NCSC warns of critical PHP vulnerability requiring immediate patching or system isolation

1. Executive summary

The NCSC has issued an alert for a critical security issue in PHP, advising UK organisations to update immediately or take systems offline where remediation is not feasible. Two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are due to be patched in an out-of-cycle release at 14:00 UTC on 21 October 2026. No CVSS score, severity rating or CISA KEV status has been resolved for either CVE, so this advisory does not assign one; the 9.2 CVSS v4.0 figure quoted in the sources is the PHP security team's own rating and is not corroborated by NVD. EMEA financial services firms running internet-facing PHP, including WordPress, Drupal, Joomla, Laravel and Magento estates, should treat every PHP installation as potentially affected until the patched versions are confirmed. Cloudflare reported early attack activity on 21 October and has deployed stopgap WAF rules; those rules are not a substitute for patching.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The two vulnerabilities are unpatched at the time of writing. The PHP security team has not published a root cause, affected component or attack path for either CVE. Public reporting describes both as remote code execution in PHP core, meaning an attacker could cause the server to run commands of their choosing. CERT-EU states that, based on the CVSS score, both could be exploited without authentication. One report suggests CVE-2026-109618 is a use-after-free bug; this is single-sourced and unconfirmed.

Confirmed steps in the exploitation chain, as far as the sources establish them:

1. An attacker sends a request to a PHP application. The exact vector is not public. Huntress states it does not yet know which part of PHP is involved, whether the flaw is reachable over a plain web request, or whether it depends on a particular configuration.
2. The request triggers remote code execution in the PHP worker process.
3. The PHP worker spawns a child process. Huntress and researcher Florian Roth expect exploitation to appear as suspicious child processes launched by php-fpm, php-cgi, php-cgi.exe, httpd or apache2, such as sh, bash, cmd.exe, powershell.exe, python, perl, curl, wget, nc or certutil.exe.
4. The attacker obtains a shell on the server. The "php2shell" name circulating among researchers reflects this outcome.

Affected versions. CERT-EU says the flaws could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official affected and fixed version list with the release. Before the release, researcher Kevin Beaumont reported the following expected fixed versions: 8.5.12 for 8.5.x, 8.4.27 for 8.4.x, 8.3.36 for 8.3.x and 8.2.35 for 8.2.x. PHP 5.x through 8.1.x are end-of-life with no fix expected. Linux distributions that ship older PHP packages may backport fixes, so organisations using distribution packages should check their vendor's advisories. The fixed version numbers are single-sourced to Beaumont via Tenable and should be verified against the PHP release announcement.

Exposure. W3Techs data cited by Tenable puts PHP on 69.3% of websites whose server-side language is known. Silas Cutler's rough estimate is over 1.3 million internet-exposed hosts potentially vulnerable; a Shodan search by Henk Poley counts over 1.9 million. These are estimates, not a count of confirmed vulnerable systems.

Exploitation status. Cloudflare CTO Dane Knecht said on 21 October that the company is "seeing early attacks emerging" and is updating mitigations as new vectors appear. Cloudflare has deployed an initial set of WAF rules for the known exploit vectors, available to all customers including free tier, and describes them as a stopgap only. watchTowr told BleepingComputer it believes it has reproduced CVE-2026-109618. watchTowr and Huntress say they have not seen either vulnerability exploited in the wild. Sansec expects mass exploitation to begin within 15 minutes of the patch release. The Cloudflare exploitation claim is single-sourced and not corroborated by the other vendors cited here; treat it as an early indicator, not a confirmed campaign.

Disclosure history. The CVE identifiers circulated on Hacker News and social media on 20 October 2026, ahead of a 22 October embargo. watchTowr confirmed the leak. The PHP security team brought the release forward by a day and reserved the right to release sooner if details became public or exploitation appeared. A video shared by researcher Kirill Firsov demonstrates the exploit chain, credited to researcher LCFR and Calif.io.

CVSS discrepancy. The PHP security team rates both vulnerabilities at CVSS v4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. No NVD score is available, so neither figure is authoritative here.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every system running PHP, including web servers, containers, CI images and developer machines, and record each version. Prioritise internet-facing systems. The NCSC names this as the first action.
• Where immediate remediation is not feasible, take the system offline until it can be fully mitigated. This is the NCSC's explicit recommendation.
• Apply the patched versions as soon as PHP publishes them at 14:00 UTC: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the expected fixed versions per Beaumont, to be confirmed against the PHP release. Systems on PHP 5.x through 8.1.x have no fix expected and need a branch upgrade.
• On managed or shared hosting, ask the provider when they will deploy this update. The provider applies PHP updates on those platforms.
• Monitor internet-facing PHP systems for malicious activity. Watch for PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2) spawning shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) or download and networking tools (curl, wget, nc, certutil.exe). Huntress flags command lines containing /dev/tcp/ and fsock as reverse shell patterns.
• If the estate sits behind Cloudflare, confirm the WAF rules for the known exploit vectors are active. Cloudflare states these are a stopgap and patching remains required.

