PHP2Shell Vulnerabilities Exploited: Patch PHP Before Oct 29

CISA added the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after honeypots caught attackers running code on an unpatched PHP server. The flaws are in the PHP runtime itself, so updating WordPress or Joomla does not close them.

What are the PHP2Shell vulnerabilities, and why did CISA list them?

PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP interpreter. An attacker with no account or privileges on the server can use them to run code, though both require high attack complexity. PHP has not published the bug class or the affected version range.

CISA listed both on October 26, calling flaws of this type “a frequent attack vector for malicious cyber actors.” Under BOD 26-04, federal civilian agencies must fix them by October 29. PHP runs roughly 70% of websites, by VirusTotal’s estimate.

What happened before and after the patches shipped?

Amazon Threat Intelligence first observed targeting around October 17, four days before the patches. CVE IDs and mitigation guidance meant for critical-infrastructure providers leaked, and proof-of-concept code appeared online; the PHP team said none of it worked.

Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack logged widespread attempts before disclosure, all unsuccessful. We explain how these sweeps work in how hackers find and target vulnerable websites.

PHP shipped fixes on October 21. That weekend, Adel Karimi, detection and response lead at Perplexity, reported honeypot evidence of remote code execution against Apache mod_php running PHP 8.4.26.

A third RCE flaw, CVE-2026-115560, has no patch. The PHP team published mitigations on October 23, saying it works only against an unusual combination of configuration and application code. Apply them now.

How do you patch and verify the PHP runtime?

Install the October 21 PHP security release for your branch, then confirm the web tier runs it.

• Check the runtime that serves the site. php -v reports the CLI binary, not the mod_php module or PHP-FPM pool. Run apache2ctl -M | grep -i php, then check FPM pools, hosting-panel PHP selectors and container images.
• Account for backports. Debian, Ubuntu and RHEL often patch without changing the upstream version number; compare the package build with your distribution’s advisory.
• Move off end-of-life branches. PHP 7.4, 8.0 and 8.1 get no official fix. Migrate to a supported branch.
• On shared hosting, ask your host which PHP version and server API your account uses. You cannot patch PHP from the WordPress dashboard.

A web application firewall can filter scanning traffic while you patch, but it does not replace the update.

Is the server clean once PHP is updated?

Not necessarily. The patch closes the entry point but not any web shell, cron job or stolen credential planted earlier. Review activity back to at least mid-October for:

• Shell or utility processes spawned under Apache or PHP-FPM workers
• New or modified PHP files in document roots, uploads and cache directories
• Unknown admin users and unfamiliar scheduled tasks
• Outbound connections from web workers to unknown hosts

Preserve logs before rebuilding. Rotate database passwords and API keys after cleanup, or an attacker still on the server can read the new ones. Our antivirus website protection scans site files for leftover backdoors.

Sources: CISA’s KEV catalog, the PHP security team’s October 21 release announcement, and BleepingComputer.

FAQ

Does PHP2Shell affect WordPress and Joomla sites?

Yes, if the server runs an unpatched PHP build. CMS, plugin and theme updates do not fix the interpreter.

Which PHP versions are vulnerable to PHP2Shell?

The full range is unpublished; the confirmed compromise ran PHP 8.4.26. Install the October 21 release, or migrate off end-of-life branches such as 7.4, 8.0 and 8.1.

Does the October 29 deadline apply to my business?

Legally, BOD 26-04 binds only U.S. federal civilian agencies. With exploitation confirmed, patch on the same timeline anyway.

If your site ran unpatched PHP at any point since mid-October, have it checked for leftover backdoors. Our website protection plans include malware cleanup and a firewall.