php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks
Executive Summary
In October 2026, the PHP project issued an emergency out-of-band patch release to address two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell' by researchers. Both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5 onward, placing an estimated 1.3–1.9 million internet-exposed hosts at risk. Exploit code and a proof-of-concept video leaked online before the official advisory, prompting Cloudflare to detect early in-the-wild attacks and deploy emergency firewall rules across its entire customer base. Patches were shipped as versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
The php2shell disclosure highlights the compounding risk posed by PHP's enormous installed base—powering 70–80% of known server-side web infrastructure including WordPress, Drupal, and Laravel—combined with the reality that the majority of exposed hosts run end-of-life branches ineligible for official patches. Pre-patch exploit leakage, rapid weaponization, and confirmed early attacks reflect an accelerating trend in which vulnerability disclosure timelines collapse, leaving defenders minimal response windows.
Why This Matters Now
With confirmed early attacks already observed by Cloudflare and working exploit code circulating publicly before the official patch, organizations have an extremely compressed window to respond. PHP underpins the majority of the web, and most exposed servers run unsupported branches, making mass exploitation a near-term reality rather than a theoretical risk. Immediate patching or network-layer isolation of internet-facing PHP applications is critical.
Attack Path Analysis
Attackers exploited two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively 'php2shell') against internet-exposed PHP servers running vulnerable versions, gaining initial footholds by executing arbitrary code on unpatched hosts. From there, attackers escalated privileges on the compromised server, moved laterally across internal workloads, established command-and-control channels via outbound connections, exfiltrated sensitive data, and ultimately caused business disruption or ransomware deployment consistent with known PHP exploitation patterns.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scanned for and targeted over 1.3-1.9 million internet-exposed PHP hosts running vulnerable versions (PHP 5.x through unpatched 8.x branches) using publicly leaked exploit chains for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). By sending crafted HTTP requests to vulnerable PHP endpoints on platforms such as WordPress, Drupal, Joomla, and Laravel, attackers achieved unauthenticated remote code execution. Cloudflare confirmed early attacks emerging within hours of exploit details becoming public. CNSF inline IPS (Suricata) with up-to-date signatures could have detected and blocked known exploit payloads at the network perimeter before reaching the application. Cloud Firewall (ACF) URL filtering and inbound policy enforcement could have restricted access to vulnerable endpoints from untrusted sources.
Related CVEs
CVE-2026-109618
CVSS 9.2A critical remote code execution vulnerability in PHP (dubbed php2shell) rated 9.2 CVSS v4.0, allowing an attacker to execute arbitrary code on a server running affected PHP versions and potentially achieve full system compromise.
Affected Products:
The PHP Group PHP – 5.x, 7.x, 8.0.x, 8.1.x, 8.2.x < 8.2.35, 8.3.x < 8.3.36, 8.4.x < 8.4.27, 8.5.x < 8.5.12
Exploit Status:
exploited in the wildCVE-2026-109619
CVSS 9.2A critical remote code execution vulnerability in PHP (dubbed php2shell), chained with CVE-2026-109618 in observed exploit activity, rated 9.2 CVSS v4.0, enabling unauthenticated attackers to execute arbitrary code on vulnerable PHP-based web servers.
Affected Products:
The PHP Group PHP – 5.x, 7.x, 8.0.x, 8.1.x, 8.2.x < 8.2.35, 8.3.x < 8.3.36, 8.4.x < 8.4.27, 8.5.x < 8.5.12
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Exploitation for Client Execution
Server Software Component: Web Shell
Exploitation for Privilege Escalation
Data Encrypted for Impact
Obtain Capabilities: Vulnerabilities
Active Scanning: Vulnerability Scanning
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Vulnerability Management and Cyber Incident Response
Control ID: Section 500.7 — Access Privileges & Section 500.16 — Incident Response
DORA (Digital Operational Resilience Act) – ICT Risk Management and Incident Classification
Control ID: Article 9 — ICT Security Policies; Article 17 — ICT-Related Incident Management
NIS2 Directive – Vulnerability Handling, Patch Management, and Incident Reporting
Control ID: Article 21 — Cybersecurity Risk Management Measures; Article 23 — Reporting Obligations
CISA Zero Trust Maturity Model 2.0 – Application Segmentation and Micro-Perimeter Enforcement
Control ID: Application Pillar — Visibility and Analytics; Network Pillar — Traffic Filtering
ISO/IEC 27001:2022 – Technical Vulnerability Management and Incident Response
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities; Annex A 5.26 — Response to Information Security Incidents
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
PHP2shell RCE vulnerabilities (CVSS 9.2) expose 1.9M internet-facing servers; IT infrastructure running WordPress, Drupal, or Laravel faces immediate lateral movement and exfiltration risk without zero trust segmentation.
Financial Services
Unpatched PHP vulnerabilities enabling remote code execution threaten PCI 4.0 and NIST 800-53 compliance, risking customer data exfiltration and unauthorized access across web-facing financial applications and portals.
Health Care / Life Sciences
PHP-driven healthcare portals face HIPAA 164.312 violations as CVE-2026-109618/109619 allow attackers to execute code, escalate privileges, and exfiltrate protected health information from unpatched servers.
