Two serious flaws in the core PHP engine—CVE-2026-109618 and CVE-2026-109619 (dubbed “PHP2Shell”)—are fueling a surge in cyberattacks against universities and business websites. Each vulnerability carries a CVSS v4.0 severity score of 9.2, and both permit adversaries to run arbitrary code on a server without needing login credentials. Because the bugs are deep in the engine itself, even clean or well-written site code offers no protection.
How the Threat Unfolded
PHP officially published patched versions on October 21, 2026, but public exploit scripts spread almost immediately. Exploit proof-of-concept tools appeared on GitHub right after the patch release, coinciding with probing activity detected as early as October 17—before the public knew details of the defects. These kernels of pre-release activity suggest attackers may have been planning ahead of disclosure.
The higher risk is for servers running PHP as an Apache module (“mod_php”), where the flaw can trigger before site code or filters ever load. Firewalls and web application firewalls often don’t capture the bad requests tied to these vulnerabilities. That leaves patching as the only full fix.
Technical Breakdown & Indicators of Compromise
The two vulnerabilities work in tandem. CVE-2026-109618 occurs when PHP runs out of memory during an upload, and its cleanup process deals with partly built data. CVE-2026-109619 lets old request data linger in a shared worker thread, enabling a subsequent request to reuse that leftover data. Public exploit chains use memory leaks to discover addresses in memory, then forge structures enabling a crafted call to the system function.
Security researchers documented traffic using botnet payloads (notably one resembling the Mirai family), scanning activity, and listener scripts hosted on open directories across standard HTTP ports. Mass‐exploitation scripts, fingerprinting probes, and tools targeting PHP sessions via multipart upload fields (especially code involving PHP_SESSION_UPLOAD_PROGRESS) have been observed. Servers that haven’t been properly updated—particularly those using PHP-FPM, Apache modules, or appliances bundling older PHP versions—are especially exposed.
What Must Be Done
The definitive solution is upgrading to one of the patched PHP releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Older versions—PHP 8.1 and below—no longer receive official fixes, so either a vendor backport or migration to a supported branch is necessary.
While some temporary mitigations can reduce risk (for example disabling upload progress tracking and restarting workers), they don’t fully address the vulnerabilities. Admins also need to ensure that all instances of PHP in their infrastructure—command-line, web server modules, containers, or appliances—are updated. Post-patch, security teams should monitor logs for suspicious POST requests, check for indicators such as the use of form field PHP_SESSION_UPLOAD_PROGRESS, and hunt for known IP addresses or listener scripts linked to exploit activity.
Universities and small businesses are especially vulnerable because they often use uniform PHP setups for web portals and course sites and may lag in patching. Public exploit code drastically lowers the bar for attackers.
What this means: The emergence of public scripts turns theoretical threats into active attacks, and the PHP2Shell bugs underscore a critical truth: a flaw in infrastructure components is often more dangerous than an issue in application code. Every organization using PHP has work to do.
