Critical PHP Security Flaws Actively Exploited Globally

Two critical security vulnerabilities, identified by the codes CVE-2026-109618 and CVE-2026-109619 and dubbed php2shell, have been discovered in the PHP programming language, which underpins the vast majority of websites. These flaws, rated with a high severity score of 9.2/10, allow for unauthenticated remote code execution, potentially leading to full website takeover by attackers.

According to Amazon Threat Intelligence, the first attempts to exploit these vulnerabilities were detected on October 17, 2026, four days before the flaws were publicly disclosed. Following the release of the patch, the number of attack attempts surged dramatically. Cloudflare CEO Matthew Prince reported that within hours of the patch announcement, tens of thousands, and soon millions, of exploitation attempts were recorded.

Global Threat and Early Exploitation

These critical php2shell vulnerabilities stem from severe bugs in the PHP engine, enabling remote code execution (RCE) without authentication. Developers had planned to release a patch for these issues on October 21, but due to leaks and early exploitation attempts, the patch was released a day earlier, on October 20. Even before the official patch release, news began to surface that cybercriminals were actively targeting these flaws.

Amazon's analysis indicates that attacks began days before public disclosure, suggesting that some malicious actors had prior knowledge of these critical vulnerabilities. Cloudflare also observed that attackers are continuously modifying and adapting their payloads to bypass web application firewalls (WAFs).

Why it matters

PHP is a fundamental programming language that powers a significant portion of websites across the internet. Consequently, critical security vulnerabilities in PHP pose a substantial risk to millions of websites globally. Successful exploitation of these flaws could lead to data breaches, service disruptions, and the distribution of malware.

The severity of this situation has prompted many government, education, and healthcare organizations worldwide to undertake precautionary shutdowns to protect their systems. The UK government reported that over 30 of its services became unavailable during patch applications. Security features like ASLR (Address Space Layout Randomization), which makes reliable remote code execution more challenging, have contributed to the limited number of confirmed successful exploits so far. However, experts emphasize that exploitation techniques will evolve, and systems must be updated urgently.

Attack Attempts and Challenges

According to a report by security firm Sophos, threat actors have attempted to leverage the php2shell vulnerabilities to spread a variant of the Mirai botnet called Potassium. Although these attempts were thwarted, it is noted that this Mirai-derived malware possesses additional functionalities and can launch DDoS attacks. Other firms like Hunt.io have also observed exploitation traffic linked to Mirai-style botnets.

Experts indicate that exploiting these security flaws is not as straightforward as it might appear. Yotam Perkal of Pluto Security told TechRadar that most publicly available Proof-of-Concepts (PoCs) do not reliably work on real systems. Nevertheless, firms like VulnCheck have announced the development of exploits that can bypass ASLR in production environments and achieve remote code execution. SOCRadar also reported discovering attacker tooling that could be effective against servers configured more like test systems than hardened production ones.

Next Steps and an Additional Risk

It is crucial for system administrators to immediately apply the latest PHP patches to protect their servers against these vulnerabilities and restart their PHP workers. Security firms note that attackers are constantly attempting new methods to bypass web application firewalls and are adapting their attacks.

Beyond these critical flaws, the PHP project issued a warning two days after the emergency patches about another unpatched remote code execution vulnerability, assigned CVE-2026-115560. According to The Hacker News, this new issue only affects web applications configured in an unusual way and is considered low risk by PHP, thus no emergency fix has been issued. Users are advised to disable a specific feature.