Internet
With PHP powering 70-80% of known server-side web infrastructure, internet platforms face mass exploitation via php2shell, requiring emergency egress controls, inline IPS signatures, and zero trust segmentation immediately.
Sources
- Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilitieshttps://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/Verified
- CERT-EU Advisory on PHP php2shell Critical Vulnerabilitieshttps://cert.europa.eu/Verified
- UK National Cyber Security Centre - PHP Vulnerability Guidancehttps://www.ncsc.gov.uk/Verified
- Cloudflare Blog - Early Attack Activity on PHP php2shell Vulnerabilitieshttps://blog.cloudflare.com/Verified
- watchTowr - PHP php2shell Vulnerability Reproduction Analysishttps://watchtower.labs/Verified
- PHP Official Security Releases - 8.5.12, 8.4.27, 8.3.36, 8.2.35https://www.php.net/releases/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because PHP exploitation campaigns depend on flat network access, unrestricted egress, and unmonitored east-west paths to move from a single compromised host to broader infrastructure. By enforcing identity-aware segmentation, controlled egress, and inline traffic inspection, CNSF would likely constrain attacker reach well beyond the initial foothold.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline IPS with up-to-date Suricata signatures could have detected and blocked known php2shell exploit payloads at the network perimeter before they reached vulnerable application endpoints, likely reducing the number of hosts successfully compromised during the initial wave.
Control: Zero Trust Segmentation
Mitigation: Identity-aware workload policies enforcing least-privilege access would likely constrain the compromised web server process from reaching IMDS endpoints or cloud management APIs, reducing the attacker's ability to harvest credentials and escalate privilege scope beyond the initially compromised host.
Control: East-West Traffic Security
Mitigation: East-west micro-segmentation enforcing workload-to-workload identity-based policies would likely reduce lateral reachability from the compromised PHP host to adjacent services, limiting how far an attacker could pivot across internal infrastructure even with valid credentials in hand.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across multicloud environments would likely flag anomalous outbound connection patterns from web server workloads to unrecognized external IPs or domains, giving security teams early visibility into active C2 beacon activity that would otherwise blend into normal web traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement with FQDN filtering and outbound traffic controls would likely constrain unauthorized data transfers from compromised web server workloads to attacker-controlled external destinations, reducing the volume and scope of sensitive data that could leave the environment undetected.
Had prior CNSF controls meaningfully reduced lateral reach and credential exposure across earlier stages, the attacker's ability to propagate ransomware payloads across multiple workloads or establish persistent webshell access across interconnected services would likely have been constrained to a smaller subset of the environment.
Impact at a Glance
Affected Business Functions
- Web Application Hosting and Server-Side Execution (PHP-based platforms: WordPress, Drupal, Joomla, Laravel)
- E-commerce Transaction Processing and Customer Data Handling
- Content Management System (CMS) Operations and Digital Publishing
- API and Backend Services for Web-Dependent Enterprise Applications
Estimated downtime: 3 days
Estimated loss: N/A
The vulnerability affects an estimated 1.3 to 1.9 million internet-exposed PHP hosts globally. Successful exploitation could result in full server compromise, exposing all data processed or stored by affected web applications including customer PII, authentication credentials, financial transaction records, proprietary application source code, session tokens, and database contents. Platforms such as WordPress, Drupal, Joomla, and Laravel collectively host millions of sites handling sensitive personal, financial, and health data. Approximately 758,000 servers run end-of-life PHP branches (5.4 through 8.1) with no available patches, representing a permanently elevated exposure risk. The financial loss estimate is set to $0 at aggregate level as no single confirmed victim loss figure has been reported; however, sector-wide losses from exploitation are expected to be substantial given the scale of exposure and historical precedent of PHP CVEs being used in ransomware campaigns.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with updated signatures for CVE-2026-109618 and CVE-2026-109619 exploit patterns at all ingress points to detect and block php2shell exploit attempts against internet-facing PHP applications as an immediate stopgap while patching to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 is completed.
- • Enforce Egress Security & Policy Enforcement with FQDN-based filtering on all workloads hosting PHP applications to block unauthorized outbound connections from web server processes, preventing reverse shell establishment and data exfiltration to attacker-controlled destinations.
- • Apply Zero Trust Segmentation with least-privilege, identity-based policies to isolate internet-facing PHP application workloads from internal databases, credential stores, and adjacent microservices, limiting lateral movement radius if a host is compromised.
- • Enable Multicloud Visibility & Control with centralized traffic observability to baseline normal outbound behavior from PHP application servers and generate alerts on anomalous connections, repeated malformed inbound requests, or unexpected inter-workload communication patterns indicative of active exploitation.
- • For PHP hosts running end-of-life branches (5.4 through 8.1, representing the majority of exposed servers) where immediate patching is not feasible, implement Cloud Firewall (ACF) rules to restrict inbound access to known-safe IP ranges and apply East-West Traffic Security controls to prevent these hosts from initiating connections to sensitive internal segments pending upgrade or decommission.
