Between 21 and 23 October 2026, PHP2Shell exploit attempts against CVE-2026-109618 and CVE-2026-109619 grew from the first recorded probe to millions of requests. Cloudflare, Previdian, Sophos, Wordfence and others still reported no confirmed remote code execution. The flaws sit in the PHP engine. Sysdig traced that code to PHP 5.4 in 2012, so replacing CMS files does not retire the host.
Key takeaways
- CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each) are unauthenticated PHP engine RCE flaws fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Cloudflare saw tens of thousands of PHP2Shell exploit attempts in 45 minutes and millions by early 22 October 2026. Vendors had not confirmed a shell.
- Sysdig traced the engine bug to PHP 5.4. Older branches have no upstream fix. Sophos saw failed attempts to install the Potassium botnet.
- Censys assessed more than 34.4 million PHP services vulnerable on 23 October 2026. The U.K. took 32 digital services offline as a precaution.
What is PHP2Shell, and why does clean application code not matter?
PHP2Shell is the public name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each scored CVSS 9.2. Chained, they allow unauthenticated remote code execution from a crafted HTTP request.
The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.2 is the oldest branch on that list. PHP 7.4, 8.0, 8.1 and older 5.x builds have no upstream fix. Upgrade, or apply a distribution backport where the vendor ships one.
Sysdig’s finding is blunt: the bugs live in the engine, not in a theme, plugin or CMS file. A current WordPress, Drupal or Joomla tree can be clean and still be reachable. WordPress and CMS penetration testing that only reviews application code will miss a defect that never appears in that tree.
| Branch | Fixed release | What to assume |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported. Patch and restart workers. |
| PHP 8.4 | 8.4.27 | Supported. One-click tooling targeted 8.4.26 under Apache mod_php. |
| PHP 8.3 | 8.3.36 | Supported. Same engine bug, same patch. |
| PHP 8.2 | 8.2.35 | Oldest branch with a listed fix. |
| PHP 8.1 and older, including 5.4–7.x | None from upstream | Vulnerable since 2012. Upgrade, or apply a distro backport if one exists. |
How fast did PHP2Shell exploit attempts scale after disclosure?
Previdian logged the first event against CVE-2026-109618 on 21 October 2026 at 13:05 UTC. Attempts against CVE-2026-109619 were smaller. Cloudflare counted tens of thousands of attempts within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by early 22 October.
The curve is automated internet-wide scanning. Cisco Talos separated that volume from a finished capability: most of what it saw was scanning plus uncoordinated payload delivery. The same-day jump matches a WordPress flaw that was exploited the same day it was patched.
Did anyone actually get remote code execution?
No confirmed remote code execution had been reported by the major telemetry sources as of 23 October 2026.
Previdian recorded hundreds of attempts against CVE-2026-109618 from dozens of addresses, and fewer against CVE-2026-109619, with no successful RCE and no dropped PHP files. Beelzebub, Dataminr, Wordfence and Sophos described scanning, fingerprinting and failed exploitation. SOCRadar saw no shell on the sites it screened as of 22 October.
Hunt.io followed one operator across 123 servers on cloud providers, shared hosting and ISP networks. About 57 ran PHP, many on unsupported 5.x–7.x branches. Ten rejected the request outright, including three of five sitting behind Cloudflare. None of the 123 was exploited.
Censys assessed more than 34.4 million PHP services as still vulnerable on 23 October 2026. It also reports more than 3.08 million hosts and 56.6 million web properties running PHP. Those are separate counts. VirusTotal put about 272,000 hosts on a supported 8.2–8.5 branch.
The U.K. government took 32 digital services offline and left four partially unavailable while updates went in. The NCSC issued about 50,000 warnings. Precautionary outages also hit government, school and hospital sites across Asia, Europe and North America.
SOCRadar found aslr_exploit.py, labelled a one-click PHP2Shell exploit for PHP 8.4.26 under Apache mod_php, plus php2shell_fp.py, deep_probe.py and wp_attack.py. The described chain has three HTTP stages: recycle the PHP worker, leak addresses through the session cookie to defeat ASLR, then abuse session upload-progress handling to run a command. Sysdig places the vulnerable engine code in PHP 5.4, released in 2012. Success on PHP-FPM, Nginx, a container or another CPU is unproven.
