PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites

PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites

The Black Week briefing released by ESET on Oct 20 identified two critical memory-safety vulnerabilities in the PHP core, now catalogued as CVE-2026-109618 and CVE-2026-109619. Both flaws enable unauthenticated remote code execution (RCE) on any PHP installation that has not applied the latest security updates. The PHP project responded with emergency patches on Oct 21, delivering fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Legacy branches (5.4-8.5.11) remain vulnerable until source-only backports are applied.

Attack Path and Exposure

The vulnerabilities arise from improper bounds checking in the PHP interpreter’s handling of specific string operations. An attacker can send a crafted HTTP request containing a malicious payload that triggers a buffer overflow, allowing arbitrary code execution with the privileges of the web server process. Because the flaw is not tied to authentication, any publicly reachable PHP site is a potential target. ESET’s analysis indicates that roughly 69% of active web servers run a PHP version within the affected range, translating to millions of sites worldwide.

Evidence and Observed Behavior

ESET monitored a sample of 200 proof-of-concept exploits circulating in underground forums. None of the samples triggered a successful exploitation on live traffic during the monitoring period. The exploits required a precise sequence of HTTP headers and payload formatting that was not present in typical web traffic. Additionally, the PHP project’s own test harness reported no crashes when the patched code was executed against the same payloads.

Attribution and Motivation

The briefing does not link the vulnerabilities to a specific threat actor. The rapid disclosure and the volume of proof-of-concept code suggest that the flaws were discovered by security researchers rather than a state-backed group. The lack of confirmed attacks indicates that the exploitation window may be narrow and that defenders can mitigate risk through timely patching.

Mitigation Steps

1. Identify: Run php -v on each server to confirm the PHP version. Versions 5.4 through 8.5.11 are affected.
2. Patch: Upgrade to the latest patched release for your PHP branch. For end-of-life branches, apply the source-only backport patches released by the PHP project.
3. Validate: After applying the patch, run php -m to ensure the interpreter loads without errors and that no deprecated modules remain.
4. Monitor: Enable logging of PHP errors and monitor for unusual activity such as repeated 500 errors or unexpected process restarts.
5. Harden: Disable unused PHP extensions, enforce strict file permissions, and consider using a web application firewall to block malformed requests.

What to Watch Next

• Patch Deployment: Track the rollout of the backport patches for end-of-life branches. Delays could leave a large number of legacy sites exposed.
• Exploit Activity: Keep an eye on threat intelligence feeds for any new proof-of-concept code that may have been refined to bypass the current mitigations.
• Configuration Drift: Verify that servers are not running outdated PHP binaries from local repositories or custom builds that may miss the official patches.

Related Coverage

• PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x
• PHP Releases Second Windows Update in Five Days to Patch PHP Brotli Flaw

Explore More on This Topic

• More PHP coverage

Related coverage

• PHP2Shell CVEs Force Immediate Patch for Millions of Sites
• Mirai ASLR bypass Enables PHP2Shell Compromise