PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure
Executive Summary
In October 2026, PHP disclosed a second unpatched remote code execution vulnerability, CVE-2026-115560, just two days after emergency patches addressed the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. The PHP2Shell vulnerabilities, patched on October 21 in versions 8.2.35 through 8.5.12, allowed unauthenticated attackers to execute code on web servers. Exploitation attempts surged from tens of thousands within 45 minutes of disclosure to millions by October 22, with threat actors attempting to deploy a Mirai botnet variant. CVE-2026-115560 affects a narrow configuration involving session serialization handler switching and requires disabling session upload progress as a temporary mitigation.
This incident illustrates the compounding risk of staggered vulnerability disclosures in widely deployed open-source runtimes. The rapid weaponization of PHP2Shell flaws—with honeypot detections four days before official disclosure—signals increasingly shortened exploit development windows, forcing organizations to treat patch cadence and network-layer egress controls as non-negotiable security baselines.
Why This Matters Now
PHP powers a significant portion of the global web, making unauthenticated RCE vulnerabilities in its core engine an immediate, mass-scale threat. With exploit attempts reaching millions within hours of disclosure, the PHP2Shell campaign and the follow-on CVE-2026-115560 warning demonstrate that attackers are operationalizing exploits faster than patch cycles can respond—demanding inline traffic inspection and egress controls as compensating controls while fixes are in progress.
Attack Path Analysis
Attackers exploited unpatched PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026, with exploit attempts beginning as early as October 17 — four days before public disclosure — indicating prior knowledge or rapid weaponization. Within 45 minutes of the advisory, Cloudflare observed exploit attempts scaling from tens of thousands to millions by October 22, with threat actors attempting to install a Mirai botnet variant on vulnerable PHP web servers, targeting internet-exposed applications lacking inline inspection or egress enforcement controls.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scanned for and targeted internet-exposed PHP web servers vulnerable to CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution flaws in PHP. Exploit attempts were logged by Amazon honeypots on October 17, four days before public disclosure, suggesting pre-patch weaponization. Mass exploitation campaigns launched immediately after the October 21 advisory, with millions of attempts observed. A secondary unpatched vulnerability, CVE-2026-115560, was also disclosed, exploitable only under narrow session handler misconfigurations. CNSF Relevance: Inline IPS (Suricata) with CVE signature coverage could have detected and blocked exploit payloads at the network perimeter; Cloud Firewall (ACF) could have restricted inbound access to PHP application surfaces from unauthorized sources.
Related CVEs
CVE-2026-109618
CVSS 9.8A critical unauthenticated remote code execution vulnerability in PHP's CGI/FastCGI request handling (PHP2Shell) allows a remote attacker without credentials to execute arbitrary code on a web server running an affected PHP version.
Affected Products:
PHP Group PHP – < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12
Exploit Status:
exploited in the wildCVE-2026-109619
CVSS 8.1A critical unauthenticated remote code execution vulnerability in PHP's session handling (PHP2Shell) allows a remote attacker without credentials to execute arbitrary code on a web server running an affected PHP version, exploitable via session upload progress mechanisms.
Affected Products:
PHP Group PHP – < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12
Exploit Status:
exploited in the wildCVE-2026-115560
CVSS 8.1An unpatched remote code execution vulnerability in PHP affecting web applications that dynamically switch session serialization handlers via ini_set() before calling session_start() with session upload progress enabled, potentially allowing arbitrary code execution under a narrow but specific configuration.
Affected Products:
PHP Group PHP – 8.2.x, 8.3.x, 8.4.x, 8.5.x
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Exploitation for Client Execution
Server Software Component: Web Shell
Compromise Infrastructure: Botnet
Deploy Container
Network Denial of Service
Active Scanning: Vulnerability Scanning
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Application of Security Patches and Updates
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Vulnerability Remediation and Incident Response Planning
Control ID: Section 500.7 — Access Privileges & Section 500.16 — Incident Response
DORA (EU 2022/2554) – ICT Vulnerability and Patch Management for Financial Entities
Control ID: Article 9 — ICT Security Policies and Article 10 — ICT Systems Management
NIS2 Directive (EU 2022/2555) – Vulnerability Handling, Patch Management, and System Hardening
Control ID: Article 21 — Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Application-Layer Threat Detection and Automated Response
Control ID: Application Pillar — Visibility and Analytics / Automation and Orchestration
ISO/IEC 27001:2022 – Technical Vulnerability Management and Timely Remediation
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Internet
PHP RCE vulnerabilities CVE-2026-109618/109619 directly threaten internet-facing web applications, with millions of botnet exploit attempts logged, risking full server compromise and lateral movement across hosted services.
Information Technology/IT
IT infrastructure running PHP web servers faces critical vulnerability exploit and Mirai botnet installation risks, demanding immediate egress controls, inline IPS signature updates, and zero trust segmentation to contain lateral movement.
Computer Software/Engineering
Software platforms built on PHP stacks are exposed to unauthenticated RCE via session serialization flaws, requiring multicloud visibility, anomaly detection, and east-west traffic controls to prevent exfiltration and command-and-control compromise.
