PHP2Shell: The risk and response

FSP THREAT INTELLIGENCE

Two critical, unauthenticated remote code execution flaws in the PHP engine leaked before the fix, were patched in an emergency release today, and are already drawing exploitation attempts. Here is what happened, what our AI-driven threat intelligence platform has observed across the organisations we monitor, and what to do this week.

The short version

• Patch now. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws allow unauthenticated remote code execution (CVSS 4.0: 9.2, critical).
  
  
• Older PHP is the bigger problem. Researchers report the flaws reach back to PHP 5.4, but only supported branches get a fix. Shodan shows 2.2 million internet-facing services advertising PHP, and 51% of those with a version run an end-of-life branch that will never be patched.
  
  
• Exploitation has started. Cloudflare, watchTowr and Hadrian report in-the-wild attempts, and SANS ISC raised its Infocon to yellow. We judge it highly likely that mass, automated exploitation follows within days.
  
  
• Do not forget what you do not run yourself. Hosted CMS sites, marketing microsites, supplier portals and appliances with embedded PHP are where unpatched copies tend to hide. Over the past year, a familiar pattern has emerged, organisations know the EU AI Act exists. They know something significant was due in 2026. And they have heard, correctly, that the most demanding requirements have been pushed back. 
  

What happened

PHP is the server-side language behind a very large share of the web, including WordPress, Drupal, Magento, Moodle and countless bespoke applications. On 20 October the PHP project warned of two critical flaws in the engine itself, rather than in any one application, and scheduled an unscheduled security release for 21 October after details leaked online.

• CVE-2026-109618 (“RCE via OOM corruption”). PHP uses longjmp() to abort a request when it runs out of memory. Some code paths leave request memory uninitialised when this happens, and the cleanup routine then reads or branches on it. An attacker who can push a request into an out-of-memory condition can turn this into code execution.
  
  
• CVE-2026-109619 (“RCE via stale global state”). Global state that briefly points into request memory is not always reset, so a later request can act on memory that has already been freed.
  
  
• Both are scored 9.2 (CVSS 4.0, critical) by the PHP CNA. Exploitation needs no credentials and no user interaction. The “high complexity” rating reflects reliability, not a real barrier for a determined attacker.
  
  
• Reporting attributes discovery to Wiz and Calif using AI-assisted code review, and notes that frontier AI models also helped build working exploits. Apache with mod_php is described as the highest-risk deployment.
  

Agencies moved quickly. CERT-EU, CERT-FR, CISA and the UK’s NCSC all issued guidance on 21 October. CISA and CERT-FR advise taking systems offline or isolating them if they cannot be patched, and CERT-FR says to migrate unsupported versions. Some hosting providers took sites offline as a precaution, and The Record reported hundreds of websites unavailable during the day.

Figure 1: Sources our platform correlated on PHP2Shell, 20 to 21 October (UTC)
Each point is a government advisory or news report, plotted when our platform ingested it. The median gap between publication and ingestion was 14 minutes.

What we’re seeing across the internet, combined with our own threat intelligence, indicates…

We looked at PHP2Shell exposure at two levels: the whole internet, using Shodan’s passive scan data, and the organisations our platform monitors (our customers, their suppliers and their sector peers). Our platform never probes those systems itself. It fingerprints software from passively collected scan data and checks it against each vulnerability’s affected version ranges.


Internet-wide

2.2m	92%	51%	54,367
Internet-facing services advertising PHP (Shodan)	of those with a version on an affected branch	on end-of-life PHP with no fix coming	of them in the UK

Figure 2: PHP branches advertised in the X-Powered-By header, internet-wide and in the UK

Source: Shodan host counts, 21 October 2026, taken before most operators could apply today’s release. Counts are services (IP and port), not organisations. Distribution builds (for example Ubuntu or RHEL) can carry vendor fixes under an older version string, so the headline numbers are an upper bound for supported branches and a fair estimate for end-of-life ones. PHP 5.2 and 5.3 are shown apart because public reporting puts the affected range at 5.4 and later.

