Security2 hOctober 25, 2026, 11:42

PHP2Shell: patch-verification and hunting plan before disclosure

Amazon's honeypots recorded the first PHP2Shell exploitation attempt on 17 October 2026, four days before PHP shipped fixes. The two unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 and are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

DEV Community

Open source

PHP2Shell: patch-verification and hunting plan before disclosure

First exploitation attempt logged on 17 October, patches released on 21 October
Both flaws are rated 9.2 under CVSSv4 and need no authentication
Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older get backports only
VirusTotal estimates more than 5.1 million exposed PHP hosts

#PHP#Amazon#Cloudflare#CISA

PHP2Shell exposes weaknesses in coordinated vulnerability disclosure

Security

Cloudflare deploys default WAF rules for two PHP flaws nine hours before disclosure

Security

Vendors and regulators respond to PHP2Shell vulnerabilities

Security

PHP2Shell: patch-verification and hunting plan before disclosure

PHP2Shell exposes weaknesses in coordinated vulnerability disclosure

Cloudflare deploys default WAF rules for two PHP flaws nine hours before disclosure

Vendors and regulators respond to PHP2Shell vulnerabilities

PHP2Shell will linger in OT sites well beyond 2030