Spencer McIntyre, director of exploit development at VulnCheck, said ASLR had been the main obstacle because it randomizes load addresses without repairing the bug. VulnCheck says its chain uses both CVEs, bypasses ASLR, and reaches code execution on x86-64 even when production settings hide errors. The firm has not identified another public or commercial exploit that does this under the same conditions. That lab result is not a census of owned servers.
What is the Potassium botnet doing in this traffic?
Potassium is an expanded Mirai-derived botnet. The PHP2Shell attempts Sophos analysed did not install it. Synthient flagged Potassium in March 2026. Nokia Deepfield and Arctic Wolf examined it afterward.
The sample resolves a hard-coded encrypted command address, opens a TCP connection, sends an HTTP request, and accepts a follow-on payload only when the response is HTTP 200 and the body is a Linux ELF binary. It falls back to hard-coded public DNS servers. In a network-contained sandbox, traffic from three source addresses fetched a loader that deployed the bot. The bot resolved a malicious domain to its command host and opened a channel on TCP port 50792. The reconstructed objective was sustained volumetric floods against two adjacent hosts on a single Ukrainian network. Arctic Wolf counted 24 flood commands across ICMP, TCP, UDP and OpenVPN.
- ChaCha20 protects the static configuration table, a use Nokia Deepfield had not previously seen in a Mirai variant.
- A single static byte, 0xED, covers everything on the wire.
- A named reverse-shell protocol (“SHELL”/”SHOUT”) shares the channel with attack commands.
- DNS misdirection swaps the two 16-bit halves of every resolved A record before the bot connects.
- ARM and x86 builds Arctic Wolf analysed contain Ethereum Name Service configuration, with ENS resolution disabled in both.
What should you check today?
Patch every supported PHP branch and restart every worker that loaded the old binary. There is no upstream fix for older PHP. Dataminr’s warning matches Log4Shell: applications get patched while embedded, appliance and forgotten runtimes stay exposed.
A version banner is weak proof. Distributions often backport the patch and leave the version string unchanged. Match the changelog or vendor advisory, then restart Apache workers, PHP-FPM pools, container images and embedded runtimes. Preserve web, PHP, session and egress logs before that restart.
If you cannot patch today, take the vhost offline or put a hard control in front of it, as the U.K. did for 32 services, and move off 5.x–7.x. After the upgrade, web application penetration testing should include the engine build and session configuration.
Attempt sources named by vendors
These are published attempt sources, not proof of a shell. Potassium command addresses are omitted. Sophos places that channel on TCP port 50792 after the bot resolves its command name.
| Role | Indicator |
|---|---|
| Potassium delivery sources (Sophos) | 85.11.167[.]243; 217.60.242[.]76; 45.198.224[.]169 |
| Exposed PHP2Shell tooling host (SOCRadar, Hunt.io) | 206.188.197[.]105:9999 |
| Wordfence attempt sources | 87.121.84[.]174; 181.215.186[.]252; 185.196.220[.]132; 185.161.210[.]29; 152.233.51[.]69; 45.134.225[.]16; 107.189.14[.]87; 193.47.62[.]24; 103.147.220[.]17; 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b |
Checks for today
- Inventory every PHP binary: OS packages, containers, appliances and bundled runtimes. Record branch, package version, and mod_php or PHP-FPM.
- Confirm 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distro advisory that backports those fixes.
- Restart or replace workers and images. A package on disk does nothing for a process that already loaded the old library.
- Treat unsupported 5.x–7.x as exposed until the runtime is replaced.
FAQ
What is PHP2Shell?
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two PHP engine flaws scored CVSS 9.2 that chain into unauthenticated remote code execution. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is PHP2Shell being exploited in the wild?
Attempts were widespread from 21 October 2026 and reached millions of requests by early 22 October. Previdian, Sophos, Wordfence, Beelzebub, Dataminr, SOCRadar and Hunt.io reported scanning and failed exploitation, with no confirmed remote code execution in that window.
Does PHP2Shell affect WordPress, Drupal or Joomla?
Yes, if the site runs a vulnerable PHP build. Sysdig traced the bug to the engine in PHP 5.4 (2012), so replacing CMS files alone leaves the worker exposed.
What is the Potassium botnet?
Potassium is an expanded Mirai-derived botnet that Synthient flagged in March 2026. Sophos saw unsuccessful attempts to install it through PHP2Shell. Those probes are not confirmed compromises.
If your estate still mixes supported PHP with bundled 5.x–7.x runtimes, a version banner will not tell you which workers can be reached. agent::offense can test that exposure directly through web application penetration testing, including the engine and session paths a CMS update never touches.