Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

FAQ

PHP2Shell FAQ: what operators ask about the PHP RCE

Answers follow the public sources linked at the bottom. Where those sources disagree, the answer says so instead of averaging them.

Last updated

What is PHP2Shell?

A collective name for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in the PHP runtime. The PHP project says they can allow unauthenticated remote code execution on PHP that serves web requests. CISA writes the nickname as “php2shell.”

Which versions are fixed?

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or later releases in those branches. They were published on 21 October 2026. PHP 8.1 and older did not get an official release. Minimal source backports exist for 7.4, 8.0, and 8.1.

Is upgrading the only complete fix?

Yes, according to the PHP project and AWS. memory_limit changes, a smaller post_max_size, disabling session upload progress, and a web application firewall are interim measures. PHP says they do not make an installation safe.

Are both mod_php and PHP-FPM affected?

PHP lists both, plus php-cgi, FrankenPHP, and LiteSpeed. It rates mod_php highest, with a demonstrated unauthenticated exploit before application code runs. FPM is also in scope. The PHP Foundation and the oss-security note emphasize FPM slightly differently; both still tell you to patch FPM.

Is it being exploited?

Attempts: yes, according to AWS, Cloudflare, and watchTowr. AWS dates one honeypot attempt to 17 October 2026, four days before disclosure. Successful compromise of real production systems was not confirmed in the CISA alert, the SecurityWeek account of watchTowr’s sensors, the AWS post (which says success on real systems was unclear), or Expel’s customer note as of 21 October 20:00 UTC.

Are the CVEs in CISA’s Known Exploited Vulnerabilities catalog?

Expel said neither CVE was listed as of 21 October 2026 at 20:00 UTC. Tanium describes a 14:04 UTC catalog update the same day that listed neither. watchTowr’s FAQ, updated 22 October, still says not listed. CISA’s own alert said CISA had not observed exploitation as of publication. Check the live catalog. This site does not re-query it on each visit.

What about PHP 8.1 and older, including PHP 5?

There is no official 21 October release for them. Wiz, Google Cloud, and Cloudflare describe affected versions from PHP 5.4 through the unfixed 8.5 builds. watchTowr has said PHP 5 onward. Expel notes that PHP did not explicitly confirm 7.3 and older in the material it reviewed, and still says to treat end-of-life PHP on the web as at risk. Upgrade, or take it offline.

Does a WAF replace the patch?

No. CISA says a WAF may provide some protection until you patch. Cloudflare deployed rules and still tells customers to patch. The PHP project says only an update is complete.

How many servers are exposed?

The Record reports a VirusTotal analysis of about 5.1 million IP addresses running PHP, not 5.1 million confirmed vulnerable hosts. ThreatCluster’s write-up of that scan says about 1.1 million of them announce a version. Wiz and Cloudflare separately cite PHP’s share of websites, near 70 percent. Those are different measurements.

Do you publish exploit code or a proof of concept?

No. Public reporting says proof-of-concept code exists. Expel warns that some circulating code is unverified and may be malicious. This site links to advisories and will not host payloads or attack procedures.

Is this an official PHP, NVD, or CISA site?

No. phpvulnerabilities.app is an independent briefing. It is not affiliated with the PHP Group, php.net, NVD, NIST, or CISA. Read the advisories we link before you act, and prefer them when we disagree.

What if I cannot patch today?

CISA’s advice is to take internet-facing PHP offline until you can update, especially PHP 8.1 and earlier. If it must stay up for a short time, apply the incomplete settings on the remediation page, keep a WAF in front, and plan the upgrade in hours rather than in a 30-day patch window. That last point is AWS’s lesson from this event, not a promise that hours are always enough.

Sources

Outbound links leave this site. We do not host exploit code.

  1. News archive 2026: security advisory, 21 October 2026 — PHP project (php.net)
  2. Critical vulnerabilities in PHP require immediate patching (21 October 2026) — CISA
  3. Known Exploited Vulnerabilities catalog — CISA
  4. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot — AWS Security Blog
  5. Cloudflare deploys protections against php2shell vulnerability — Cloudflare
  6. FAQ: PHP2Shell CVE-2026-109618 and CVE-2026-109619 (published 20 October 2026, updated 22 October 2026) — watchTowr
  7. Notice: php2shell, critical PHP vulnerabilities (status as of 21 October 2026, 20:00 UTC) — Expel
  8. PHP2Shell patches land as first exploitation attempts hit sensors — SecurityWeek
  9. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Wiz Research
  10. Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 — ThreatCluster (VirusTotal Internet scanning write-up)
  11. PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 — The Record