What CISA, ENISA, Cloudflare, and AWS say about PHP2Shell

PHP project and the PHP Foundation

php.net’s 21 October advisory is the operational source. It says both flaws can allow unauthenticated remote code execution, that every PHP installation serving web requests is at risk, that mod_php is the highest risk, and that only an update is a complete fix. Fixed releases named there are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP Foundation’s same-day post says full remote code execution was demonstrated on Apache mod_php with default settings, before application code runs, and that remote code execution was also confirmed on PHP-FPM through application-level paths. The Foundation does not, in that post, publish a count of in-the-wild compromises.

NVD

Tanium’s timeline says NVD published CVE-2026-109618 on 21 October 2026 at 14:17 UTC and marked it “Undergoing Analysis.” This site links the NVD detail pages for both CVEs. A direct fetch of the CVE-2026-109618 page on 22 October returned the NVD shell without the analysis text, so this page does not claim to have re-read NVD’s current status. If NVD still says the record is undergoing analysis, treat the PHP advisory as the source for the score and the fix. Tanium also says a CISA KEV catalog update at 14:04 UTC the same day listed neither CVE.

CISA

CISA’s alert, released 21 October 2026, tells organizations to patch immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, to inventory PHP including where it is only a component, and to take systems offline if they cannot update, including PHP 8.1 and earlier. It says a web application firewall may provide some protection until then. On exploitation it says: CISA had not observed exploitation as of publication. The alert does not say either CVE was added to the Known Exploited Vulnerabilities catalog. watchTowr’s FAQ, updated 22 October, still lists CISA KEV as not listed. Expel said the same as of 21 October at 20:00 UTC. This site has not re-downloaded the catalog.

ENISA and the EU joint statement

ENISA published a joint statement on the critical PHP vulnerabilities. The text retrieved for this site says the PHP security team issued updates on 21 October 2026 at 13:40 UTC, with technical details and the affected and fixed versions accompanying the release, and that the bugs can run malicious code on vulnerable servers without authentication. CERT-EU’s own advisory 2026-018, which Tanium had already flagged as a 20 October product, is a separate document: version 1.1 says the fixes shipped on 21 October at 13:30 UTC, that proofs of concept had begun to circulate, and that this raises the likelihood attackers are already exploiting the bugs. CERT-EU’s advice is to patch immediately or isolate internet-facing applications until a fix is applied and verified. It points operators at the NCSC-NL inventory for products that embed PHP. The 13:30, 13:40, and 14:00 UTC figures are left as each source wrote them.

United Kingdom and the Netherlands

The UK NCSC tells organizations to identify PHP generally, not only old versions, to apply the PHP team’s hardening, and to take a system offline if temporary mitigations cannot be applied in time. It also says to look for compromise if a system stayed exposed, and it points at an NCSC-NL inventory of software with a PHP dependency. That inventory is the NCSC-NL php2shell repository. It restates the PHP project’s warning: unauthenticated remote code execution is possible, and web-serving installations including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed are in scope, with mod_php the highest risk. The list is a starting inventory, not a proof that an unlisted product is safe.

Canada, Germany, Japan, and CERT-EU

• Canadian Centre for Cyber Security, AL26-026, 21 October 2026: both CVEs are described as use-after-free issues that could allow an unauthenticated actor to execute arbitrary code. The centre says it has seen open-source reporting that a proof of concept is available, and that it had not identified active exploitation at that time. It publishes the same four fixed versions and says 8.1 and older get no official PHP release.
• BSI, warning 2026-297981-1032, version 1.0, dated 21 October 2026: CVSS v4.0 9.2 implies unauthenticated remote code execution without user interaction. BSI says no confirmed exploitation was known at that time, and that unconfirmed reports of exploits already existed. The warning describes the patch as announced for 16:00 German time (14:00 UTC) and says it should be installed as soon as it is out. Read it as BSI’s position at publication of that version, not as a later all-clear.
• JPCERT/CC: the 2026 alerts index lists, on 22 October 2026, a notice titled for multiple PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The same morning, JPCERT/CC’s JVN listing includes an entry on multiple PHP vulnerabilities that can allow arbitrary code execution, timestamped 10:30. This site did not retrieve the full alert body, so it does not attribute an exploitation finding to JPCERT/CC beyond those titles.
• CERT-EU 2026-018 is summarized with the ENISA section above. It is the EU institutions’ CERT, not a substitute for the ENISA joint statement.

Cloudflare, including the 22 October attempt figures

Cloudflare’s 21 October blog says WAF rules for customers on free and paid plans were active from 03:02 UTC, that the vulnerability leaked before the official release, and that Cloudflare observed attack traffic and payload changes aimed at those rules. It also says customers should still patch. A Reuters story dated 22 October 2026 quotes Cloudflare CEO Matthew Prince from a post on X. This site has not opened that X post. As Reuters quotes him: in the 10 hours before the public announcement Cloudflare saw thousands of attempts; that jumped to tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and millions by the time of the post. Reuters describes the post as “late on Wednesday” in a story dated 22 October. The same story says government websites in Europe and elsewhere went offline as operators scrambled, and that Mitsubishi UFJ Financial Group and Japan’s Finance Ministry temporarily suspended some services as emergency measures. Those sentences describe shutdowns and suspensions. They do not say those sites were compromised through PHP2Shell.

AWS and watchTowr

AWS says MadPot saw an exploitation attempt on 17 October 2026, four days before disclosure, and further attempts and proof-of-concept exploits on 21 October, including before the embargo lift. AWS says it is unclear whether those attempts would have succeeded on real systems, and, after the patch, that PHP2Shell was being broadly exploited in the wild — meaning the attempts AWS was seeing, not a published list of breached websites. watchTowr says it is observing active exploitation attempts of both CVEs on its honeypot network. SecurityWeek reports that watchTowr had not observed successful attempts. watchTowr’s FAQ, updated 22 October, still marks CISA KEV as not listed.

Datadog, Qualys, Tanium, and Huntress

• Datadog Security Labs says it independently reproduced both issues and that application authentication does not stop the mod_php path, because PHP handles the request before application code runs. It cites AWS’s 17 October attempts and says only patching is a complete fix. This site does not repeat Datadog’s reproduction steps.
• Qualys, in an update dated 21 October 2026, tells customers to prioritize internet-facing PHP, starting with Apache mod_php, and notes that Cloudflare has reported attack traffic, including attempts to evade protections. Qualys publishes detection QIDs and says its PHP-detected check does not by itself prove either CVE.
• Tanium says exploitation in the wild has been reported, that reliable public exploits were still scarce when it wrote, and that neither CVE was in the KEV catalog update it checked on 21 October. It also records the NVD “Undergoing Analysis” mark noted above.
• Huntress’s rapid-response post urges an immediate update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. In the portion of that post returned in search, Huntress said it had not yet seen exploitation across its partner base, while noting that others were seeing attacks emerge. Read the post itself for the timestamp on that sentence.

Distribution and panel vendors, in brief

Red Hat’s bulletin RHSB-2026-013 says some updates are already available and more are in progress. Ubuntu says it has released fixes for affected packages on all supported releases. cPanel says it has released updates for ea-php74 and above. Plesk says fixes are available for the PHP it ships, including specific Plesk Obsidian updates for the panel’s own engine. Detail and the limits of those claims are on the vendor status page.