Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster

What it is

Aikido's post on the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, October 2026) is a vendor account that also gives practical response guidance. It argues that AI-assisted discovery and exploit building will shorten embargoes, so teams should be ready to patch overnight. The page gives little technical detail on the bugs. It says only that the first is an out-of-memory issue, which OSTIF and Quarkslab had flagged in a 2024 audit but left unfixed because no one had shown it was exploitable. Calif (reported under OpenAI's Patch the Planet initiative) and Wiz later found the flaws independently, with proof of exploitation.

Preconditions / Affected

• Any PHP runtime below the fixed release for its branch. The page does not name fixed version numbers.
• PHP 8.4.26 is the unpatched version used in a public test. Debian unstable was still shipping it on release day.
• PHP often sits inside container base images, CI images, hosting panels and vendor software, so it may be present without a deliberate install.
• On shared hosting, owners cannot patch PHP and must wait for their provider.

What to do

• Upgrade to a patched PHP. Aikido also publishes a free checker at php2shell.aikido.io that tests a site for the memory-exhaustion behavior.
• Build an inventory of every runtime and dependency, including ones you did not install. Aikido's Charlie Eriksen calls this the first step.
• For old branches, Aikido's free backported images on its public ECR cover PHP 5.5, 5.6, the 7.x series and 8.2 through 8.5. Swap the image in the Dockerfile. This avoids a major PHP upgrade.
• Check distro packages before assuming the fix is installable. On release day SUSE and Fedora updates were still in testing.
• Cloudflare extended its PHP2Shell WAF rules to all plans, including free, before the patch was out. This is a stopgap if you cannot patch yet.
• Pin versions with lock files and upgrade when CVEs appear. Aikido advises against Renovate-style automatic upgrades to latest, which it says break apps until teams switch them off.
• Ask vendors whether they update guidance as exploitation develops, send live alerts, explain interim exposure reduction and supply fixes.

Timeline

• 17 October: Amazon reports the first exploitation attempts.
• 20 October: the CVE IDs leak. PHP pre-announces at 19:30 UTC.
• 21 October, 14:00 UTC: PHP releases, a day earlier than the planned 22 October.
• 27 October: Censys counts about 11.2 million PHP services on a fixed version and 32.5 million on an affected one. More than 60 million report no version.

Caveats

• The Amazon date, the Pavur test (a participant broke into an unpatched PHP 8.4.26 server in about three hours) and the Trail of Bits exploit built with Codex in a day are reported, not independently checked on the page.
• Estimates about LLM-built exploits (a few hours, per Eriksen) and about faster future disclosures are Aikido's opinions.
• The page promotes Aikido's checker and images, and does not compare alternatives.