# PHP2Shell: two critical PHP flaws put 34 million web services on the clock

Published 2026-10-23 · Software & Technology on MarketScale
Canonical: https://www.marketscale.com/industries/software-and-technology/php2shell-two-critical-php-flaws-put-34-million-web-services-on-the-clock

> Two unauthenticated remote code execution bugs in the PHP engine, both scored 9.2, shipped patches a day early after the CVE numbers leaked. Scanning reached millions of attempts within hours. No confirmed compromise yet, and no patch for PHP 8.1 or older.

## Key points

- 34.4 million PHP services were vulnerable to the remote code execution flaws as of October 23, with roughly 272,000 hosts running supported branches that received patches
- PHP 8.1 and older versions have no official patch available, requiring migration to a supported branch or acceptance of backported fixes from Linux distributions
- Exploit attempts grew from tens of thousands within 45 minutes of disclosure to millions by October 22, but ASLR and proper error-display configuration on production servers have so far prevented confirmed code execution

The language behind most of the web has two critical holes in it, and the patch window is measured in hours, not weeks. PHP2Shell is the name attached to CVE-2026-109618 and CVE-2026-109619, a pair of bugs in the PHP engine that let an unauthenticated attacker run code on a server with a crafted HTTP request. Both carry a CVSS 4.0 score of 9.2.

> The scale of the exposure is what makes this a business story rather than a developer story.

## PHP releases and guidance

PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day ahead of the planned date after the CVE identifiers surfaced online. There is no fix for PHP 8.1 or anything older. Security teams that run those branches have a migration, not a patch, in front of them. Advice from watchTowr, reported by The Hacker News, is to move to a supported branch or take a backported fix from a Linux distribution.

Censys counts more than 3.08 million hosts and 56.6 million web properties running PHP, and as of October 23 it assessed more than 34.4 million PHP services as vulnerable, according to The Hacker News. VulnCheck, citing VirusTotal data, puts the population on supported branches at roughly 272,000 hosts. Everything else is on a version that will never get the fix.

## Attackers and their attempts

Attackers moved faster than most patch cycles. Cloudflare told The Hacker News it saw tens of thousands of exploit attempts within 45 minutes of disclosure, hundreds of thousands within two hours, and millions by early October 22. Amazon dated the earliest attempt it observed to October 17, before public disclosure, according to Recorded Future's summary of the research.

The intended payload, so far, is a botnet. Sophos found a Mirai-derived sample it described as an updated and expanded version of an early-2026 variant, with downloader and network disruption functions. The fork is being called Potassium. Arctic Wolf documented 24 flood commands in the samples, and Nokia Deepfield described an encrypted configuration. The attack infrastructure traced to three IP addresses and, in the samples analyzed, pointed at two hosts inside a single Ukrainian network.

> The attempts are not landing yet. Researchers at Previdian, Beelzebub, Dataminr and Wordfence report scanning, probing and attempts to confirm command execution, with no confirmed remote code execution.

Hunt.io tracked 123 targeted servers, about 57 of them running PHP, and found none exploited. Sophos said the operators appear to be struggling to build a reliable exploit. The reason is address space layout randomization: on a properly configured production server, the memory layout is randomized and PHP does not display errors, which starves a simple exploit of the information it needs.

## Future risks

That protection has an expiration date. VulnCheck said it built a chain that bypasses ASLR on x86-64 systems with PHP's recommended production error-display setting, using a memory leak to reach code execution. The firm is restricting the exploit to its customers, but the point stands: what the botnet crews could not do this week, a better-resourced attacker already can.

The official picture is still mixed. CISA had not observed exploitation at the time of its alert, while watchTowr reported seeing active attempts against both CVEs, according to SecurityWeek and Recorded Future. In the UK, the National Cyber Security Centre issued roughly 50,000 warnings, and 32 digital services went fully unavailable with four more partially down during the response, The Hacker News reported.

## Action items for IT leaders

For IT and operations leaders, the checklist is short and unforgiving. Inventory every PHP runtime, including the ones inside appliances, marketing sites, customer portals and vendor-hosted tools where nobody on staff thinks of PHP at all. Patch the supported branches now. Treat anything on 8.1 or earlier as compromised-in-waiting and schedule the upgrade. Qualys and Huntress both stress that PHP's maintainers described patching as the only complete fix, with no reliable mitigation short of it.

## The modern patch window

The lasting lesson is about the shape of the modern patch window. The CVE numbers leaked, the fix shipped a day early, and exploitation attempts reached millions before most organizations had read the advisory. Two years ago that timeline would have been a week. This time it was a weekend.

## Sources

- [PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware](https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html) (The Hacker News)
- [Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge](https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/) (SecurityWeek)
- [PHP2Shell Exploitation: Two Critical PHP Flaws Explained](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) (Recorded Future)
- [Two Critical PHP Flaws Could Hand Attackers Your Web Servers](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities) (Qualys)
- [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) (Huntress)

Tags: PHP, cybersecurity, vulnerability management, web infrastructure, Mirai, patching

---
Source: MarketScale, https://www.marketscale.com/industries/software-and-technology/php2shell-two-critical-php-flaws-put-34-million-web-services-on-the-clock. Published for AI indexing and citation; cite the canonical URL. Site guide for agents: https://www.marketscale.com/llms.txt