Financial Services
Financial web applications using PHP risk unauthorized code execution enabling botnet installation and data exfiltration, with PCI 4.0 and NIST.800-53 compliance obligations demanding urgent egress policy enforcement and intrusion prevention deployment.
Sources
- PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patcheshttps://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.htmlVerified
- PHP Official Security Archive - October 2026 Advisorieshttps://www.php.net/archive/2026.php#2026-10-23-1Verified
- GitHub Security Advisory GHSA-6wmf-4rv5-p3rp - PHP2Shell RCE (CVE-2026-109619)https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpVerified
- PHP Issues Emergency Patches for Two Critical PHP2Shell Flawshttps://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.htmlVerified
- PHP2Shell Exploit Attempts Hit Millions Within Hours of Disclosure - Cloudflare Reporthttps://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.htmlVerified
- Amazon Honeypot Logs Pre-Disclosure Exploit Attempt Against PHP2Shell CVEshttps://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.htmlVerified
- NVD Detail - CVE-2026-109618https://nvd.nist.gov/vuln/detail/CVE-2026-109618Verified
- NVD Detail - CVE-2026-109619https://nvd.nist.gov/vuln/detail/CVE-2026-109619Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers exploited unauthenticated RCE vulnerabilities in internet-exposed PHP servers to install Mirai botnet variants, relying on unrestricted inbound access, open east-west paths, and uncontrolled egress to propagate and establish C2 channels. By enforcing segmented access, inline inspection, and identity-aware egress policies, CNSF would likely have reduced attacker reachability and constrained the blast radius across multiple stages of the attack chain.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection with CVE signature coverage could have detected and limited exploit payload delivery to vulnerable PHP application surfaces, while inbound access controls would likely have reduced the reachable attack surface by restricting which sources could initiate connections to exposed PHP endpoints.
Control: Zero Trust Segmentation
Mitigation: Zero Trust identity-based segmentation policies would likely have constrained the scope of what the compromised web server identity could reach, limiting the workload's ability to access adjacent namespaces, sensitive metadata endpoints, or elevated IAM paths beyond its defined least-privilege boundary.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement policies would likely have constrained the compromised PHP host's ability to initiate connections to internal services and adjacent workloads, reducing how far Mirai propagation scanning and lateral pivoting could reach within the cloud environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely have surfaced anomalous outbound connection patterns and repeated beaconing behavior from the compromised PHP host, providing the detection signal needed to constrain further C2 activity before DDoS participation or additional payload delivery could occur.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement with FQDN-based filtering would likely have limited outbound data transfers to only approved destinations, reducing the viable paths available for encrypted exfiltration of credentials, tokens, or application data to attacker-controlled infrastructure.
Where prior CNSF controls reduced attacker reachability and egress paths, the residual blast radius of successful compromise would likely be constrained to the directly affected PHP workload rather than spreading to adjacent infrastructure, limiting botnet enrollment to a smaller number of hosts and reducing the attacker's ability to weaponize the environment for sustained DDoS participation or persistent access.
Impact at a Glance
Affected Business Functions
- Web Application Hosting and Delivery
- Server-Side Application Execution Environments
- Content Management System (CMS) Operations
- E-commerce Transaction Processing
Estimated downtime: 7 days
Estimated loss: N/A
No confirmed data exfiltration has been reported to date. However, successful exploitation of CVE-2026-109618 or CVE-2026-109619 could expose all data processed by affected PHP web applications, including customer PII, session tokens, authentication credentials stored server-side, application source code, and database connection strings. Attempted Mirai botnet installations, if successful, would result in server compromise enabling credential harvesting, lateral movement, and participation in distributed denial-of-service infrastructure. CVE-2026-115560 poses a narrower but similar theoretical risk for applications with the specific misconfiguration, with no confirmed exploitation or data exposure reported.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with updated signatures for CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560 exploit patterns to detect and block unauthenticated RCE payload delivery at the network perimeter before reaching vulnerable PHP application surfaces.
- • Enforce Egress Security & Policy Enforcement with FQDN-based filtering on all outbound traffic from web-tier workloads to block Mirai C2 beaconing and unauthorized outbound connections to attacker-controlled infrastructure immediately upon compromise detection.
- • Apply Zero Trust Segmentation with identity-based microsegmentation policies to isolate PHP web server workloads, ensuring that a compromised host cannot initiate east-west connections to internal databases, APIs, or adjacent services without explicit policy authorization.
- • Enable Multicloud Visibility & Control to baseline normal outbound traffic patterns from PHP application hosts and configure anomaly alerting for deviations consistent with botnet C2 beaconing, port scanning, or bulk outbound data transfers indicative of post-compromise activity.
- • As an immediate compensating control, set session.upload_progress.enabled=0 across all PHP deployments to mitigate both CVE-2026-109619 and CVE-2026-115560 until official patches are applied in the next PHP routine release, and validate that PHP versions are updated to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for the two already-patched PHP2Shell flaws.