Three points stand out:

1. End-of-life PHP is the main risk. About 765k services (51% of those advertising a version) run PHP 5.4 to 8.1. These branches are reported as affected, and the PHP project will not patch them. PHP 5.6 (186k) and 7.2 (180k) are the largest groups. For these, the only real fixes are upgrading to a supported branch or isolating the host.
   
   
2. Supported branches still mean a large patching job. About 608k services run 8.2 to 8.5. They can be fixed in place, so patch speed is what matters this week.
   
   
3. The UK is no exception. Of 35,219 UK services advertising a version, 47% are on end-of-life branches and 49% on supported branches that need today’s patch. About 33% of services internet-wide hide their version entirely, which is good practice but means you need an inside-out inventory to know where you stand.

Across the organisations we monitor

Our platform’s passive view of the estates we monitor shows the same pattern. Of 1,687 hosts advertising PHP, 43% of those with a version run end-of-life branches and 45% run supported branches awaiting the fix. Where the platform finds a likely exposure on a customer’s estate, it checks the match with an AI exposure review before anyone is told, and the customer gets the specific hosts and versions directly. Those details never appear in publications like this one.

Honeypot and exploitation telemetry

Our platform ingests honeypot and sensor telemetry daily, including SANS ISC DShield port activity and Shadowserver’s honeypot-observed exploitation data, alongside exploitation sightings from vulnerability intelligence feeds. Here is what that shows so far:

• Shadowserver honeypots: no attempts tagged yet. Data runs to 20 October, before the CVEs were published, and sensor networks need a signature before they can label traffic. Our platform will raise an exploitation signal as soon as these CVEs appear.
  
  
• DShield web ports: no clear spike yet. Distinct sources attacking TCP/80 and TCP/443 stayed within their 30-day range up to 20 October (Figure 3). Generic web scanning is noisy, so a PHP2Shell campaign will show first in signature-based data, not port volumes.
  
  
• Third-party sensors already report attempts. Cloudflare reported in-the-wild exploitation and deployed WAF rules. watchTowr and Hadrian reported attempts soon after the patches. Proof-of-concept code circulated before the PHP 8 fix was available.
  
  
• Vulnerability intelligence chatter is high. Our feeds logged 69 and 64 sightings of the two CVEs within a day of publication, an unusually fast rise for a newly published CVE.

Figure 3: DShield honeypot activity on web ports, distinct attacking sources per day (30-day baseline)
Source: SANS Internet Storm Center DShield (CC BY-NC-SA 4.0), via the FSP platform. This baseline is what a PHP2Shell spike would be measured against.

Our assessment It is highly likely (80 to 90%) that automated, mass exploitation of PHP2Shell against internet-facing PHP begins within the next 7 days. Working exploit details leaked before the patch, exploitation is already reported, and the attack surface is enormous. Early activity will likely focus on opportunistic web shell deployment, cryptomining and initial access for resale. Ransomware affiliates may follow against organisations with unpatched, end-of-life PHP in their perimeter. Organisations whose PHP footprint sits with suppliers or hosting providers are likely to find out about exposure late. Ask them directly.

How our AI-driven platform handled it

Events like PHP2Shell are where an intelligence platform earns its keep. Here is what ours did in the first day:

Capability	What it did for PHP2Shell
Early warning	Ingested the CERT-EU advisory 52 minutes after publication, about 14 hours before the CVE records themselves were published.
Automated correlation	Linked 13 advisories and reports from 11 sources to both CVEs automatically, with a median ingest time of 14 minutes. Analysts got one story, not a dozen alerts.
AI enrichment	A locally hosted large language model reads every article, extracts the CVEs, products, exploitation claims and affected sectors, and grades source reliability. No customer data leaves our infrastructure.
Exposure mapping	Matched passively observed PHP versions on every monitored estate against the PHP project’s affected ranges and fixed releases within hours of the advisory.
False positive control	Version-inferred matches go through an AI exposure check, which rules out matches the evidence does not support (for example, a module that is not present). Customers hear about real exposure, not noise.
Honeypot and exploitation watch	Monitors honeypot, sensor and KEV data for the first sign of exploitation and raises the priority automatically when it appears.

