PHP2Shell: two critical PHP flaws put 34 million web services on the clock

The language behind most of the web has two critical holes in it, and the patch window is measured in hours, not weeks. PHP2Shell is the name attached to CVE-2026-109618 and CVE-2026-109619, a pair of bugs in the PHP engine that let an unauthenticated attacker run code on a server with a crafted HTTP request. Both carry a CVSS 4.0 score of 9.2.

PHP releases and guidance

PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day ahead of the planned date after the CVE identifiers surfaced online. There is no fix for PHP 8.1 or anything older. Security teams that run those branches have a migration, not a patch, in front of them. Advice from watchTowr, reported by The Hacker News, is to move to a supported branch or take a backported fix from a Linux distribution.

Censys counts more than 3.08 million hosts and 56.6 million web properties running PHP, and as of October 23 it assessed more than 34.4 million PHP services as vulnerable, according to The Hacker News. VulnCheck, citing VirusTotal data, puts the population on supported branches at roughly 272,000 hosts. Everything else is on a version that will never get the fix.

Attackers and their attempts

Attackers moved faster than most patch cycles. Cloudflare told The Hacker News it saw tens of thousands of exploit attempts within 45 minutes of disclosure, hundreds of thousands within two hours, and millions by early October 22. Amazon dated the earliest attempt it observed to October 17, before public disclosure, according to Recorded Future's summary of the research.

The intended payload, so far, is a botnet. Sophos found a Mirai-derived sample it described as an updated and expanded version of an early-2026 variant, with downloader and network disruption functions. The fork is being called Potassium. Arctic Wolf documented 24 flood commands in the samples, and Nokia Deepfield described an encrypted configuration. The attack infrastructure traced to three IP addresses and, in the samples analyzed, pointed at two hosts inside a single Ukrainian network.

Hunt.io tracked 123 targeted servers, about 57 of them running PHP, and found none exploited. Sophos said the operators appear to be struggling to build a reliable exploit. The reason is address space layout randomization: on a properly configured production server, the memory layout is randomized and PHP does not display errors, which starves a simple exploit of the information it needs.

Future risks

That protection has an expiration date. VulnCheck said it built a chain that bypasses ASLR on x86-64 systems with PHP's recommended production error-display setting, using a memory leak to reach code execution. The firm is restricting the exploit to its customers, but the point stands: what the botnet crews could not do this week, a better-resourced attacker already can.

The official picture is still mixed. CISA had not observed exploitation at the time of its alert, while watchTowr reported seeing active attempts against both CVEs, according to SecurityWeek and Recorded Future. In the UK, the National Cyber Security Centre issued roughly 50,000 warnings, and 32 digital services went fully unavailable with four more partially down during the response, The Hacker News reported.

Action items for IT leaders

For IT and operations leaders, the checklist is short and unforgiving. Inventory every PHP runtime, including the ones inside appliances, marketing sites, customer portals and vendor-hosted tools where nobody on staff thinks of PHP at all. Patch the supported branches now. Treat anything on 8.1 or earlier as compromised-in-waiting and schedule the upgrade. Qualys and Huntress both stress that PHP's maintainers described patching as the only complete fix, with no reliable mitigation short of it.

The modern patch window

The lasting lesson is about the shape of the modern patch window. The CVE numbers leaked, the fix shipped a day early, and exploitation attempts reached millions before most organizations had read the advisory. Two years ago that timeline would have been a week. This time it was a weekend.