PHP2Shell Exploitation Started Days Before Patches

What it is

PHP2Shell is a pair of critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Fixes shipped on 21 October 2026. The page's main finding is timing: exploitation began before the fix existed, and the exposed population is mostly unpatched or end-of-life.

Timeline

• 17 October 2026: Amazon sees the first exploitation, against a honeypot, from a commercial anonymization network, while the flaws were still under embargo. Amazon says it is unclear how the actor got exploit information.
• About 12 hours before disclosure: Amazon sees multiple PoCs from other anonymized infrastructure. The varied payloads and origins suggest several actors.
• 20 October 2026: both issues leak online and PoC circulation speeds up.
• 21 October 2026: patches released.

Cloudflare's Matthew Prince reported thousands of attempts in the 10 hours before the announcement. After it, the count rose to tens of thousands within 45 minutes, hundreds of thousands within 2 hours, and millions. Hadrian and Patchstack also saw attempts before the fixes.

Preconditions / Affected

ThreatLocker's Michael Jenkins says that in some configurations the flaws allow code execution before the security checks run. The page does not describe the mechanism or which configurations.

Exposure counts as of 21 October 2026:

• Censys: about 1.57 million of 1.58 million hosts with an identifiable PHP version were unpatched.
• VulnCheck: more than 2.6 million internet-facing PHP hosts, nearly all vulnerable. At least 1 million run end-of-life versions: over 700,000 on PHP 3.x to 7.3 and nearly 400,000 on 7.4, 8.0 or 8.1.
• VirusTotal: 1.1 million IPs announce a version. About 272,000 run a supported version and about 758,000 run an end-of-life one (PHP 5.4 to 8.1).
• About 920,000 of these hosts are in the US. They sit on a few providers (AWS, DigitalOcean, Alibaba, OVHcloud, Hetzner), so the page says fixes could come through configuration pushes and WAF rules.

What to do

CISA urged updating immediately to one of these releases, which fix both flaws:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

Jenkins also advises investigating for signs of compromise after patching, since exploitation may have started before 21 October. Until systems are patched, he suggests limiting what the web-facing PHP process can launch, read or connect to. He calls this a backstop, not a substitute for patching.

Hosts on PHP 8.1 or older have no fix in this list. Forescout's Sai Molige warns that much of the forgotten infrastructure will have no upstream fix.

Caveats

• Amazon, WatchTowr and others say the observed attempts failed. WatchTowr's Jake Knott says the circulating PoCs do not achieve RCE: they do not work, only test timing differences, or crash the target.
• JFrog has seen fake PoCs and prank malware on GitHub, so public exploit code is unsafe to run.
• VulnCheck saw at least one Chinese IP fail to deploy a webshell through the flaw.
• Forescout's Molige and Expel's Marcus Hutchins compare it to Log4Shell. Hutchins puts it about halfway to Log4j: wider direct impact and easier exploitation, but a shorter tail because PHP is less embedded in third-party software.
• The page gives no exploit mechanism and no detection queries or indicators.