What to do now

Patch first

• Upgrade every PHP instance to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution’s fixed package), starting with internet-facing servers, and Apache with mod_php in particular.
  
• Restart PHP-FPM pools and web servers after patching. A patched binary on disk does not protect a long-running process.
  

Deal with end-of-life PHP

• Treat any internet-facing PHP 8.1 or earlier as exposed with no fix. Upgrade, or remove it from the internet and put it behind authentication or a VPN until you can.
  
• Commercial extended-support builds may receive backports. Confirm with the vendor in writing.
  

Reduce exposure while you patch

• Turn on WAF protection where you have it. Cloudflare and other providers have published rules for known exploit vectors. Treat this as a stopgap, not a fix.
  
• Review request size, body and upload limits on internet-facing PHP. The OOM variant depends on driving requests into out-of-memory conditions.
  

Hunt for signs of compromise

• Look for bursts of “Allowed memory size exhausted” fatal errors, or crashing PHP-FPM workers, from unusual sources since 20 October.
  
• Check for new or modified .php files in web roots and upload directories (web shells), and for unexpected child processes of httpd, nginx or php-fpm (sh, bash, curl, wget, python).
  
• Watch for outbound connections from web servers to unfamiliar hosts, and for new cron jobs or scheduled tasks.
  

Look beyond your own servers

• Inventory PHP you do not host: marketing sites, CMS platforms, e-commerce, LMS, intranet tools, and appliances or control panels with embedded PHP.
  
• Ask key suppliers and hosting providers whether they are affected and when they will patch, and record the answers.
  
  
  

What we are doing for FSP customers

• We check each Threat Intelligence customer’s monitored internet-facing estate against the affected versions. If we identify likely exposure, we contact you directly with the specific hosts and versions.
  
  
• Watching honeypot, sensor and exploitation feeds continuously, and updating this assessment when exploitation is confirmed or the picture changes.
  
  
• Tracking supplier exposure, so you know which of your third parties are likely to be affected.

If you would like a tailored exposure check, or help assessing PHP you do not host directly, please contact cyber@fsp.co

Sources

Published (UTC)	Source	Title
2026-10-20 22:33	CERT-EU	2026-018: Critical Vulnerabilities in PHP https://cert.europa.eu/publications/security-advisories/2026-018/
2026-10-21	CERT-FR	Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014) https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-014/
2026-10-21 07:02	SecurityWeek	PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/
2026-10-21 10:13	Security Affairs	PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws https://securityaffairs.com/201403/security/php-prepares-emergency-fixes-for-two-critical-remote-code-execution-flaws.html
2026-10-21 12:00	CISA	Critical Vulnerabilities in PHP Require Immediate Patching https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
2026-10-21 12:44	SANS ISC	Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow] https://isc.sans.edu/diary/rss/33440
2026-10-21 13:40	CyberScoop	Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
2026-10-21 13:51	Help Net Security	PHP2Shell: Critical PHP vulnerabilities patched, update now! https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
2026-10-21 14:17	The Record	Hundreds of websites taken offline as concern grows over two PHP vulnerabilities https://therecord.media/php-script-vulnerabilities-warnings
2026-10-21 14:52	Hackread	PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities https://hackread.com/php-releases-emergency-fixe-php2shell-vulnerabilities/
2026-10-21 15:26	Krebs on Security	Widespread PHP Flaw May Cause Many Site Outages Today https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
2026-10-21 16:50	SecurityWeek	PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/
2026-10-21 17:30	The Record	PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 https://therecord.media/php-foundation-statement-critical-vulnerabilities
2026-10-21	PHP project	GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (php-src security advisories) https://github.com/php/php-src/security/advisories
2026-10-21	Wiz	PHP2Shell research https://www.wiz.io/blog/php2shell-php-rce