New findings on the two critical PHP flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026
109619) show attackers are already probing for them across the internet. Amazon saw an exploitation
attempt on 16 October 2026, four days before the flaws were made public, and broad attempts followed
within hours of release. Public proof-of-concept exploit code is now available, and one botnet payload
has been seen in failed attempts. No real-world server has been confirmed as fully compromised yet,
but that can change quickly. Patching PHP remains the only complete fix. The detailed stopgaps and
web-filter rules below reduce exposure while you patch.
1. Vulnerability Details
Both flaws sit in the PHP engine and affect all web-serving modes (mod_php, PHP-FPM, php-cgi, FrankenPHP,
LiteSpeed) across every branch from PHP 5.4, independent of the application. Risk is highest for Apache mod_php,
where an unauthenticated request can trigger the flaw before any application code runs. This advisory updates the 22
October PHP2Shell alert with confirmed exploitation activity, a public proof of concept, and vendor web-filter coverage.
Patching to a fixed release remains the only complete fix; the stopgaps below reduce but do not remove exposure.
- CVE-2026-109618 (CVSS 9.2) RCE via OOM corruption A crafted multipart request drives PHP out of memory before some request data is initialised, and request shutdown then acts on that invalid state. Gives unauthenticated remote code execution as the web worker account.
- CVE-2026-109619 (CVSS 9.2) RCE via stale global state: A fatal error leaves PHP holding references to request memory that is freed at request end; a later request on the same worker follows the stale references. Gives unauthenticated use after free, memory disclosure and remote code execution.
2. Affected Products
- PHP 8.5: below 8.5.12, fixed in 8.5.12
- PHP 8.4: below 8.4.27, fixed in 8.4.27
- PHP 8.3: below 8.3.36, fixed in 8.3.36
- PHP 8.2: below 8.2.35, fixed in 8.2.35
- PHP 7.4, 8.0 and 8.1: end of life, source backports only; use a distribution or LTS vendor fix
- PHP 5.4 to 7.3: end of life and affected, no project fix; migrate to a supported branch
- All web-serving modes: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed
3. Observed Activity
- Exploitation before disclosure (AWS MadPot) Amazon Threat Intelligence saw a PHP2Shell attempt on 16 October 2026 (logged 10/17) from a commercial anonymisation IP, four days before disclosure. Multiple proof-of-concept exploits appeared from about 02:00 UTC on 21 October, with further attempts to 08:00 UTC from varied infrastructure, pointing to several actors. AWS reports broad exploitation attempts in the wild and advises investigating from at least 16 October, not the disclosure date.
- Public PoC and Potassium payload (Sophos CTU): Public proof-of-concept exploit code is available. Sophos telemetry shows scanning and a small number of failed attempts, with no confirmed successful compromise after an earlier report was corrected. A blocked payload is Potassium, a likely Mirai-derived botnet with downloader and DDoS features that beacons to a hard-coded C2. A reliable real-world exploit is proving hard to build even with AI support, but the flaws remain serious.
- Upload-progress probes and WAF evasion: Previdian honeypots caught multipart upload-progress probes on 21 October using PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS fields and the upload filename shown below, with no code execution. Cloudflare deployed default-on WAF protection about nine hours before disclosure and observed attackers changing payloads to try to evade it.
4. Indicators of Compromise (IOCs)
TYPE- INDICATOR
IP- 134.199.154[.]64 (Potassium C2)
IP- 117.55.202[.]115 (Potassium C2)
DOMAIN- hackattackkaboom[.]botlesscucks[.]st (payload staging)
DOMAIN- hik[.]gettingheadfromduckysmom[.]st (Potassium infrastructure)
5. Recommendations
- Patch now to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or your vendor backport for 7.4, 8.0, 8.1); this is the only complete fix. Measure patch timelines in hours, and start hunts from at least 16 October 2026, not the disclosure date, since compromise can predate the advisory.
- Proactive stopgaps for CVE-2026-109618 where you cannot patch at once: set memory_limit=-1 through php_admin_value in the FPM pool or Apache config so applications cannot override it; set a low post_max_size (8M without uploads, 32M if uploads are needed); add a container or cgroup memory limit that kills only the affected worker; lower max_input_nesting_level and bound the number of input variables, multipart parts, headers per part and uploads; if the application does not use multipart uploads, block those requests at the frontend; then restart every worker.
- Proactive stopgaps for CVE-2026-109619: set session.upload_progress.enabled=0, and on PHP 8.5 set fatal_error_backtraces=0; remove deprecated or invalid per-request INI directives that emit diagnostics before initialisation (hiding them with error_reporting, display_errors or @ does not help); fix attacker reachable fatal errors and execution timeouts in upload, import, callback and cleanup paths; if performance allows, set pm.max_requests=1; then restart every worker. These reduce exposure but do not replace patching.
- Hunt for multipart POST requests carrying PHP_SESSION_UPLOAD_PROGRESS or PHPSESSID, PHP code in upload filenames such as .txt, and requests followed by memory-limit errors, repeated HTTP 500 responses, or unexpected process execution or file writes on web servers.
- Cloudflare WAF customers: confirm the following rules are deployed in block mode and keep them on during and after patching. Cloudflare Managed Ruleset (paid, ruleset efb7b8c949ac4650a09736fc376e9aee), Generic Rules – Anomalous Execution 1 to 7: c1d409ad838f47f59446f21cc438d5dd, f9a45927414245e3a64bb12d0a0c2f64, 771c654ae1154d4daa72f4e1545d163c, 217005865f0145f392300bac212afcc9, 38efdb17ea594501bb55a1d71867b12e, 4148ae686fdb4d01be673fab9d9c073d, 1389aa259617437392ce149c48143645. Cloudflare Managed Free Ruleset (free, ruleset 77454fe2d30c4220b5701f6fdfb893ba), Anomalous Execution 1 to 7: 4e315666e8e344cdb64119a3b5ccf32f, 00c10e6cc4da4bd08722adeebcd95984, 48ddf592361e4fdb97a8a85982dab691, 3556683d512a47f2937899c524b1a4c6, da07c85852e34625bb478496302ede46, 19373a83abb840e18ab3ce5a7975ce1b, 07f0b6ddaabf40b1b2042dade8d613fa. Managed Response Firewall Default (all plans), Default block for High confidence Signatures: afffe22785674c80a31875c848d2242a.
- Monitor for the IOCs. Block the IOCs at their respective controls.
6. Sources
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot
- https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
- https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- https://x.com/PrevidianCyber/status/2112936591719068048
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.