PHP patches critical PHP2Shell flaws that were targeted before disclosure

PHP has patched two critical flaws, dubbed PHP2Shell, that let unauthenticated attackers run code on web servers, and Amazon says someone tried to exploit them four days before their Oct. 21 disclosure.

The bugs, CVE-2026-109618 and CVE-2026-109619, are in the PHP engine, not in apps built on it. Both are rated 9.2 (Critical) on CVSS v4.0, according to Ubuntu. Wiz said it achieved remote code execution (RCE) on the latest WordPress, Drupal and Joomla containers.

"There are no configuration-only workarounds that fully address both issues," AWS said in its security blog, adding that upgrading "is the only complete remediation." CISA urged organizations to update immediately.

AWS says PHP2Shell "is now seeing broad exploitation attempts in the wild," but no one has published a count of compromised servers. AWS also said it's unclear whether its early sightings would have worked on real systems. Which flaw reaches which older PHP branches also isn't spelled out in the sources EngineerPal reviewed.

Am I affected, and what should I do?

Any PHP that serves web requests is in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to PHP's security advisory. Wiz says every PHP version "released in the last decade" is affected by at least one of the flaws, back to 5.4.

Check the version on your server, but note that Linux distributions patch older version numbers. Ubuntu 24.04's fixed package, for example, is 8.3.6-0ubuntu0.24.04.13, so check your distro's advisory rather than the version string alone, as OpenAI's checker does.

php -v

1. Upgrade to a fixed release or your distro's patched package, and move off PHP 8.1 or older if you can.
2. Restart PHP-FPM and Apache workers, since a fixed package doesn't prove running workers use it.
3. Add a web application firewall (WAF) if you can't patch yet. Cloudflare says its free and paid WAF rules have protected customers by default since 11:02 p.m. ET Oct. 20 (8:02 p.m. PT; 0302 UTC Oct. 21), and AWS WAF added a PHP2Shell_BODY rule. Neither is a full fix.
4. Review logs from Oct. 17 on. AWS says to "look for POST requests with the PHP_SESSION_UPLOAD_PROGRESS string in form uploads" and check for unexpected processes and file changes.
5. Rotate secrets if you suspect exposure. Wiz says memory disclosure can leak "passwords, tokens, and API keys."

Attacked before disclosure, and found with AI

Amazon Threat Intelligence found a PHP2Shell exploitation attempt dated Oct. 17 in its MadPot honeypot data, from an IP address tied to a commercial anonymization network, Amazon Integrated Security CISO CJ Moses wrote. It "remains unclear how the actor acquired exploit information prior to disclosure," he said.

AWS saw its earliest proof-of-concept exploits at 10 p.m. ET Oct. 20 (7 p.m. PT; 0200 UTC Oct. 21), with varied payloads "suggesting these were multiple actors." "Defenders should not assume the public disclosure date is the earliest date of exploitation," Moses said. CISA said Oct. 21 it hadn't observed exploitation as of its alert.

The flaws were found with AI, twice. Security firm Calif found a flaw using OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet program, while Wiz Research found both independently with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Cloudflare also credits Quarkslab.

Wiz said it reported the flaws to PHP's security team on Aug. 24, and PHP began a coordinated fix on Sept. 21. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," Wiz said.

Disclosure was set for 10 a.m. ET Oct. 22 (1400 UTC) but moved up a day "due to a public leak," Ubuntu said. Sophos says the flaws' existence became public Oct. 20.

Hacker News user petecooper posted an apology: "I unknowingly broke the PHP RCE embargo. I am sorry." He said his contact had told him "there was no embargo." It hasn't been established that his post was the leak Ubuntu cited.

The next deadline is Dec. 31, when PHP 8.2 gets its last security fixes, according to php.net. Sites on 8.2 that patch now will need to move to 8.3 or later by then to keep getting fixes for flaws like these.