Two serious vulnerabilities found in PHP, one of the leading programming languages in web development, have created serious cybersecurity issues. This followed their discovery by researchers, who noticed a malicious hacking attempt just a few days before the public notification.
Grouped under the name PHP2Shell, these vulnerabilities are classified as CVE-2026-109618 and CVE-2026-109619. They both have a CVSS v4.0 score of 9.2 indicating their critical risk level. Hackers can exploit these vulnerabilities remotely and execute harmful instructions without having to validate their identity. Hackers can steal valuables from the servers that present weaknesses.
Vulnerability discoveries
Wiz Research and OpenAI scientific researchers detected and studied the weaknesses independently from each other. The research was coordinated with help by Quarkslab.
According to Wiz Research, the group of scientific researchers consisting of Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz was able to discover the security holes using the latest advancements. According to Wiz Research, the first weakness was found on August 19, 2026, and the report on it was sent to the security team of PHP just a few days after on August 24.
It became clear that the vulnerability was present in the code of PHP for more than ten years.
How Does PHP2Shell Work?
PHP2Shell exploits memory-management weaknesses within PHP’s core engine, particularly when the system encounters fatal errors or runs out of memory while processing requests.
CVE-2026-109618 involves a use-after-free vulnerability associated with upload-progress processing, potentially allowing memory disclosure or remote code execution.
CVE-2026-109619 involves stale internal state, including use-after-free and memory type-confusion conditions, which attackers could exploit to execute malicious code.
Researchers demonstrated successful attacks against PHP-based platforms, including WordPress, Drupal and Joomla.
Because the flaws exist in PHP itself, websites may remain vulnerable even if their applications and plugins are otherwise secure.
Who Are the Perpetrators Behind the Incidents?
The perps remain unidentified.
Nonetheless, the threat intelligence of Amazon unearthed that the exploitation attempts started on October 17, 2026, four days prior to the public notification about vulnerabilities.
The activity was noticed via the MadPot honeypot network of Amazon, which tracks malicious cyberattacks.
The first attempt originated from an unknown IP address. The attempts that happened on October 21 have shown us that different payloads and infrastructure were applied, which indicates the activity of different cybercriminals.
Amazon has not yet revealed if the attempts have accomplished the operation concerning real servers.
Emergency Patches and Global Response
Information about PHP2Shell leaked publicly on October 20, prompting the PHP security team to accelerate its planned security release.
Emergency patches were published on October 21, 2026.
The first patched PHP versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older unsupported versions also require urgent attention.
Following disclosure, security companies observed widespread exploitation attempts. Cloudflare deployed web application firewall protections, while the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to apply security updates immediately.
PHP is used by approximately 70% of websites with a known server-side programming language, making these vulnerabilities particularly significant.
What Action Should Organizations Take?
Organizations must address the problem immediately by updating to the latest PHP versions and checking web server logs for unusual requests, monitoring PHP processes for unwanted activities and tracking back any issues to October 17.
While web application firewall offers a temporary solution, it is essential to implement the PHP patch in order to keep website secure.
