PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Executive Summary

Two critical unauthenticated remote code execution (RCE) vulnerabilities in PHP, collectively dubbed "PHP2Shell," are under active and widespread exploitation, impacting an estimated 70% of all websites. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to execute arbitrary code on a vulnerable server without authentication, leading to a complete system takeover. Exploitation was observed in the wild before patches were released, creating a critical situation for defenders. The U.S. National Security Agency (NSA) and CISA have issued urgent advisories, with CISA adding both flaws to its Known Exploited Vulnerabilities (KEV) catalog, mandating a short patching deadline for federal agencies. The incident has forced organizations worldwide to take websites offline as a precautionary measure while they scramble to apply the necessary updates.

Vulnerability Details

The PHP2Shell vulnerabilities consist of two distinct memory management flaws within the core PHP engine, making them broadly applicable across various applications and frameworks built on the language.

• CVE-2026-109618: This is an out-of-memory corruption vulnerability. It allows an attacker to write data outside of its intended buffer, which can be leveraged to corrupt memory structures and ultimately execute arbitrary code.
• CVE-2026-109619: This is a use-after-free vulnerability related to how PHP handles stale request states. An attacker can manipulate the server into reusing a piece of memory after it has been freed, leading to a crash or, more critically, arbitrary code execution.

Both vulnerabilities are unauthenticated, meaning an attacker only needs network access to a vulnerable PHP-based web server to attempt exploitation. The attack complexity is low, and successful exploitation grants the attacker the same level of privilege as the web server process, which is often sufficient for a full system compromise.

Affected Systems

The vulnerabilities affect a vast range of PHP versions. Patches have been released in the following versions, and all prior versions are considered vulnerable:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Given that PHP powers a significant portion of the web, including popular content management systems like WordPress, Joomla, and Drupal, the attack surface is immense. Any public-facing server running an unpatched version of PHP is at immediate risk.

Exploitation Status

Active and widespread exploitation of both CVE-2026-109618 and CVE-2026-109619 was confirmed before the official patch release. This is a classic zero-day scenario where attackers had a head start.

• October 17, 2026: Amazon Threat Intelligence reported observing exploitation attempts, four days before the public announcement.
• October 20, 2026: The CVE identifiers were leaked on social media, accelerating attacker activity.
• October 21, 2026: The PHP security team released patches. Cloudflare reported exploit attempts immediately surged from thousands to millions per hour.
• October 26, 2026: CISA added both CVEs to its KEV catalog, confirming ongoing exploitation and requiring federal agencies to patch by October 29, 2026.

Impact Assessment

The impact is global and severe. The vulnerabilities allow for complete server takeover, enabling attackers to steal sensitive data, deploy ransomware, install crypto miners, or use the compromised server as a pivot point to attack internal networks. The immediate real-world impact included government and private websites in the US, UK, France, Denmark, Finland, and the Netherlands being taken offline. Major Japanese corporations like ANA, JR West, and MUFG Bank also suspended services to mitigate the risk. The pre-patch exploitation indicates that many organizations may already be compromised and should assume a breach if they were running vulnerable versions.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable systems or exploitation attempts:

Detection Methods

Security teams should focus on both identifying vulnerable assets and detecting post-exploitation activity.

1. Asset Inventory: Use scanners or package management tools (dpkg -l | grep php, rpm -qa | grep php) to identify all servers running PHP and their specific versions. Compare against the patched versions.
2. Web Server Log Analysis: While specific exploit payloads are not public, hunt for a spike in 5xx server errors, which could indicate failed exploitation attempts. Look for unusually long or strangely encoded request URIs or POST bodies. This can be done with D3FEND Network Traffic Analysis.
3. Endpoint Detection and Response (EDR): Monitor web server processes (httpd, nginx, php-fpm) for suspicious child processes. A web server should not be spawning shells (/bin/bash) or network utilities (curl, wget) to connect to external systems. This aligns with D3FEND Process Analysis.
4. Network Intrusion Detection System (NIDS): Deploy signatures that look for patterns associated with memory corruption exploits. While these may be generic, they can catch attempts to overflow buffers or trigger use-after-free conditions over HTTP.

Remediation Steps

1. Patch Immediately: The highest priority is to update all PHP installations to the latest patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). This is the only way to fully remediate the vulnerabilities. This is a core part of D3FEND Software Update.
2. Apply Virtual Patching: If immediate patching is not possible, use a Web Application Firewall (WAF) with rules specifically designed to block exploit attempts against these CVEs. Major WAF vendors have already released signatures.
3. Assume Breach: For any internet-facing server that was running a vulnerable version, assume it has been compromised. Initiate incident response procedures, hunt for signs of persistence, and review logs for unauthorized activity.
4. Harden Configurations: Implement D3FEND Application Configuration Hardening by disabling unnecessary PHP functions in php.ini via the disable_functions directive (e.g., exec, shell_exec, system, passthru). This can limit an attacker's ability to execute commands even if they achieve initial code execution.