PHP2Shell has the IT world on edge: two critical flaws in PHP itself, with more than 22 million potentially vulnerable servers. Exploitation has now been observed, including an attack on a European government body in which the attacker went from webshell to Active Directory in two hours.
PHP2Shell: two critical RCE flaws in PHP are being actively exploited, with AI-assisted attackers also active
| Vulnerability | Two memory bugs in the PHP core (collectively known as PHP2Shell) that allow an unauthenticated attacker to execute code remotely: a flaw in the handling of out-of-memory conditions and a use-after-free caused by global state left over between requests. All PHP installations that handle web requests are affected (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php most at risk |
| CVE number | CVE-2026-109618 and CVE-2026-109619 |
| CVSS score | 9.2 (CVSS 4.0) for both vulnerabilities |
| Actively exploited | Yes. Amazon recorded an attempt as early as 17 October 2026, four days before public disclosure. Unit 42 reported an attack on a European government body on 23 October |
| Patch available | Yes, since 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 7.4, 8.0 and 8.1 (end of life), only source-code backports are available; older versions will not receive a fix |
How has this been exploited?
Details of the flaws leaked online on 20 October, before the patches were ready. According to Help Net Security, Amazon Threat Intelligence’s MadPot honeypot network recorded an exploit attempt as early as 17 October from an IP address belonging to a commercial anonymisation service. A single unauthenticated request is enough, and the attack works before any application code runs. According to the available analysis, Rapid7 states that each of the public proofs of concept only works for a specific combination of operating system, PHP version and web server. That has not reduced the risk, however: Unit 42 observed an attacker at a European government body who was probably working with AI assistance. Within two hours of the initial intrusion, the attacker had stolen password hashes and MFA secrets, set up an NTLM relay tunnel to Active Directory and attempted to become Domain Admin.
What could the consequences be?
Palo Alto Cortex Xpanse counts more than 22.6 million potentially vulnerable instances. In the Netherlands, sites were taken offline as a precaution on 21 October, including those of the Tweede Kamer (the Dutch House of Representatives) and the Dutch NCSC, Dutch IT Channel reports. At that point, the NCSC had not yet seen any exploitation. For MSPs, this affects virtually every web hosting environment, every CMS and every client website running on its own server. A compromised web server is a springboard into the internal network, as the attack on the government body shows. Appliances that include PHP are also affected: Palo Alto reports that all PAN-OS and Panorama versions are vulnerable and that no fixes are available yet, while Fortinet and Cisco are still investigating their products.
What should IT administrators do now?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the patched packages from your Linux distribution or LTS vendor. If you have systems running PHP 8.1 or older, ask the vendor for a backport or take the system off the internet. If you cannot patch immediately, the UK’s NCSC recommends taking the system offline. As a temporary measure, Datadog suggests enforcing memory_limit=-1 at administrator level, supplemented by request limits on the frontend and memory limits on the container. Cloudflare has WAF rules for known attack patterns, including for free customers. In addition, look for webshells and anomalous traffic, especially on servers that have been publicly accessible since 17 October, and check rpms.remirepo.net users: that repository did not yet have an update at the time of publication. The open-source tool php2shell-scanner from Searchlight Cyber shows whether a host is exposed.
This article was originally published in Dutch on MSP Business. Read the original →
