PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploited

Two critical remote code execution (RCE) vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, are currently being exploited in the wild. If your organization operates web servers or applications running PHP, especially versions 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, or 8.5.* before 8.5.12, your systems are highly vulnerable and require immediate attention. The most important action you can take today is to upgrade your PHP installations to the patched versions without delay.

What Happened: The PHP2Shell Exploitation Timeline

Security researchers have confirmed that the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are being actively exploited in real-world attacks. These flaws allow for unauthenticated remote code execution, giving attackers full control over affected systems. The PHP security team released patches for these vulnerabilities on Wednesday, October 21, 2026, urging administrators to prepare for immediate updates.

Initially, despite public leaks of vulnerability details and proof-of-concept (PoC) exploits, most detected exploitation attempts by various cybersecurity firms were reported as unsuccessful. However, this changed when Adel Karimi at Perplexity observed definitive evidence of successful RCE. Karimi's honeypots recorded specific malicious activity against an Apache mod_php installation running PHP 8.4.26, demonstrating memory disclosure and subsequent code execution.

The evidence included the exfiltration of a significant amount of cookie data, approximately 800 KiB, which was then used to derive a function address that appeared in a later exploit payload. This confirms a fully functional exploit chain. Marcus Hutchins, a threat researcher, independently corroborated these findings, calling it the "highest quality confirmation" of in-the-wild exploitation.

Due to this active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026. This designation underscores the severe risk, setting a deadline of October 29, 2026, for US federal agencies to apply vendor mitigations or discontinue use of affected products.

Are You Affected and How to Check

If your business utilizes PHP on its web servers for websites, applications, or internal tools, you are likely impacted. PHP powers approximately 70% of all websites, and over 5 million PHP hosts are exposed online. The vulnerabilities specifically target recent PHP 8.x branches.

To determine if you are affected, you must identify the exact version of PHP running on your servers. This can typically be done via the command line (php -v) or by checking your web server configuration files (e.g., Apache's httpd.conf or Nginx's nginx.conf). Focus on any installations that have an internet-facing presence or handle untrusted input, as these are primary targets for unauthenticated RCE.

The critical PHP2Shell vulnerabilities affect specific PHP 8.x versions. You are affected if your PHP installation falls into any of these categories:

Immediate Actions to Secure Your Systems

Given the confirmed active exploitation and the critical CVSS v4.0 score of 9.2 for both CVEs, immediate action is paramount. Your priority must be to update all affected PHP installations to the patched versions as quickly as possible. This is not optional; unauthenticated remote code execution means an attacker can completely compromise your server with minimal effort.

Specifically, you need to upgrade to the following PHP versions to mitigate these PHP2Shell vulnerabilities:

Beyond patching for PHP2Shell, the PHP security team also released mitigation advice for a separate RCE vulnerability (tracked as CVE-2026-115560) that currently lacks a patch. This vulnerability exploits unusual configurations. While distinct from PHP2Shell, it's a good practice to implement its recommended mitigation if applicable to your environment, especially given the current threat landscape. To block potential attacks for CVE-2026-115560, set session.upload_progress.enabled=0 in your php.ini file. This was also a general recommendation before the PHP2Shell security updates were released.

If immediate patching is not feasible due to business critical dependencies or other constraints, you must apply vendor-provided mitigations diligently. CISA's guidance for federal agencies emphasizes that if mitigations are unavailable or insufficient, discontinuing use of the product should be considered. For small and mid-size businesses, this might mean temporary service discontinuation or implementing robust web application firewalls (WAFs) and strict network segmentation to limit exposure until a patch can be applied. Consider engaging with our incident response services if you suspect compromise or need urgent assistance.

How to Spot PHP2Shell Exploitation

Detecting exploitation requires vigilance and robust monitoring. While the specific SIGMA detection rule CISA shared is not detailed in our facts, you should focus on anomalies indicating unauthenticated remote code execution. This includes unexpected process spawns from the PHP process, abnormal network connections originating from your web server, or unusual file modifications.

Look for signs of memory corruption, unexpected PHP process crashes followed by suspicious new processes, or attempts to access or exfiltrate sensitive data, such as large cookie data exfiltrations. Any unusual behavior from your Apache or PHP processes should trigger immediate investigation.

We recommend reviewing your web server access logs and PHP error logs for suspicious requests or errors. Implement endpoint detection and response (EDR) solutions to monitor for anomalous process execution and system calls. Consider implementing a Security Information and Event Management (SIEM) system with correlation rules to identify potential exploitation attempts. Our 24x7 SOC services can provide continuous monitoring and threat detection for your infrastructure.

What This Means for Small and Mid-Size Businesses

For SMBs in India and the US, these PHP2Shell vulnerabilities represent a critical and immediate threat. Many SMBs rely heavily on PHP-based applications for their online presence, e-commerce, and internal operations. An unauthenticated RCE flaw means that an attacker doesn't need to bypass login screens or compromise user accounts; they can directly execute code on your server simply by sending a malicious request.

The direct implications are severe: complete server compromise, data breaches, website defacement, ransomware infection, or even using your server as a launchpad for further attacks. Small businesses often have limited IT resources, making timely patching and sophisticated threat detection challenging. This is where a proactive cybersecurity strategy becomes crucial.

To manage risks like PHP2Shell effectively, SMBs should prioritize regular vulnerability scanning and patching, maintain comprehensive backups, and implement multi-layered security controls. If internal resources are stretched, consider partnering with a managed security service provider. Services like our cybersecurity services, vCISO services, and EASM services can help you identify exposures, manage vulnerabilities, and respond to threats effectively, ensuring your critical business operations remain secure.

Sources