NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedBeing used in attacksUpdated

PHP2Shell flaws exploited: emergency PHP fixes released, but product updates and a follow-up fix remain

PHP2Shell lets attackers run code on vulnerable web servers without logging in. The original two flaws have PHP fixes, but bundled-product updates remain uneven and a separate follow-up awaits release. Ask your website host or IT team to confirm protection.

What to do

If you own a website, ask its host or IT team to confirm the running web server uses PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or a supplier-confirmed backported fix, and that every PHP worker has been restarted. Also ask them to apply PHP's session.upload_progress.enabled=0 advice for the follow-up issue until its fix arrives. Ordinary website visitors have no PHP update to install.

What’s happening

PHP2Shell covers two critical flaws in PHP, software that runs websites and online services. They can let an attacker run code without logging in, with the permissions of the web server process. PHP identifies all installations serving web requests as at risk, with Apache mod_php at highest risk; exploitability depends on the server, configuration and application. Emergency releases on 21 October fixed both original flaws across supported stable PHP branches. ITPro reported precautionary shutdowns affecting UK government services and Orange websites, alongside millions of attack attempts reported by Cloudflare. CISA subsequently listed both flaws as exploited. Protection remains partial across products that bundle PHP: Red Hat still describes outstanding updates, and the Dutch NCSC's 2 November inventory records unresolved exposure. A separate session upload-progress issue, CVE-2026-115560, still awaits a regular PHP release as of 3 November; PHP provides a protective setting for its unusual configuration requirements.

What
Flaw
Affects
PHP web servers and products that bundle PHP
Affected
For CVE-2026-109618 and CVE-2026-109619, PHP's advisories list releases before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on their respective branches.
PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; precise exposure depends on configuration and application behaviour.
PHP 8.1 and older are outside upstream support; distribution and LTS supplier fixes must be checked separately.
CVE-2026-115560: applications with session upload progress enabled that configure php_binary or php_serialize, then switch to php at runtime before starting the session; PHP has not yet published full affected-version details.
Fixed in
PHP 8.2.35 — CVE-2026-109618 and CVE-2026-109619
PHP 8.3.36 — CVE-2026-109618 and CVE-2026-109619
PHP 8.4.27 — CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12 — CVE-2026-109618 and CVE-2026-109619
PHP 8.6.0 RC4 — fixes both original flaws in the development branch; PHP warns against production use
CVE
CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
Since
20 Oct 2026

Timeline

  1. Update

    The Dutch NCSC's inventory listed 930 products: 167 marked fixed, 215 vulnerable and 93 under investigation, with others runtime-dependent, unaffected or unknown. These are inventory classifications, not counts of compromised systems.

  2. CISA added

    CISA added both original PHP2Shell flaws to its Known Exploited Vulnerabilities catalogue, according to ITPro's 28 October report. US federal civilian agencies were given until 29 October to apply fixes.

  3. Update

    Red Hat's revised bulletin said some fixes were available and others remained in progress. It also said RHEL 7 was affected by CVE-2026-109619 but lacked the vulnerable code for CVE-2026-109618.

  4. Vendor revisedPartly fixed

    PHP disclosed a separate, unlikely remote code execution issue, CVE-2026-115560, awaiting the next regular release. It recommended disabling session upload progress; applications that never change their session serialisation handler at runtime are not exposed to this issue.

  5. Wider attacks

    ITPro reported that Cloudflare had counted millions of exploitation attempts. Dozens of UK government services and some Orange websites were taken offline as a precaution while organisations assessed exposure and patched.

  6. New fixPartly fixed

    PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing CVE-2026-109618 and CVE-2026-109619. Organisations using distribution packages or bundled PHP still needed their supplier's updates.

  7. Made publicNo fix yet

    PHP announced emergency updates for two critical flaws for 21 October. BleepingComputer reported that information had leaked before the planned disclosure.

Sources

  1. PHP October security releases and session upload-progress warningPHP · 23 Oct 2026
  2. RCE via OOM corruptionPHP · 21 Oct 2026
  3. RCE via stale global statePHP · 21 Oct 2026
  4. RHSB-2026-013: PHP request-handling memory corruptionRed Hat · 23 Oct 2026
  5. PHP warns administrators ahead of emergency security updatesBleepingComputer · 20 Oct 2026
  6. PHP attack attempts and precautionary website shutdownsITPro · 22 Oct 2026
  7. CISA urges federal agencies to patch after PHP exploits observedITPro · 28 Oct 2026
  8. PHP2Shell operational guidance and software inventoryNCSC-NL · 2 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS