PHP2Shell Flaws Are Being Exploited Against Internet-Facing Systems

Two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being targeted in attacks against exposed systems. The flaws allow unauthenticated remote code execution in affected PHP installations.

The PHP project released fixes on October 21, 2026. Patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The evidence packet does not identify a fixed release for PHP 8.1 or earlier.

Why it matters

PHP is not limited to websites. It is also embedded in the management interfaces of some firewalls, VPN gateways, application delivery controllers, and network-attached storage products. In those appliances, administrators may not be able to update PHP directly because the runtime is bundled into the vendor’s firmware.

That creates a second patching problem: even after the PHP project publishes a fix, appliance owners may need to wait for a vendor firmware or software update. Until then, an internet-exposed management interface can remain a potential entry point.

Reports indicate active exploitation, but the public evidence does not establish that every affected product or PHP deployment has been compromised. CISA added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, while a separate Linux kernel flaw, CVE-2026-46300, has reportedly been chained with them in attacks against an unnamed firewall platform.

Dream researchers described a campaign involving 25 servers across the United States, Japan, Taiwan, and South Korea, including systems connected to a US government-affiliated environment. A separate summary from Wordfence described 24 internet-facing firewalls and an internal management server. The public reporting does not identify the firewall vendor, and the underlying artifacts have not been independently verified in the supplied material.

Wordfence reported roughly 77,600 PHP2Shell-related requests from more than 2,000 IP addresses between October 23 and October 27. Those requests showed scanning and exploitation attempts, but request activity alone does not prove that an attack succeeded. As of October 28, Wordfence said it was not aware of a WordPress site compromised through PHP2Shell.

What administrators can do

For servers that run PHP directly, update to a release containing both fixes and restart PHP. Updating WordPress does not update the PHP runtime underneath it. Site owners should also confirm which PHP version their hosting provider is actually running rather than relying on a WordPress update status.

For appliances and other products that bundle PHP:

• Check the vendor’s security advisory or firmware release for CVE-2026-109618 and CVE-2026-109619.
• Apply the vendor update when it becomes available.
• Follow the infrastructure guidance cited in the supplied reporting and avoid exposing PHP-backed management interfaces directly to the internet while waiting for a fix, where that can be done without disrupting required administration.
• Review logs for suspicious requests and investigate any signs of command execution, unexpected files, credential access, or persistence. An attempted request is not proof of compromise, but it can justify a closer review.

Google’s Cloud security bulletin says supported PHP versions in Cloud Run, Cloud Run functions, and App Engine Standard were patched, while customers with workloads using PHP were told to redeploy with updated dependencies. The supplied evidence does not show that every Google Cloud workload is automatically protected, so deployment-specific guidance remains necessary.

The confirmed facts are that PHP2Shell affects vulnerable PHP versions, fixed releases are available, and exploitation attempts have been observed. The full scope of successful exploitation across websites, cloud workloads, and network appliances remains unclear. Patching the PHP runtime or the relevant vendor firmware is the direct defensive step supported by the available evidence.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.