summary
Cloudflare reported millions of PHP2Shell exploit attempts, but successful exploitation has not been confirmed. About 99% of identified affected hosts remained unpatched after 24 hours; agencies urge patching or taking exposed systems offline.
Key points
- PHP2Shell comprises CVE-2026-109619, a use-after-free in PHP's upload progress feature, and CVE-2026-109618, memory corruption triggered by an out-of-memory condition. Both can enable remote code execution.
- Cloudflare said attempts on its network rose from thousands before public disclosure to millions afterward. Amazon also reported exploit attempts against its honeypots, with no evidence they succeeded.
- Ox Security reported that roughly 99% of affected hosts it identified through Shodan still showed an unpatched PHP version 24 hours after patches were released.
- VulnCheck said it developed a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 and is sharing it privately with some customers.
- VulnCheck scans found more than 1.1 million hosts running outdated, unsupported PHP versions, alongside 403,000 hosts on versions 8.2 through 8.5 that can be updated.
- Government cybersecurity agencies urged organizations to identify PHP deployments, patch internet-facing systems immediately or take them offline, and monitor for suspicious activity; experts said patching is the only reliable mitigation.
Article Details
- Vulnerability Types
- Use-after-free in PHP core's upload progress feature
- Memory corruption triggered by an out-of-memory condition
- Severity
- Critical
- Affected Versions
- PHP versions 8.2 through 8.5
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Patch internet-facing systems immediately or take them offline; the article reports no reliable mitigation short of patching.
MITRE ATT&CK
CVE
CVE-2026-109618CVE-2026-109619 is a use-after-free vulnerability in PHP core's upload progress feature, while CVE-2026-109618 is a memory corruption vulnerability triggered by an out-of-memory condition, said cloud securityCVE-2026-109619PHP2Shell comprises two flaws: CVE-2026-109619 is a use-after-free vulnerability in PHP core's upload progress feature, while CVE-2026-109618 is a memory corruption vulnerability triggered by an out-of-memory condition,
People
CJ MosesAmazon CISO who said proof-of-concept exploits appeared and were used against Amazon sensors.Matthew PrinceCloudflare CEO who reported the rising volume of exploit attempts observed across the Cloudflare network.Ondrej VlcekAisle CEO who said attackers compromised LiteLLM's release pipeline and pushed a malicious version.Steven WeinsteinFlashpoint senior vice president of intelligence who warned that public technical details put unpatched systems at risk.
Vendors
Akamaiis a memory corruption vulnerability triggered by an out-of-memory condition, said cloud security giant Akamai.AmazonBefore the patches appeared, Amazon said its honeypots recorded multiple exploit attempts that appeared to track to different threat actors, and said there's no evidence yet any of those exploits succeeded.CloudflareCloud security firm Cloudflare said exploit attempts are flying fast and furious. "In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumpedFlashpointto investigate," said Steven Weinstein, senior vice president of intelligence at cybersecurity firm Flashpoint, in an emailed statement.The PHP FoundationFollowing a series of leaks, the PHP Foundation on Wednesday released patches for the two flaws, dubbed PHP2Shell, for all currently supported versions of its server-side code (see: Critical PHP Patches Address 'Very,VulnCheckbypass address space layout randomization on x86-64 systems, while ARM64 systems would be easy game, VulnCheck said in a Thursday blog post.
Products
LiteLLMof the cybersecurity world was preoccupied with PHP2Shell, attackers compromised the release pipeline of LiteLLM, a hugely popular open-source AI library with more than 20 million weekly downloads, and pushed aPHPAttacks targeting the critical PHP vulnerabilities patched Wednesday are mounting as a flood of proof-of-concept exploits appear online.