PHP 2Shell has moved from PoC status to active exploitation in the wild, with two critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Amazon Threat Intelligence first spotted attempted activity on 17 October, ahead of public disclosure, and public PoCs appeared on 21 October. Cloudflare’s monitoring echoed the surge in attack volume, describing thousands of attempts before the disclosure and runaway growth afterwards. Multiple payloads indicate more than one actor is involved, and the researchers note that PHP2Shell is now broadly exploited in real-world environments.
The vulnerabilities share a root cause related to PHP memory handling when a request ends abnormally. CVE-2026-109618 is an out-of-memory (OOM) corruption chain that can yield code execution as the web worker account, while CVE-2026-109619 involves a stale global state that can enable a heap use-after-free, memory disclosure and remote code execution. The issues affect PHP 8.2 through 8.5 releases prior to the fixed versions, with official updates patched in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP team notes that mod_php poses the highest risk, as an unauthenticated request can trigger the attack before any application code runs.
Defensive steps include upgrading to the fixed releases and restarting workers, applying backports for legacy versions, and mitigations such as temporarily limiting memory and post_max_size, disabling session.upload_progress.enabled, and, on PHP 8.5, enabling fatal_error_backtraces. Organisations should search for signs of compromise from 17 October onwards and prioritise patching, as public exploits are circulating rapidly.