23 October: millions of probes, no confirmed RCE, and a second PHP flaw
Censys counted more than 34.4 million vulnerable PHP services. PHP also disclosed an unpatched session-upload RCE that requires an unusual configuration.
Incident file CVE-2026-109618 · CVE-2026-109619 Research cut-off 23 October 2026, 13:58 UTC
PHP2Shell: verified updates, fixes and timeline
Two critical PHP runtime flaws, disclosed together on 21 October 2026. This record separates what the PHP project confirmed, what security vendors observed, and what remains unestablished. Every key claim links to the original source.
Patch8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
ExploitationAttempts observed; no confirmed mass compromise
Updated23 October 2026, 13:58 UTC
Independent publication. Not affiliated with PHP, any security vendor or any government agency. No exploit code is published here.
Source notice. The last automated source check was 23 October 2026, 13:52 UTC. This notice appears when that check is older than 24 hours; published content is retained, but the live status may be out of date. See per-source status.
01 Current assessment
What is established now
- Confirmed impact
-
Two memory-safety flaws in the PHP runtime allow unauthenticated remote code execution in affected configurations. The flaws are below the application layer: updating a CMS or plugin does not remove exposure.
PHP Group GitHub / PHP Security Team GitHub / PHP Security Team - Patch status
-
Fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older have no upstream release; source backports exist and distributions may backport the fix without changing the visible version string.
PHP Group PHP Group CERT-EU - Exploitation evidence
-
Attempts were observed before the patch, and attack traffic rose sharply after disclosure. Public reporting reviewed here documents attempts, PoCs and laboratory exploitation, not a confirmed mass compromise. Attempts are not victim counts.
SecurityWeek Cloudflare Bitdefender - KEV status
-
Neither PHP2Shell CVE appears in CISA KEV catalog version 2026.10.21, checked 23 October 2026, 13:52 UTC. This is a catalog observation, not proof that exploitation never occurred.
CISA - Last update
-
— the record adds a source-bounded early assessment of the patch, exploitation reports and unresolved questions. The build time is shown separately in the footer.
02 Latest updates
Latest PHP2Shell updates
New facts, corrections and open questions from the last day of reporting.
Early assessment: patches, attempts and unresolved questions
What the first day of PHP2Shell reporting established: the fixes are confirmed, attempts are documented, exposure estimates disagree, and no confirmed mass compromise has been publicly established.
Cloudflare reports millions of PHP2Shell attempts after disclosure
The WAF provider deployed protections about nine hours before disclosure and then tracked a steep rise in attack traffic. It still says customers must patch.
Amazon saw a PHP2Shell exploitation attempt four days before patches
A honeypot attempt on 17 October predates the leak and the public advisory. SecurityWeek reports that PoCs circulated hours before disclosure, but attempts are not confirmed compromises.
Fake PoCs, prank repositories and one failed webshell attempt
Researchers describe a messy exploit ecosystem: some public PoCs do not work, some crash targets, and at least one repository was a prank. That does not make the underlying flaw less serious.
CERT-EU, NCSC and CISA issue alerts as some sites go offline
The official advice is consistent: patch immediately, restart workers, and isolate if that is not possible. Some organisations chose to take services offline rather than wait.
03 Timeline
How the record developed
- 23 October 2026PHP flags an unpatched session-upload RCE as a separate issue Advisory
- 23 October 2026Attack traffic reaches millions; successful exploitation still unconfirmed Exploitation report
- 22 October 2026Researchers flag fake PoCs, prank repositories and an unconfirmed AWS claim Research
- 22 October 2026Exposure estimates vary widely; they are host counts, not victim counts Research
- 21 October 2026, 03:02 UTCCloudflare activates managed WAF rules about nine hours before disclosure Mitigation
05 Sources and verification
Sources and verification
What “confirmed” means
At least one primary source — a vendor advisory, a release note or a government alert — supports the claim.
What “reported” means
A vendor or media organisation reports it. The claim is attributed and not promoted to confirmed on repetition.
What “not established” means
The sources reviewed do not support it. This is a boundary of the search, not proof that the opposite is true.