Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 see early wild exploitation

1. Executive summary

Two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, were leaked ahead of a coordinated disclosure and are scheduled for an emergency patch release on 2026-10-21 at 14:00 UTC. The PHP security team rates both CVSSv4.0 9.2; no NVD entry, EPSS score or CISA KEV listing exists for either CVE at the time of writing, so the KEV exploitation state is not established. Cloudflare's CTO reported early attacks on 2026-10-21 and watchTowr states it has reproduced CVE-2026-109618, but no technical root cause, affected component or attack path has been published. EMEA financial services exposure is concentrated in internet-facing PHP estates: customer portals, marketing and CMS platforms (WordPress, Drupal, Joomla, Laravel, Magento), shared hosting and control panels, and CI or container images carrying PHP. The bottom-line risk is a pre-patch window on a near-universal web runtime, with mass exploitation expected within minutes of the patch release according to Sansec.

2. Regulatory framing

3. Technical analysis & attack chain

The vulnerabilities are confirmed to exist and are rated critical, but the mechanism is not public. No root cause, affected component or attack path has been published by the PHP security team. Public reporting describes both as remote code execution in PHP core. CERT-EU states that, based on the CVSS score, both could be exploited without authentication. One report suggests CVE-2026-109618 is a use-after-free bug; that is single-sourced and unconfirmed. The name php2shell, used by researchers, indicates that a request to a vulnerable web server yields a shell on that server.

Confirmed steps in the disclosure timeline, not an exploitation chain:

1. On 2026-10-20 a Hacker News post claimed two critical PHP vulnerabilities were headed for disclosure; the post was removed but screenshots circulated on social media.
2. watchTowr confirmed the leak and stated the vulnerabilities were real and had been under embargo until Thursday 2026-10-22.
3. The PHP security team published an advance notice of a security release for 2026-10-21 at 14:00 UTC, a day earlier than the original embargo, reserving the right to release sooner if details became public or exploitation appeared.
4. CERT-EU published advisory 2026-018 naming both CVEs. The NCSC published guidance for UK organisations.
5. A video by researcher Kirill Firsov demonstrates the exploit chain, credited to researcher LCFR and Calif.io.
6. On 2026-10-21 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging and is updating mitigations as new vectors appear. watchTowr told BleepingComputer it believes it has reproduced CVE-2026-109618.

Affected and fixed versions. PHP has not published the official affected and fixed version list; that is expected with the release. Before the release, researcher Kevin Beaumont reported the following fixed versions:

CERT-EU says the vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. Huntress notes reports pointing to versions 5, 6, 7 and 8. Linux distributions that ship older PHP packages may backport fixes, so organisations using distribution packages should check their vendor advisories.

Severity discrepancy. The PHP security team rates both vulnerabilities CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. The 9.2 rating is the one carried by the PHP project and by CERT-EU and NCSC communications.

Scale. W3Techs puts PHP at 69.3% of websites whose server-side language is known. Silas Cutler's rough estimate is over 1.3 million internet-exposed hosts potentially vulnerable; a Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Both figures are estimates, not measurements of exploitable hosts.

What exploitation will likely look like. With no public exploit detail, Huntress and Florian Roth describe the expected pattern: a PHP worker process such as php-fpm, php-cgi, php-cgi.exe, httpd or apache2 spawning an abnormal child process. Expected children include shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) and download or networking tools (curl, wget, nc, certutil.exe). Command lines containing reverse shell patterns such as /dev/tcp/ and fsock are the ones to inspect. This is a behavioural expectation, not an observed indicator set.

Mitigations available before the patch. PHP core developer Gina Peter Banyard said the only mitigation is patching or upgrading PHP. PHP 8.6 release manager Joe Ferguson said ini settings will not save you, responding to a suggestion to turn off session upload progress. Cloudflare has deployed WAF rules for the known exploit vectors, available to all customers including the free tier, and describes them as a stopgap only; they cover only traffic routed through Cloudflare. CERT-EU recommends that organisations where immediate patching is not feasible consider isolating internet-facing applications from public networks until a fix is available. The NCSC advises taking a system offline where immediate remediation is not feasible.

Unconfirmed and single-sourced claims. The use-after-free description of CVE-2026-109618 rests on one report. The fixed version numbers come from Kevin Beaumont ahead of the official release. The reproduction claim is watchTowr's own. The early-attacks statement is a single public comment from Cloudflare's CTO with no published indicators. Code claiming to exploit the vulnerabilities is circulating publicly; Tenable states it has not verified that any of it works, and unverified exploit code is sometimes laced with malware. Sansec's expectation that mass exploitation will start within 15 minutes of patch release is a prediction, not an observation.

