PHP released emergency fixes on October 21 for two runtime flaws that can let an unauthenticated attacker execute code with a web worker’s permissions. The pair is known as PHP2Shell.

What is exposed

  • CVE-2026-109618 concerns corrupted request memory after an out-of-memory error. Maintainers validated remote code execution against Apache mod_php, including a path before application code starts.
  • CVE-2026-109619 concerns stale state surviving between requests. Maintainers validated session-lifecycle attacks against mod_php and PHP-FPM; the FPM path depends on a suitable application operation.
  • Both advisories rate the flaws 9.2 under CVSS 4.0, a vulnerability-severity scoring system. Actual exploitability depends on the server integration, configuration, extensions, and application.

The affected layer is PHP itself. Updating a WordPress plugin alone does not patch the runtime underneath it. Hosted customers need their provider’s confirmation that the running PHP packages contain the fixes.

What the attack evidence shows

Exploitation status: working research exploits and source-reported activity in the wild.

Amazon Threat Intelligence reports an attempted exploit against its MadPot honeypots on October 17, before public disclosure. It observed further attempts before the October 21 release and says exploitation broadened afterward.

Amazon also says it is unclear whether the earlier attempts would have succeeded against real-world systems. Honeypot traffic establishes observed attempts; it does not provide a verified count of compromised websites. AWS sells cloud and security services, and this account describes its own telemetry.

Brian Krebs reports precautionary outages alongside the emergency patch rollout. Taking a site offline to protect it is different from evidence that it was breached.

What operators should do

  1. Deploy PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a distribution package whose vendor confirms both fixes were backported.
  2. Confirm the web-serving workers actually run patched code. A different command-line PHP installation is insufficient evidence.
  3. If immediate patching is impossible, consult both maintainer advisories for temporary controls and their limits. There is no configuration-only workaround that completely fixes both flaws.
  4. Follow Amazon’s advice to investigate suspicious activity from at least October 17, including unexpected process execution and file changes. Patching closes the vulnerability; it does not undo a prior compromise.

Blocking uploads or changing memory settings can disrupt applications and cover only particular attack paths. Apply temporary measures with the advisory’s prerequisites, rather than copying a universal configuration snippet.

Caveat: PHP’s widespread use is not a measurement of exploitable hosts or successful compromises; the maintainer advisories distinguish demonstrated paths from suspected ones.

Update: October 21, public exploit claims need scrutiny

Elias Taylor challenges the reliability of circulating public exploits, with a divided HN discussion. The PHP Foundation says it found no functional circulating examples at the moment of public release, despite privately validated exploit paths.

These observations concern different evidence and times. They do not negate the maintainer advisories or independently establish the success of attacks reported by telemetry providers. Keep the patch guidance while checking claims of a universal, easy exploit.