PHP2Shell: The Fix Is Out. Patch PHP Today, and Don't Wait for an Indicator List, Because There Won't Be a Useful One.
PHP has shipped fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. Details and an exploit tool called PHP2Shell leaked before the fix, so attackers had a head start. If you run PHP on anything that answers web requests, update today: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's package. This post covers who is exposed, what to do if you cannot patch yet, and what our own instruments can and cannot see of this attack.
Who is exposed
PHP's advisory says the flaws affect every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the highest risk, because there is a demonstrated exploit in which an unauthenticated request triggers the bug before any application code runs. That last part matters. Your application firewall plugin, your WordPress security plugin and your Magento extension all run after PHP has already parsed the request. They are not in the way.
The two bugs, in plain terms:
CVE-2026-109618. If PHP runs out of memory at the wrong moment while setting up a request, cleanup can treat half-built data as valid. An attacker who can push a request toward the memory limit can turn that into code execution.
CVE-2026-109619. Internal state that belongs to one request can survive after its memory is freed, and the next request handled by the same worker can use it. So leftover state from one request can be picked up by the next.
What to do
Patch. 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and long-term-support vendors received the patches in advance, so your package manager may already have them. If you use the volunteer-run Remi repository, PHP says it will not have updates today; switch to distribution packages or build from source.
On 8.1 or older. The PHP project no longer ships releases for these, but given the severity it published minimal source backports for 7.4, 8.0 and 8.1. Use those, an LTS vendor's backport, or upgrade.
If you cannot patch in the next few hours, PHP lists settings that reduce exposure without making you safe. Set them in php.ini, the FPM pool or the server configuration, never with ini_set() or a .user.ini file, and restart every worker:
Close the side door. If your site sits behind Cloudflare or another WAF, make sure the origin only accepts connections from it. Cloudflare's emergency rules do nothing for a request that goes straight to your server's IP.
Look back. The exploit tool leaked on October 20 and Cloudflare reported attacks the next morning. If you were unpatched in that window, check for files that appeared in web-writable directories since October 20 and for PHP workers that crashed or restarted unusually often.
Why there is no useful indicator list
Most campaigns we cover come with something to block: an IP address, a domain, a file hash. This one mostly does not. The attack is carried inside an ordinary-looking request to any PHP page on your site, in the body and the request headers, and it can come from anywhere. An IP blocklist will catch a few noisy scanners and miss the rest.
We checked our own instruments, and that is what they say:
Our GitHub harvester picked up the first public proof-of-concept repositories at 06:01 UTC on October 21 and had 10 by 12:01. Those times are when we collected other people's public code, not detections. We have not vetted the repositories. Leak-day "exploit" repositories are a well-known lure for researchers, so do not run them.
The harvester turned 8 of them into path-matching detection rules. Our feed's own filter already held back 3. The other 5 reached our STIX bundle, including a documentation placeholder (victim.tld) and a path pulled from next to embedded image data. For this bug, a path rule is the wrong shape anyway: the payload is in the request body, not the URL. We have tightened the filter that decides which harvested paths ship; measured across all 4,453 stored harvester rules, it withholds 35 that were junk and changes nothing else. It is in testing, not yet deployed. (Corrected October 21: an earlier version of this post said all 8 ship.)
Our edge found no match for those paths across 11,617 blocked requests, 4,131 decoy hits and 103 requests that reached the origin since October 14. Given the point above, that zero tells you nothing about whether anyone is attacking PHP. It only tells you nobody requested those paths from us.
Our own exposure. We checked: none of our containers or servers run PHP, and our blog is hosted by Wix. We had nothing to patch before publishing this.
Why this one will be worked fast
Two days ago, NorForge and Reuters described one operator whose AI agents tried more than 1,200 websites and got into more than 100 companies, at roughly $50 per successful break-in. One documented intrusion went through PHP: unsafe handling of stored PHP objects in old Zend Framework code. That is the economics a pre-authentication PHP bug with a leaked exploit tool walks into. A target list of PHP shops is cheap to build, and trying each one costs an agent a few dollars. Assume your site will be tried even if nobody has heard of you.
The full advisory, the downloads and the source backports are on php.net: php.net security advisory and downloads.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=php2shell-the-fix-is-out-patch-php-today-and-don-t-wait-for-an-indicator-list-because-there-won
Comments