PHP2Shell PoCs Proliferate as Patching Lags and Exploit Reports Conflict
Summary
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has prompted millions of exploit attempts and a surge in PoCs. PHP patches are available, but reports of successful in-the-wild exploitation remain conflicting.
Key points
- PHP2Shell comprises two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated critical with a CVSS v4 score of 9.2.
- The PHP Foundation released fixes for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports also provided for PHP 7.4, 8.0 and 8.1.
- Cloudflare reported millions of exploit attempts in the first 24 hours after the patches were released. Reports of successful in-the-wild exploitation are conflicting; the Dutch NCSC said it was investigating initial signs, while some firms later retracted success claims.
- VulnCheck said it found a circulating PoC that bypassed ASLR on x86-64 for PHP 8.4.26 with default heap settings, but not other PHP setups.
- Censys reported that 8.1 million vulnerable hosts had been patched, about 20% of 41.5 million services revealing their PHP version; version reporting and distribution backports limit the estimate.
- Sophos observed unsuccessful attempts apparently aimed at delivering Potassium, a Mirai variant targeting IoT devices.
- The article reports that Citrix NetScaler and Palo Alto Networks products remain affected in some configurations, with fixes planned or still pending.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical; CVSS v4 score 9.2 for both vulnerabilities
- Affected Versions
- PHP 8.4.10–8.4.26
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Enable ASLR on affected products where supported; the article describes it as a control that can impede exploits, not a replacement for patching.
MITRE ATT&CK
CVE
CVE-2026-109618it's also found a proof-of-concept in the wild that successfully exploits PHP2Shell, which comprises CVE-2026-109618 and CVE-2026-109619, both with a "critical" CVSS v4 score of 9.2.CVE-2026-109619in the wild that successfully exploits PHP2Shell, which comprises CVE-2026-109618 and CVE-2026-109619, both with a "critical" CVSS v4 score of 9.2.
People
Dan GuidoSaid a Trail of Bits researcher developed a working exploit that got a shell on an unmodified MediaWiki installation.Elias TaylorReported that many circulating proof-of-concept exploits require a targeted PHP server to already have a local-file inclusion vulnerability.Kevin BeaumontWarned that ASLR-supporting PHP exploits were likely to emerge and urged organizations to ensure vendors enable ASLR.
Malware
Miraifirm Sophos on Thursday. These have included apparent attempts to deliver Potassium, a variant of the Mirai malware built to target internet of things devices.Potassiumoperators, said cybersecurity firm Sophos on Thursday. These have included apparent attempts to deliver Potassium, a variant of the Mirai malware built to target internet of things devices.
Vendors
CitrixCitrix said its NetScaler devices are vulnerable, and plans to issue fixes Tuesday.Palo Alto NetworksBeaumont cautioned that while ASLR is built into many products, it isn't always enabled by default, including in some Citrix NetScaler and Palo Alto Networks edge devices.The PHP FoundationTo fix the flaws, the PHP Foundation on Wednesday released patched upgrades: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions and long-term support vendors will be supplying their own patched versions.
Products
CortexPalo Alto said it patched its cloud-based Cortex and WildFire services on Wednesday, although WildFire appliances remain vulnerable - the vendor hasn't said when it might issue patches. Also vulnerable: all currentMediaWikisecurity and vulnerability researchers developed "a working exploit that gets a shell on an unmodified MediaWiki installation," without needing an LFI vulnerability to exploit first.NetScalerCitrix said its NetScaler devices are vulnerable, and plans to issue fixes Tuesday.PAN-OS- the vendor hasn't said when it might issue patches. Also vulnerable: all current versions of the PAN-OS software running its next-generation firewalls, for which it plans to release patches over the course ofPHPare bracing for breakthroughs in weaponized exploits targeting just-patched vulnerabilities in widely used PHP code. The flaws could enable attackers to take control of any server and underlying device running PHP asWildFirePalo Alto said it patched its cloud-based Cortex and WildFire services on Wednesday, although WildFire appliances remain vulnerable - the vendor hasn't said when it might issue patches. Also vulnerable: all current