Experts Outline PHP2Shell Patch Challenges and Temporary Mitigations
Summary
Experts say PHP2Shell exploitation is accelerating while patching lags. They recommend inventorying PHP deployments, checking vendor fixes, hunting for compromise and isolating unpatchable systems; disabling session upload progress may temporarily mitigate CVE-2026-109
Key points
- Cloudflare CEO Matthew Prince said the company observed thousands of PHP2Shell exploitation attempts before public disclosure, rising to millions by Oct. 21.
- Check Point Research claimed attempts had reached 10% of organizations. Ox Security reported that 97.5% of Shodan-discovered instances still did not advertise a newly patched version as of Oct. 23.
- PHP may run in devices such as storage appliances, cameras and access-control systems; some require manufacturer firmware updates, which may be unavailable for unsupported products.
- Experts recommend finding and inventorying PHP across an organization's systems, hunting for compromise, and restricting access to or taking offline systems that cannot be patched.
- Disabling session.upload_progress.enabled and restarting PHP workers blocks the reported session-upload-progress attack paths for CVE-2026-109619, but does not address CVE-2026-109618.
- Backported fixes may not change the displayed PHP version, and installing a corrected package may not update PHP interpreters already loaded by running workers.
Article Details
- Vulnerability Types
- PHP session upload progress vulnerability
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- For CVE-2026-109619, disable session.upload_progress.enabled and restart the PHP workers; the article says this blocks confirmed session-upload-progress attack paths but does not address CVE-2026-109618.
- Restrict access to vulnerable systems or take them offline until they can be patched.
MITRE ATT&CK
CVE
CVE-2026-109618be simple. There are new versions one can update to, which cover the vulnerabilities in question, CVE-2026-109618 and CVE-2026-109619. In practice, addressing PHP2Shell will look very different from one organizationCVE-2026-109619are new versions one can update to, which cover the vulnerabilities in question, CVE-2026-109618 and CVE-2026-109619. In practice, addressing PHP2Shell will look very different from one organization to the next, and
People
Adrian CheekFlare senior cybercrime researcher who discussed PHP exposure, remediation challenges, and a temporary mitigation for CVE-2026-109619.Alex SpokoinyCheck Point chief security and trust officer who advised organizations to assess suppliers' PHP2Shell responses and consider extending WAF protection where possible.Matthew PrinceCloudflare CEO who reported observing thousands of exploitation attempts before public disclosure and a rapid increase afterward.Neatsun ZivOX Security CEO who described organizational differences in responding to PHP2Shell.
Vendors
Products
PHPThe data began trickling in on Oct. 21, painting a picture of the world's initial response to the new PHP vulnerabilities. The picture wasn't pretty.UbuntuThe most common version in public records, 7.4.3, is what shipped with Ubuntu 20.04. As Cheek points out, "Linux distributions frequently retain an older PHP version number while backporting security fixes. So an old