Overview
The PHP2Shell vulnerabilities have crossed an important security threshold. CISA has now added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue after evidence confirmed that attackers are exploiting the flaws in real-world attacks. The two vulnerabilities were patched by the PHP security team on 21 October 2026, but evidence suggests attackers were already targeting vulnerable systems before the fixes became publicly available. For organisations running internet-facing PHP applications, the vulnerability is no longer simply a patching priority. It is now an active compromise risk.
From Potential RCE to Confirmed Exploitation
PHP2Shell consists of two critical vulnerabilities that can be chained to achieve remote code execution on vulnerable systems. The flaws can be exploited without authentication, although the attacks are considered technically complex. The PHP security team released emergency updates after warning organisations to prepare for the fixes. However, vulnerability details and mitigation information leaked before the patches were released, while multiple security companies reported exploitation attempts during the period surrounding disclosure. Initially, many of those attempts were assessed as unsuccessful. That has now changed. Security researchers observed evidence of successful remote code execution against an Apache mod_php installation running PHP 8.4.26. CISA’s addition of both vulnerabilities to the KEV catalogue formally confirms that exploitation is no longer theoretical.
The Attack Window Started Before the Patch
One of the most concerning aspects of PHP2Shell is the timing. Amazon Threat Intelligence reported that attackers began targeting the vulnerabilities four days before the security patches were released. This creates a difficult window for defenders. Once vulnerability information becomes known, attackers can move rapidly from understanding the weakness to identifying exposed systems. For widely deployed technologies such as PHP, that window can be particularly dangerous because organisations may have thousands of applications, servers, containers and third-party platforms that depend on different PHP versions. The existence of a patch does not immediately eliminate the exposure.
PHP’s Scale Makes the Risk Larger
PHP remains one of the most widely deployed technologies on the internet.
The supplied research estimates more than 5.1 million PHP hosts exposed online, with approximately 3.8 million instances having at least one port open to attack.
Not every exposed PHP system is necessarily vulnerable to PHP2Shell, and exposure counts should not be interpreted as confirmed vulnerable hosts.
However, the scale demonstrates why widespread exploitation can develop quickly.
Internet-facing PHP applications need to be treated differently from isolated development systems. A vulnerable web server can provide an attacker with a direct path into the application environment and potentially the underlying infrastructure.
🛡️ Patching Is Now Only the First Step
With confirmed exploitation, remediation needs to go beyond installing the fixed PHP release. Organisations should identify all internet-facing PHP systems, determine which versions are actually running and establish whether applications use affected functionality. Systems that could not be patched immediately require additional containment while remediation is completed. More importantly, systems that remained exposed during the exploitation window should not automatically be considered clean after upgrading. Logs, web-server activity, PHP process behaviour, unexpected child processes, modified web files and newly created accounts or persistence mechanisms can provide evidence of earlier compromise. A successful patch closes the vulnerability. It does not undo what an attacker may already have done.
Another PHP RCE Is Already on the Radar
The situation is also evolving. The PHP security team has separately disclosed mitigation guidance for CVE-2026-115560, another remote-code-execution vulnerability that does not yet have a patch and depends on an unusual combination of configuration and application code. This demonstrates the difficulty of securing a widely deployed runtime. The vulnerability management process cannot simply stop once PHP2Shell is patched. New vulnerabilities, configuration-specific attack paths and unsupported versions continue to change the risk profile.
Expert in the Cloud Insight
PHP2Shell demonstrates why vulnerability management needs to be viewed as a race rather than a checklist.
Disclosure → exploitation → detection → patching → investigation → recovery
Each stage can overlap.
The most important change is that PHP2Shell is no longer a vulnerability that organisations can assess solely through severity and exposure. CISA’s KEV listing and confirmed exploitation provide direct evidence that attackers are actively using the weakness.
For internet-facing infrastructure, the priority therefore becomes clear:
Patch the vulnerable PHP components, contain systems that cannot immediately be patched, and investigate exposed systems for evidence of compromise.
Because once attackers are actively exploiting a vulnerability, being patched today does not prove that the system was safe yesterday.
Leave a Reply