4. Mitigation & containment

P1 within 24 hours:

• Inventory every PHP installation and record the exact version: web servers, containers, CI images and developer machines. For WordPress, the version is under Tools, Site Health, Info, Server. Tenable plugins 48243 (PHP Version Detection), 58987 (PHP Unsupported Version Detection), 200476 (PHP Scripting Language Installed, Windows) and 216936 (PHP Scripting Language Installed, Unix) identify installations and unsupported versions.
• Apply the PHP release at 14:00 UTC on 2026-10-21 as soon as it is available, targeting 8.5.12, 8.4.27, 8.3.36 and 8.2.35 per the reported fixed versions, and confirm the running version afterwards rather than trusting the package manager alone.
• For any internet-facing PHP application that cannot be patched immediately, isolate it from public networks or take it offline, per CERT-EU and NCSC guidance.
• Ask managed and shared hosting providers when they will deploy this release, and obtain the deployed version in writing.
• Enable the Cloudflare WAF rules if traffic is proxied through Cloudflare, and treat them as a stopgap that does not cover traffic bypassing the proxy.
• Hunt for PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2) spawning sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, nc or certutil.exe, and for command lines containing /dev/tcp/ or fsock.

P2 within 72 hours:

• Plan branch upgrades for any estate still on PHP 5.x through 8.1.x. Those branches are end-of-life and no official fix is expected; backports may exist from Linux distributions, so check each vendor advisory.
• Check distribution-packaged PHP against the distribution's own advisory rather than the upstream version numbers.
• Review CI images and container base images for PHP and rebuild them on a fixed base.

P3 within 7 days:

• Add detection for PHP child-process anomalies to EDR and SIEM coverage permanently, since this pattern recurs across PHP intrusions.
• Re-verify third-party hosting and CMS contracts specify a remediation timeline for critical runtime vulnerabilities, in line with DORA Art. 28 and NIS2 Art. 21(2)(d).
• Do not run exploit code circulating publicly to test exposure; Tenable has not verified that any of it works and it is sometimes laced with malware.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IP addresses, file paths) are available in the source material. The sources describe observable behaviours only.

Behavioural indicators:

6. Detection

The sources give behavioural material (process parentage and command-line patterns) but no file artefacts, strings, mutexes, paths or registry keys from the threat itself. A YARA rule built on the available material would only match reporting about the vulnerabilities, so none is emitted. The Sigma rule below targets the process behaviour the sources describe.

title: PHP Worker Process Spawning Shell or Network Utility
id: 8f3c2a71-4b6e-4d2a-9c1f-7a5e0b3d9c42
status: experimental
description: Detects a PHP worker process spawning a shell, interpreter or network utility, the exploitation pattern described for CVE-2026-109618 and CVE-2026-109619.
author: Adverse Trace
date: 2026-10-21
references:

  - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
  - https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:

      - '\php-cgi.exe'
      - '/php-fpm'
      - '/php-cgi'
      - '/httpd'
      - '/apache2'
  selection_child:
    Image|endswith:

      - '\cmd.exe'
      - '\powershell.exe'
      - '\certutil.exe'
      - '/sh'
      - '/bash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
  selection_cmdline:
    CommandLine|contains:

      - '/dev/tcp/'
      - 'fsock'
  condition: selection_parent and (selection_child or selection_cmdline)
falsepositives:

  - Legitimate application code invoking curl or wget from PHP for outbound HTTP requests
  - Administrative scripts run through PHP on development hosts
level: high

Tune the false-positive set against normal application behaviour before enabling at high severity; PHP applications that legitimately shell out to curl or wget are common.

7. Sources

• Tenable, php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities, https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote, 2026-10-21
• Huntress, Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619), https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities, 2026-10-20
• SecurityWeek, PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws, https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/, 2026-10-20
• The Hacker News, PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert, https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html, 2026-10-21
• Help Net Security, A critical PHP security release is coming today, so get ready to update!, https://www.helpnetsecurity.com/2026/10/21/php-security-release-announcement-october-2026/, 2026-10-21
• NCSC UK, Critical security issue affecting PHP, https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php, 2026-10-21
• Rapid7, CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core, https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core, 2026-07-17 (context on a separate WordPress flaw, not part of this item)

8. Adverse Trace position

Adverse Trace assesses this as a high-urgency pre-patch exposure rather than a confirmed campaign. The CVSSv4.0 9.2 rating is the PHP project's own; no NVD entry, EPSS score or CISA KEV listing exists for either CVE, and the early-attacks claim rests on a single public statement from Cloudflare's CTO with no published indicators, so we treat wild exploitation as reported but unconfirmed. No named actor is involved and no attribution is possible from the available material. The client impact is broad: any internet-facing PHP estate, including CMS platforms, customer portals and shared hosting, is potentially exposed, and the end-of-life branches from 5.x through 8.1.x will not receive an official fix. We will track the 14:00 UTC release, update this advisory with the official affected and fixed version list and any published indicators, and notify clients if exploitation is corroborated by a second source. Clients should treat the patch as the only mitigation and have a maintenance window ready for 14:00 UTC today.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.