Key points
- CVE-2026-109618 and CVE-2026-109619 allow remote code execution.
- Chainguard broke the disclosure embargo, accelerating attacker activity.
- Millions of exploit attempts have targeted vulnerable PHP servers.
Developers must update PHP installations immediately to address two critical vulnerabilities collectively known as PHP2Shell. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, enable remote code execution attacks on systems running the widely used programming language. The PHP Foundation released patches earlier than planned after cybersecurity firm Chainguard broke a coordinated disclosure embargo.
The premature release allowed attackers to analyze the binary fixes and create proof-of-concept exploits before many defenders could apply updates. According to AWS and Cloudflare, active exploitation began hours or days before the official disclosure. Consequently, millions of attempts to abuse these 9.2-severity bugs have been recorded since the issue became public.
View the original post on X
What we know
The PHP Foundation originally set an embargo for October 22 at 14:00 UTC for the coordinated release of details and mitigation actions. However, on October 20 around 15:00 UTC, the CVE IDs began circulating online without technical details. The PHP project moved its pre-announcement forward, publishing it at 19:30 UTC that same day.
One vulnerability stems from an out-of-memory problem first detected in 2024. Deep research into this issue occurred on July 30, 2026, after the PHP project joined OpenAI’s Patch the Planet program. Researchers from Calif, OpenAI, and Google Cloud’s Wiz clarified the full impact, making the fix a top priority.
Defender's checklist
- Verify current PHP version against the patched releases.
- Check server logs for signs of remote code execution attempts.
- Monitor network traffic for unusual outbound connections.
- Confirm that all web applications are running updated libraries.
What analysts watch for
Teams usually examine server logs for irregular memory consumption patterns that might indicate exploitation of out-of-memory flaws. Analysts check for unauthorized script execution and look for new user accounts created by attackers. They also review binary changes in recent updates to understand how patches alter code behavior. Monitoring for proof-of-concept tools circulating in threat forums helps identify emerging attack vectors before widespread damage occurs.
What to do and how to stay safe: PHP
- Apply the latest PHP security patches provided by the vendor immediately.
- Review access logs for any unauthorized remote code execution attempts.
- Isolate affected servers from the network if exploitation is confirmed.
- Once the vendor provides an update, verify that all dependencies are also secure.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the PHP2Shell vulnerabilities?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
Why were the patches released early?
Chainguard broke the coordinated disclosure embargo, prompting the PHP project to release patches ahead of schedule.
How severe are these vulnerabilities?
The bugs are rated 9.2 on the severity scale, allowing remote code execution.
