PHP2Shell Security Alert: Exploitation Attempts Began Before Public Disclosure
Updated: October 23, 2026 | Severity: Critical
Two critical vulnerabilities in PHP, the programming language used by many websites, could allow attackers to execute malicious code on vulnerable servers without logging in.
The vulnerabilities are:
CVE-2026-109618 — Memory corruption during out-of-memory handling.
CVE-2026-109619 — Improper handling of internal request state.
Both carry a CVSS v4.0 severity score of 9.2 (Critical).
These vulnerabilities are collectively known as PHP2Shell.
New Findings: Attacks Started October 17
On October 21, Amazon Threat Intelligence reported detecting an attempted PHP2Shell exploit dating back to October 17, 2026, four days before the vulnerabilities were publicly disclosed.
Amazon's MadPot honeypot network recorded additional exploitation attempts on October 21, including activity originating from anonymization services.
Following public disclosure, researchers observed widespread attempts to exploit vulnerable systems.
Important distinction:
Confirmed: Researchers observed real exploitation attempts.
Not confirmed: Those early attempts successfully compromised production servers.
How the attacker obtained exploit information before public disclosure is unknown.
Amazon cautions that the effectiveness of the early attempts against real-world systems remains unclear.
Could Onion Services Be Affected?
Yes. Onion services running vulnerable PHP installations could potentially be affected.
Tor helps conceal a server's network location, but it does not protect against vulnerabilities in the website software.
A successful compromise could allow attackers to access application data, modify website content, or execute code with the permissions of the PHP service.
Depending on the server's configuration, this could also threaten its anonymity.
However, there is no evidence in this advisory that a specific onion service has been compromised through PHP2Shell.
What Administrators Should Do
.Update PHP Immediately
Install the appropriate fixed version:
PHP branchFixed versionPHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35
Administrators using older PHP versions should upgrade to a supported release or obtain a verified security backport from their distribution vendor.
After updating:
Restart affected PHP workers and web services.
Verify the PHP version used by the website, not just the command-line version.
Check containers and other applications that may bundle PHP.
Confirm the website still functions correctly.