P2, within 72 hours:

• For WordPress sites, check the PHP version under Tools, Site Health, Info, Server, and record it against the inventory.
• Where distribution packages are in use, check the distribution vendor's advisory for backported fixes rather than assuming the upstream version numbers apply.
• Deploy process-level detection on PHP hosts. Huntress points to Florian Roth's process-watcher, a Linux process monitoring tool aimed at detecting exploitation of these bugs.

P3, within 7 days:

• Re-run the inventory to catch PHP embedded in products that do not advertise it. Huntress notes a large amount of software runs PHP under the hood without saying so.
• Review whether any internet-facing PHP system can be moved behind a WAF or restricted by source IP as a standing control.

5. Indicators of compromise

No atomic indicators of compromise (file hashes, domains, IP addresses, file paths) are available in the source material. The sources describe observable behaviours only.

Behavioural indicators

6. Detection

The sources give behavioural material (process parentage and command-line patterns) but no file artefacts, strings, mutexes or paths from the vulnerabilities themselves. A YARA rule built on CVE identifiers or product names would detect reporting about the flaw, not the flaw, so none is emitted. The Sigma rule below targets the process-spawn behaviour Huntress and Roth describe.

title: PHP Worker Process Spawning Shell or Network Tool
id: 8f3c2a71-4b6d-4e29-9c1a-7d5e0b2f6a13
status: experimental
description: Detects a PHP worker process (php-fpm, php-cgi, httpd, apache2) spawning a shell, interpreter or download/networking tool, consistent with exploitation of CVE-2026-109618 and CVE-2026-109619 as described by Huntress.
author: Adverse Trace
date: 2026-10-21
references:

  - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
  - https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:

      - '/php-fpm'
      - '/php-cgi'
      - '/httpd'
      - '/apache2'
  selection_child:
    Image|endswith:

      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  selection_cmdline:
    CommandLine|contains:

      - '/dev/tcp/'
      - 'fsock'
  condition: selection_parent and (selection_child or selection_cmdline)
falsepositives:

  - Legitimate application code or maintenance scripts that shell out from PHP
level: high

A Windows variant should match ParentImage ending in php-cgi.exe or httpd.exe spawning cmd.exe, powershell.exe or certutil.exe, using the same child and command-line selections.

7. Sources

• NCSC, "Critical security issue affecting PHP", https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php, 2026-10-21.
• Help Net Security, "A critical PHP security release is coming today, so get ready to update!", https://www.helpnetsecurity.com/2026/10/21/php-security-release-announcement-october-2026/, 2026-10-21.
• Tenable Research, "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities", https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote, 2026-10-21.
• SecurityWeek, "PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws", https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/, 2026-10-21.
• The Hacker News, "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert", https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html, 2026-10-21.
• Huntress, "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)", https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities, 2026-10-21.
• ANSSI CERT France, "Multiples vulnérabilités dans PHP", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1227/, 2026-09-24. This advisory covers earlier PHP vulnerabilities and does not reference CVE-2026-109618 or CVE-2026-109619.

8. Adverse Trace position

No CVSS score, severity rating or CISA KEV status has been resolved for CVE-2026-109618 or CVE-2026-109619, so Adverse Trace does not assign one. The 9.2 figure is the PHP security team's own CVSS v4.0 rating; the 10.0 figure circulating in early reports is unverified. The exposure is broad: PHP underpins a large share of web-facing applications and is frequently embedded in products that do not advertise it, so an unauthenticated RCE in PHP core reaches far beyond the obvious WordPress and Drupal estates. The exploitation picture is early and partly single-sourced: Cloudflare reports attack activity but has published no atomic detail, watchTowr reports reproduction of CVE-2026-109618, and no vendor has published a root cause, affected component or attack path. We will track the PHP release at 14:00 UTC, update this advisory with the confirmed affected and fixed versions and any NVD or CISA KEV entry, and reissue if a root cause or working exploit detail becomes public. Clients should complete the P1 inventory and patching actions before the release lands, not after.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.