PHP Project issues new guidance as PHP2Shell exploitation attempts mount

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two flaws with critical severity scores of 9.2 that affect most PHP builds, according to ZDNet. The PHP Project released patches for the bugs on Wednesday. PHP provides the backbone for many websites and services, from WordPress sites to e-commerce platforms, and Wiz's security team, which discovered the vulnerabilities with the help of AI, says PHP can be found on 70% of the world's websites.

The flaws include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, Wiz says. Attackers could execute code on affected servers or read sensitive process memory, stealing data and infiltrating corporate networks, according to ZDNet. Wiz says developing an attack chain to demonstrate exploitability required an exceptionally complex chain of steps that would have been at the edge of what human researchers could practically achieve; frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.

Amazon Threat Intelligence found attempts to exploit PHP2Shell were already happening four days before the vulnerabilities were made public, and proof-of-concept work began appearing hours later, ZDNet reported. A threat actor tied to PHP2Shell attack chains is attempting to deploy a Mirai-style botnet, and Cloudflare CEO Matthew Prince said the Cloudflare network was recording millions of exploitation attempts.

In its Oct. 23 advisory, the PHP Project urged organizations to set session.upload_progress.enabled=0 until the next scheduled bug fixes in PHP. The step was already listed as a mitigation in the Oct. 21 release, but the project said further investigation showed it can protect against a different remote code execution vector. That vector, CVE-2026-115560, requires an unusual configuration and application code setup, so the project considers it unlikely and says mitigation will suffice until it is handled in the regular release cycle. The project said an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(); session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.

The PHP Project urged users to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply the advisory's mitigations if immediate patching is not possible. The National Security Agency advised heightened awareness over the coming weeks and said vendor-issued patches tied to PHP2Shell should be prioritized. It also said companies should consider enhanced logging and replacing end-of-life PHP packages, and that all users should inventory hardware and software services reliant on vulnerable PHP versions where feasible.

Matthew Weier O'Phinney, principal product manager of Perforce Zend and OpenLogic, told ZDNet that most open source software and commercial LTS software distributions had patches available at the coordinated release or within a few hours afterward, and that PHP users likely have a fix available now.

Editor's Summary

The PHP Project has released patches and additional mitigation guidance for the critical PHP2Shell vulnerabilities, and the National Security Agency is urging organizations to prioritize fixes. Exploitation attempts were observed before public disclosure, and Cloudflare reported millions of attempts. PHP runs on about 70% of websites, according to Wiz.