Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

What it is

Huntress rapid-response post, written on 20 October 2026, on two unpatched PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Public reporting describes them as remote code execution. Researchers call the pair "php2shell". A Hacker News post leaked them on 20 October, and watchTowr confirmed they were real. The PHP team moved its release from Thursday to Wednesday 21 October 2026, 14:00 UTC (10am ET). It reserves the right to ship sooner if details leak further or exploitation appears.

Preconditions / Affected

PHP has not published affected versions. Reports point to PHP 5, 6, 7 and 8. Some researchers expect fixes only for currently supported PHP 8 branches, so Huntress warns that PHP 5, 7 and 8.0/8.1 may never get a fix. It is not known which component is involved, whether a plain web request reaches it, or whether a particular configuration is required. Huntress has not reproduced a PoC and knows of no public exploit code. A short exploit video was posted and removed. No IOCs are confirmed.

What to do

Before the release:

• Inventory every PHP install, including vendor appliances and Windows software that bundle php.exe or php-cgi.exe, control panels such as cPanel and Plesk, and WordPress, Drupal, Joomla and Magento hosts.
• Patch internet-facing systems first once fixed versions are published. Check your Linux distribution and hosting provider for backported packages.
• Move end-of-life PHP off the internet, or put it behind a VPN or WAF, until it is upgraded.
• On Linux servers without endpoint detection, run Florian Roth's free process-watcher, starting in observe mode.

Detection cues, based on the expectation that exploitation will show as odd child processes of PHP workers (php-fpm, php-cgi, php-cgi.exe, httpd, apache2):

• Shells: sh, bash, cmd.exe, powershell.exe.
• Interpreters: python, perl.
• Download or network tools: curl, wget, nc, certutil.exe.
• Reverse shell strings in command lines: /dev/tcp/, fsockopen, mkfifo.
• Recon run from the web server: whoami, id, uname -a, ipconfig.

If you find a hit, isolate the server and preserve web server and PHP logs. Then look for webshells and new files in the web root, new cron jobs, scheduled tasks and accounts.

One unrelated pattern Huntress saw the week before: a PHP FastCGI process repeatedly ran a one-liner. It wrote a small PHP file with random marker strings to the first writable temp directory, ran it, then deleted it. If no directory was writable, it printed !notwrtbl!.

Caveats

The detection guidance is a prediction, not observed php2shell behaviour. Huntress says the FastCGI incident is not related to php2shell. Sigma and YARA rules are promised at huntresslabs/threat-intel only after technical details are public. Affected and fixed versions are due with the 21 October release, so this post will be superseded by it.