---
title: "PHP2Shell exploited: what CISA confirmed · camada"
description: "CISA now lists the two PHP2Shell flaws as exploited. They allow code execution with no login. What is confirmed so far, and what to do if you run PHP."
url: https://www.camada.app/blog/php2shell
last_updated: 2026-11-04
---

# CISA lists PHP2Shell as exploited; mass website hacks remain unproven

The camada team · October 27, 2026 · 4 min read

## TL;DR

- Two PHP engine flaws allow code execution with no login. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- CISA listed both as exploited on October 26. Dream reports 25 rooted servers, mostly firewalls. Mass website hacks remain unproven.
- Patch, restart every worker, find PHP hidden inside appliances, and hunt for workers spawning shells.

CISA [added two PHP engine flaws](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) to its exploited list on October 26, five days after [PHP shipped fixes](https://www.php.net/archive/2026.php). An attacker with no login can send crafted HTTP requests and run code on the server. Your framework offers no cover: [CERT/CC says](https://kb.cert.org/vuls/id/763488) proof-of-concept exploits against Apache mod_php have fired before any app code runs. [CISA says](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) the bugs affect any PHP install serving web requests, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

## What broke

CVE-2026-109618 corrupts memory when PHP runs out of it while setting up a request. CVE-2026-109619 is a use-after-free: state from one request outlives its memory, and a later request on the same worker touches it. PHP rates both 9.2. [Datadog says](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) the trigger sits in the POST body. Our read: a URL filter will not catch it.

The fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also published source backports for 7.4, 8.0 and 8.1. [watchTowr says](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/) 7.3 and older are affected too, with no fix. On October 23 PHP flagged a third flaw, CVE-2026-115560, with no fix yet. It needs an unusual setup, and PHP suggests session.upload_progress.enabled=0 until the next release. On Windows, take the -1 builds, which also fix a Brotli flaw.

## What is confirmed

Attackers moved fast. Cloudflare reported [millions of attempts](https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html) by early October 22. [Censys counted](https://censys.com/advisory/cve-2026-109618-cve-2026-109619/) about 4.18 million hosts running PHP on October 23 and calls them potentially vulnerable. That figure measures exposure, and says nothing about breaches.

Confirmed shells are scarce. On October 24, [Adel Karimi logged 35 shells](https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md) on three honeypots, and warned that the single-worker setup favored the attacker. [Rapid7’s advisory](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/), last updated October 27, says each public exploit works against one mix of OS, PHP version and web server. It has not observed exploitation in the wild, though it notes reports of attempts.

The worst report so far involves firewalls. On October 26, [Dream said](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) attackers rooted 25 servers by chaining these bugs with a Linux kernel flaw. Most were firewalls from a large vendor it did not name. Our read: appliances ship one stack to every customer, so an exploit tuned once can repeat.

We would not relax. [Talos expects](https://blog.talosintelligence.com/two-critical-rces-in-php-core/) volume and skill to grow as stronger groups build their own tools. Be wary of early victim claims too: Unit 42 [retracted its report](https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html) tying these CVEs to a European government breach.

## What to do

- List every system running PHP. CISA warns that PHP often sits inside other software, where you may not spot it.
- Update, then [restart every worker](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/). PHP says only an update fully fixes this.
- If you run 8.1 or older, or cannot patch now, CISA says to take the system offline.
- Take management interfaces off the internet.
- Hunt on patched hosts too. CISA says to watch for PHP workers spawning shells or download tools. [ReliaQuest](https://reliaquest.com/blog/threat-spotlight-php2shell-responding-to-critical-php-vulnerabilities/) adds a log pattern: a POST returning 500, a memory-exhaustion error, then a worker crash. [Datadog’s exploit](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/) returned 200 with no crash, so do not wait for that pattern. Rapid7 warns that clean logs do not prove you are safe.

## Update, Nov 3

Exploitation in production is now confirmed, which changes the Rapid7 picture above. [Palo Alto Networks confirmed](https://fieldeffect.com/blog/php2shell-exploited-against-firewalls) on October 28 that attackers are exploiting exposed PAN-OS management interfaces. Dream’s update names PAN-OS. [Hunt.io said](https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls) on October 30 these are the first confirmed production compromises. [Unit 42 says](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) it verified the attackers’ tooling and results.

For websites, Hunt.io still saw no proof of reliable mass compromise. [Kaspersky said](https://kaspersky.com/blog/php2shell-two-weeks-after-patches/56647) on November 3 that no wave of breaches has come. Yet Censys data it cites shows 29 million of 46 million scannable servers still carry the flaws. That is a wider count than the 4.18 million hosts above.

[Singapore’s CSA](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-157/) names affected products from Palo Alto, Cisco, Citrix, F5 and Siemens, and says the list is not complete. Check your appliances.

## Sources

- [PHP project: advance notice and security advisory, October 2026](https://www.php.net/archive/2026.php)
- [CISA: Critical Vulnerabilities in PHP Require Immediate Patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)
- [CISA: adds two known exploited vulnerabilities to catalog, October 26](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CERT/CC: VU#763488](https://kb.cert.org/vuls/id/763488)
- [Dream: chained PHP2Shell exploit roots 25 servers](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
- [Palo Alto Networks: advisory on CVE-2026-109618](https://security.paloaltonetworks.com/CVE-2026-109618)
- [Field Effect: PHP2Shell exploited against firewalls](https://fieldeffect.com/blog/php2shell-exploited-against-firewalls)
- [Rapid7: Critical unauthenticated RCE in PHP](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/)
- [watchTowr: CVE-2026-109618 FAQ](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)
- [Datadog Security Labs: PHP2Shell](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/)
- [Censys: advisory on CVE-2026-109618 and CVE-2026-109619](https://censys.com/advisory/cve-2026-109618-cve-2026-109619/)
- [Cisco Talos: Two critical RCEs in PHP core](https://blog.talosintelligence.com/two-critical-rces-in-php-core/)
- [The Hacker News: PHP2Shell exploit attempts hit millions](https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html)
- [The Hacker News: PHP2Shell exploitation attempts continue](https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html)
- [Adel Karimi: honeypot report on confirmed RCE](https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md)
- [ReliaQuest: responding to PHP2Shell](https://reliaquest.com/blog/threat-spotlight-php2shell-responding-to-critical-php-vulnerabilities/)
- [Hunt.io: PHP2Shell one week later](https://hunt.io/blog/php2shell-honeypot-shells-root-palo-alto-firewalls)
- [Unit 42: Threat brief on CVE-2026-109618 and CVE-2026-109619](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/)
- [Kaspersky: PHP2Shell, what we know two weeks later](https://kaspersky.com/blog/php2shell-two-weeks-after-patches/56647)
- [CSA Singapore: active exploitation of PHP2Shell in network and security products](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-157/)

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)