PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets strangers run code on PHP servers with no login. How MSPs find exposed clients.
Somebody took a swing at this bug four days before the fix existed. On October 17, 2026, Amazon's honeypots logged a PHP2Shell exploitation attempt. PHP shipped its patch on October 21.
PHP runs WordPress, Drupal, Magento, and that client portal someone built in 2019 and nobody has touched since. So if the plan for your clients is "we patched on day one," remember that some servers were being probed before there was anything to install.
TL;DR
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two memory-safety flaws in the core PHP interpreter, not in any plugin or app. Because the bugs live in the engine, every PHP website inherits them, however tidy its own code is.
PHP's security advisory lists every common way PHP serves the web as at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php the highest risk, describing "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
The pool is enormous. According to Recorded Future, the scanning firm Modat counted 4,384,302 PHP services on 1,886,612 hosts, and about 79% of the ones showing a readable version were on a branch PHP no longer supports.
Think of PHP as a hotel front desk that is supposed to change the lock after every guest. PHP2Shell is what happens when the desk hands the next guest a key still cut for the last guest's room. Here is the confirmed mechanism in plain language. One honest caveat first: a fully reliable public exploit is not out yet, so this describes what researchers proved, not a point-and-click tool.
Keep it in proportion. Recorded Future says the public evidence "remains insufficient to establish the extent of successful compromise." The PoC scripts that circulated early (poc0_109618.py and poc1_109619.py) were unverified, and the theory behind them was later invalidated. So treat this as a race that is on, not a solved exploit: the mechanism is confirmed and the attempts are real, but reliable mass exploitation is not here yet.
Exploit attempts are confirmed; successful break-ins are not yet public. Amazon logged the first attempt on October 17 and says PHP2Shell is "now being broadly exploited in the wild," while adding that "it's unclear if any of these attempts would have succeeded in real-world systems."
The rest of the picture is mixed. Cloudflare reported early attacks at 07:43 UTC on October 21, before the roughly 14:00 UTC release, and deployed WAF rules. watchTowr says it "is observing active exploitation attempts of both" CVEs but reports no successful compromises; its head of threat intelligence told SecurityWeek, "Whilst nobody has been successful to date, we don't expect that will last long." Huntress said that as of 4:30pm ET on October 21 it had "not observed in-the-wild exploitation on partner systems." Patchstack's reports of incidents from hosting partners are, by other coverage, still unverified.
The honest summary: the attacks are real and growing, and the body count is still being tallied.
Assume any client with a PHP website or web app is in scope until you prove otherwise. Sansec says researchers confirmed unauthenticated code execution against Magento 2.4.9 and a long list of common PHP apps, including WordPress, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, WHMCS, Laravel and Symfony. Wiz says the impact is "independent of their CMS," because the bug is in PHP, not the app.
Two groups are easy to miss:
Checking the PHP version string in a Server or X-Powered-By header is a weak test, so "we grepped our versions" is not the same as "we confirmed we are not exploitable." Three things break that shortcut:
php2shell-checker warns in plain text: "UNKNOWN does not mean the target is patched!" and "Headers can be hidden or changed, and distribution backports may not change the upstream version."Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's patched package, then restart every PHP worker. Amazon calls upgrading "the only complete remediation for both," and PHP says no configuration change fully closes the hole.
Watch for these traps: distribution builds may keep an older version string while carrying the fix, so check the vendor advisory rather than php -v; end-of-life branches (8.1 and older) get no official packages, though PHP published source backports for 7.4, 8.0 and 8.1 and some LTS vendors ship patches; and PHP 5.x gets nothing. If you truly cannot patch a client today, PHP's advisory lists stopgaps, such as setting session.upload_progress.enabled=0 and restarting workers, that reduce exposure but do not make a server safe.
PHP2Shell is not hard to patch. The hard part is knowing every place your clients run PHP, including the servers nobody remembers, and proving a server is actually safe rather than just reading its version banner. That is the gap an autonomous pentest closes, and KinoSec has just added a dedicated PHP2Shell check.
An attack is someone doing this without permission. A pentest is the same reconnaissance run with your client's permission, inside a scope, with a report they can act on. Point KinoSec at a client's external web surface and it does exactly that: it maps what is reachable from the internet, fingerprints the technology behind it, and safely confirms whether that client is actually exposed to PHP2Shell, rather than trusting a header. The same chain an attacker would attempt is what KinoSec checks for, on demand, across your whole client book. You re-run it after patching and hand each client evidence instead of a promise.
PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. They let an unauthenticated attacker run code on a web server running PHP, with the vulnerable code reaching back to PHP 5.4. PHP fixed them on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
First, search each server's web logs from October 17, 2026 onward for POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string in file uploads, the pattern Amazon flags. Second, check whether PHP worker processes (php-fpm, php-cgi, httpd, apache2) have spawned shells, download tools like curl or wget, or recon commands like whoami and id, which is what Huntress recommends watching for. Third, look for new files in the web root, new cron jobs and new accounts; if you find anything, isolate the server, preserve its logs, and rotate the secrets it held.
The only complete fix is a patched PHP build followed by a restart of every PHP worker. PHP 8.1 and older are end-of-life, but PHP published source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship patched packages. PHP 5.x has no patch. Until you upgrade, PHP's advisory lists stopgaps such as disabling session upload progress, but it is clear these only reduce exposure.
Only partly. Cloudflare deployed WAF rules and reported attackers adapting to evade them, so a WAF buys time but does not fix anything. Application-level security plugins do not help against the highest-risk mod_php path, because the bug triggers before any application code runs.
As of October 22, 2026, neither CVE-2026-109618 nor CVE-2026-109619 appears on CISA's Known Exploited Vulnerabilities catalog. That can change quickly given confirmed exploitation attempts, so recheck the live catalog. KEV status does not change the urgency: patch now regardless of whether it is listed.