If you run PHP anywhere, treat this as a drop-everything patch. Two flaws in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are both rated 9.2 on CVSS. They allow pre-authentication remote code execution. Amazon's Threat Intelligence team says it saw an exploit attempt against its MadPot honeypot on October 17, 2026, four days before the patches shipped.
What is affected
The flaws were found by researchers from Calif, OpenAI and Wiz. According to The Hacker News report, they are present in every PHP release from the 7.x and 8.x series. They put every reachable PHP endpoint at risk, including static forms, login routes and health checks.
The PHP Foundation says both bugs sit in code that nearly every request touches: memory management and error handling. That is why they were hard to fix "without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions."
CrowdStrike's framing is the part I would act on: "The exposure is independent of the CMS, framework, or plug-ins in use." Your WordPress hardening and your framework's auth layer do not help, because no application code runs.
Timeline as reported
| Date (UTC) | Event |
|---|---|
| Oct 17 | Amazon's MadPot sees an exploit attempt from 103.216.220[.]92, via a commercial anonymization network |
| Oct 21, ~02:00 | Earliest attempt Amazon flags on patch day, followed by six more hours of attempts |
| Oct 21, 08:36 | ELLIO sees its first PHP2Shell request, less than an hour after Chainguard published built images containing the fix |
| Oct 22, 14:00 | Original coordinated disclosure time; the PHP Foundation moved it up one day after the CVE IDs and a proof-of-concept leaked |
The PHP Foundation says Chainguard "unilaterally broke the embargo." The Foundation's point is that an attacker could study the fix in binary form while everyone else still waited. Amazon also says it is unclear how the October 17 actor got exploit information while the bug was under embargo.
Why you will not see it in your logs
CrowdStrike describes a nearly traceless attack: worker processes stay stable, responses return HTTP 200, and application logs record nothing. "The only server-side trace is a single memory-limit fatal in the web server's error log, which is routinely dismissed as noise."
That shapes the hunt. What I would check, based on the source:
- Search web server error logs for memory-limit fatals around and after October 17. Normally you would ignore them.
- Per the FBI, watch for PHP processes unexpectedly launching command shells or downloading files. That needs process-level monitoring, not web telemetry.
- Look for the user-agent
php2shell-scan/109618. VulnCheck saw it from 85.11.167[.]243 and 45.198.224[.]169. Another host, 109.71.252[.]97, used both flaws. - Amazon's October 21 attempt sources: 31.223.184[.]166, 37.19.200[.]5, 134.209.159[.]64, 103.114.163[.]188, 95.217.98[.]37.
Amazon says the variety of payloads and anonymization infrastructure points to multiple actors. Cloudflare reports attackers mutating payloads to evade its rules, so WAF rules are a stopgap, not a fix. Pantheon says it blocked over 60,000 suspicious requests.
The long tail is the real problem
VulnCheck found PHP on 2,608,039 internet-facing hosts:
| PHP versions | Hosts |
|---|---|
| 3.x through 7.3 | over 700,000 |
| 7.4, 8.0, 8.1 | about 400,000 |
| 8.2 through 8.5 | 403,000 |
Most exposed hosts are on versions that are old. The article does not say which of those branches received fixes, and it does not list fixed version numbers, so check your vendor's advisory rather than assuming. For distro and hosting stacks, CloudLinux has released fixed packages for ea-php52 through ea-php85 and every alt-php version.
Sonatype's Ilkka Turunen makes the practical point: PHP is bundled into many operating system distributions and historic environments. Before you patch, inventory where PHP runs, including container base images and vendor appliances, and decide who owns each one.
What I would do today
- Inventory every PHP runtime, including images, CI containers and bundled copies.
- Apply vendor fixes. The UK NCSC and US CISA both say to patch quickly or consider taking the service offline.
- Run OpenAI's Codex skill, which checks whether a website or local PHP binary is vulnerable.
- Hunt backwards to October 17, not just from the patch date.
Amazon CISO CJ Moses names the structural shift: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit." The gap between a patch and working exploits is now hours or minutes. Plan your patch process around that.
Sources: