{"slug":"php2shell","title":"PHP2Shell (CVE-2026-109618 / CVE-2026-109619)","shortName":"PHP2Shell","summary":"Two PHP core remote code execution bugs: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). PHP scores both CVSS 4.0 9.2. Exploitation attempts are widely reported; Google Threat Intelligence has not validated exploitation in the wild as of 23 Oct 2026. Neither CVE is in CISA KEV (catalog 2026.10.23, checked 24 Oct 2026).","isExample":false,"draft":false,"family":"php2shell","kind":"shared-component","aliases":["CVE-2026-109618","CVE-2026-109619","PHP2Shell","php2shell"],"publishedAt":"2026-10-21T13:48:34Z","updatedAt":"2026-10-24","patchStatus":"partly-patched","exploited":"attempts","scores":{"cve":"CVE-2026-109618","cvss":{"cve":"CVE-2026-109618","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","sourceDate":"2026-10-23","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2026-109618","score":0.1162,"percentile":0.96047,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-109618","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2026-109618","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"high"},"managementSummary":{"what":"Two PHP core remote code execution bugs (CVE-2026-109618 and CVE-2026-109619). Public exploitation attempts are widely reported; confirmed in-the-wild use is not validated. Not in CISA KEV.","action":"Patch PHP to the 21 Oct 2026 emergency releases and treat remaining internet-facing unpatched PHP as urgent."},"seenInTheWild":[{"metric":"exposed","value":3082629,"observer":"Censys","date":"2026-10-22","method":"Hosts running PHP (56,663,669 web properties); exposure, includes non-affected versions. Advisory update dated 22 Oct 2026","sourceUrl":"https://censys.com/advisory/cve-2026-109618-cve-2026-109619/"},{"metric":"possibly-vulnerable","value":"more than 34.4 million PHP services still assessed to be vulnerable","observer":"Censys","date":"2026-10-23","method":"Censys version assessment","sourceUrl":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"},{"metric":"scanning","value":"tens of thousands of attempts 45 minutes after disclosure, hundreds of thousands within 2 hours, millions as of early 22 Oct 2026","observer":"Cloudflare","date":"2026-10-22","method":"WAF-observed exploit attempts","sourceUrl":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"},{"metric":"scanning","value":"CVE-2026-109618 exploitation attempt recorded 17 Oct 2026, before disclosure; success unclear","observer":"Amazon MadPot honeypots","date":"2026-10-17","method":"Honeypot","sourceUrl":"https://censys.com/advisory/cve-2026-109618-cve-2026-109619/"},{"metric":"scanning","value":"one unsuccessful exploitation attempt against CVE-2026-109618 from a China-based IP","observer":"VulnCheck sensors","date":"2026-10-22","method":"Sensor network","sourceUrl":"https://censys.com/advisory/cve-2026-109618-cve-2026-109619/"},{"metric":"exposed","value":1863662,"observer":"Shodan","date":"2026-10-23","method":"Product query http.component:\"PHP\"","sourceUrl":"https://www.shodan.io/search?query=http.component%3A%22PHP%22","note":"Exposed hosts. Data: Shodan."}],"seenInTheWildLinks":[{"title":"PHP Session Upload Progress Exploit Attempt","url":"https://viz.greynoise.io/tags/php-session-upload-progress-exploit-attempt","observer":"GreyNoise","metric":"scanning"},{"title":"PHP CVE-2026-109619 Session Upload Progress Check","url":"https://viz.greynoise.io/tags/php-session-upload-progress-check","observer":"GreyNoise","metric":"scanning"},{"title":"php2shell Tooling","url":"https://viz.greynoise.io/tags/php2shell-tooling","observer":"GreyNoise","metric":"scanning"},{"title":"Censys PHP2Shell Exposure Tracker (free, hourly)","url":"https://censys.com/php2shell","observer":"Censys","metric":"exposed","cadence":"hourly"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Google Threat Intelligence: no validated in-the-wild exploitation; some public PoCs work on default mod_php, not PHP-FPM.","section":"exploitation","sourceUrl":"https://x.com/JohnHultquist/status/2113686799708991522"},{"text":"Google Cloud blog updated 23 Oct with Mandiant pre-patch hardening and 23 SecOps detections (GLOBAL.26.015).","section":"defenders","sourceUrl":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"},{"text":"Still not in CISA KEV as of catalog 2026.10.23, checked 24 Oct 2026.","section":"exploitation","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"text":"VirusTotal sized the internet-facing PHP exposure window (21 Oct 2026).","section":"coverage","sourceUrl":"https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html"},{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"PHP2Shell (also php2shell) is a public nickname from Wiz's exploit-script name; CISA, AWS, Ubuntu, Splunk and Cisco use it. PHP's own advisories do not. They name CVE-2026-109618 “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp), published 21 Oct 2026. This page follows PHP's GHSA CVE-to-bug mapping, not Wiz's table.\n\nCVE-2026-109618 (CNA): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\n\nCVE-2026-109619 (CNA): PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). The CNA record also lists CAPEC-234.\n\nThe bugs sit in PHP core (Zend engine / SAPI request lifecycle; multipart/RFC1867 body parsing, session upload progress, error handling). This page uses PHP's GHSA mapping: session upload-progress is under CVE-2026-109619 (stale global state); CVE-2026-109618 is described as $_POST/multipart OOM corruption. Wiz's public table files some of those techniques under the other CVE. Treated here as an open discrepancy, not a resolved fact.\n\nPHP describes Apache mod_php as highest risk (confirmed app-independent RCE before application code). PHP-FPM, php-cgi, FrankenPHP (likely susceptible for CVE-2026-109618 by source analysis), and LiteSpeed/LSAPI (conditional/unvalidated) are also discussed in the advisories, with varying confirmation. This is not an exploit recipe.\n\nFixed upstream branches announced 21 Oct 2026: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (8.2 EOL 31 Dec 2026). The php.net ChangeLog lists those four releases as 22 Oct 2026. This page uses the 21 Oct news/GitHub date and records the ChangeLog difference as a note. PHP 8.1 and older no longer get updates from the PHP project; the security team provided minimal source backports for 7.4, 8.0 and 8.1 (no binaries).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"request","label":"Request","detail":"A network request reaches PHP (Zend engine / SAPI request lifecycle)."},{"id":"oom-or-stale","label":"OOM or stale state","detail":"CVE-2026-109618: an OOM abort can leave request memory uninitialized. CVE-2026-109619: global state may still refer to freed request memory."},{"id":"corrupt","label":"Memory corruption","detail":"Later request cleanup, or a later request on the same worker, may read or branch on that memory."},{"id":"exec","label":"Code exec","detail":"PHP's CNA records say this condition can lead to remote code execution. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-21","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Last verified 24 Oct 2026. CISA KEV catalog 2026.10.23 (released 2026-10-23T19:30:18Z, 1,756 entries). Neither CVE-2026-109618 nor CVE-2026-109619 is listed."},"firstSeen":{"date":"2026-10-17","source":"AWS Security Blog / MadPot","note":"Amazon's MadPot honeypots logged an exploitation attempt from anonymising infrastructure while the bugs were still under embargo; Amazon says it is unclear whether such attempts would succeed."},"vendorStatements":[{"vendor":"CISA","date":"Release Date October 21, 2026","statement":"Alert “Critical Vulnerabilities in PHP Require Immediate Patching”. Quote: “While CISA has not observed exploitation of these vulnerabilities as of the time of publication...”. CISA SSVC (ADP) 2026-10-21: exploitation none, automatable no, impact total.","url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","retracted":false},{"vendor":"AWS","date":"21 OCT 2026","statement":"First MadPot attempt dated Oct 17, 2026; further attempts 21 Oct 02:00-08:00 UTC. Quote: “it's unclear if any of these attempts would have succeeded”. Later “broad exploitation attempts” wording refers to attempts, not confirmed compromises. AWS services are not impacted (bulletin 2026-143-AWS).","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","retracted":false},{"vendor":"watchTowr (own pages)","date":"Published Oct 21, 2026 14:19 UTC; Last updated October 22, 2026","statement":"watchTowr's own intelligence pages say “Exploited in the wild: Yes” and that Attacker Eye honeypots observed exploitation from 21 Oct. On 20 Oct watchTowr said on X it had reproduced the bug and would not publish details.","url":"https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","retracted":false},{"vendor":"watchTowr via SecurityWeek (Jake Knott email)","date":"October 22, 2026 (5:48 AM ET)","statement":"Secondary quote only. Not found on a watchTowr-owned page. SecurityWeek quotes Jake Knott (watchTowr head of threat intel) by email: “The exploits being sprayed indiscriminately either don't work at all, test for timing-based differences, or crash the target.”","url":"https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/","retracted":false},{"vendor":"Sophos CTU blog","date":"22 Oct 16:18 UTC claim; 22 Oct 21:21 UTC correction","statement":"The 22 Oct 16:18 UTC update reported “one successful exploitation”. The 22 Oct 21:21 UTC update corrected that: “telemetry shows scanning and a small number of failed exploitation attempts ... no evidence of a successful compromise”. Failed attempts only (Mirai “Potassium” payload blocked).","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","retracted":true},{"vendor":"Imperva","date":"Oct 22, 2026","statement":"482,342 requests, 122,311 sessions and 21,998 sites across 103 countries in the first 24h. These “do not represent confirmed successful exploitation”.","url":"https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens/","retracted":false},{"vendor":"Palo Alto Networks","date":"Published 2026-10-21, Updated 2026-10-23","statement":"PAN is “not aware of any malicious exploitation ... against our products”.","url":"https://security.paloaltonetworks.com/CVE-2026-109618","retracted":false},{"vendor":"Cisco PSIRT","date":"First Published 2026 October 21 19:12 GMT; rev 1.4 2026-OCT-22","statement":"Cisco PSIRT is not aware of malicious use. Advisory ID cisco-sa-php-october26-Jj384Daq (revision 1.4, Interim).","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","retracted":false},{"vendor":"Google Threat Intelligence Group","date":"23 Oct 2026 17:39 UTC","statement":"We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be \"vibe-coded\" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM. Hultquist also wrote that exploitation may have already begun in a limited fashion.","url":"https://x.com/JohnHultquist/status/2113686799708991522","retracted":false}]},"timeline":[{"date":"2026-08-05T15:54:24Z","event":"A Calif researcher (@lcfr_hax) posted a bare hash on X; Calif later pointed to it as proof he found and exploited the bug class first. (Priority claim by Calif; the 5 Aug post itself is only a hash. Wiz gives its own discovery date of 19 Aug.)","source":{"title":"Calif post on X (quoting the 5 Aug post)","url":"https://x.com/calif_io/status/2112914613297668583","publisher":"Calif (X)"},"kind":"other"},{"date":"2026-08-11","event":"PHP's security team received its first reports of the issues, according to Sophos. (Secondary: stated by Sophos, not by PHP directly.)","source":{"title":"Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","publisher":"Sophos"},"kind":"disclosure"},{"date":"2026-08-19","event":"Wiz Research says it found the first of the PHP bugs using AI-assisted analysis.","source":{"title":"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet","url":"https://www.wiz.io/blog/php2shell-php-rce","publisher":"Wiz Research"},"kind":"disclosure"},{"date":"2026-08-24","event":"Wiz says it reported the vulnerabilities to the PHP security team.","source":{"title":"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet","url":"https://www.wiz.io/blog/php2shell-php-rce","publisher":"Wiz Research"},"kind":"disclosure"},{"date":"2026-10-12T21:03:58Z","event":"CVE-2026-109618 and CVE-2026-109619 were reserved by PHP as CNA (-109619 at 21:04:00Z).","source":{"title":"CVE-2026-109618 (CVE Services API record)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-109618","publisher":"CVE Program / PHP CNA"},"kind":"other"},{"id":"exploitation-attempts","date":"2026-10-17","event":"Amazon's MadPot honeypots logged an exploitation attempt from anonymising infrastructure while the bugs were still under embargo; Amazon says it is unclear whether such attempts would succeed.","source":{"title":"Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","publisher":"AWS Security Blog"},"kind":"exploited","key":true},{"date":"2026-10-20","event":"PHP pre-announced an emergency security release for two critical bugs rated CVSS 4.0 9.2. (The live page now says the release was scheduled for 21 Oct 14:00 UTC; watchTowr's 20 Oct post says everyone was meant to wait until 'Thursday at 11am ET' (22 Oct), and BleepingComputer reports PHP brought the date forward after a leak. The page may have been edited.)","source":{"title":"Upcoming Critical PHP Security Release","url":"https://www.php.net/archive/2026.php#2026-10-20-1","publisher":"PHP Group (php.net)"},"kind":"disclosure"},{"date":"2026-10-20T18:26:48Z","event":"After details leaked ahead of the embargo, watchTowr publicly confirmed the PHP RCE bugs were real but withheld technical details.","source":{"title":"watchTowr post on X","url":"https://x.com/watchtowrcyber/status/2112611507749982605","publisher":"watchTowr (X)"},"kind":"disclosure","key":true},{"date":"2026-10-21","event":"PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing both CVEs, plus source-only backports for 7.4, 8.0 and 8.1. (php.net news posts are dated 21 Oct 2026, but the php.net ChangeLog lists all four releases as 22 Oct 2026. We use 21 Oct, which matches the GHSAs and CVE records.)","source":{"title":"Security advisory: Critical remote code execution vulnerabilities, update now","url":"https://www.php.net/archive/2026.php#2026-10-21-5","publisher":"PHP Group (php.net)"},"kind":"patch","key":true},{"date":"2026-10-21","event":"CISA urged immediate patching and said it had not observed exploitation at publication; it told organisations on PHP 8.1 or earlier to take PHP systems offline.","source":{"title":"Critical Vulnerabilities in PHP Require Immediate Patching","url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","publisher":"CISA"},"kind":"other"},{"date":"2026-10-21","event":"The UK NCSC told organisations to update PHP immediately or take systems offline if they cannot. (Page metadata: published 2026-10-21, modified 2026-10-22.)","source":{"title":"Critical security issue affecting PHP","url":"https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php","publisher":"NCSC (UK)"},"kind":"other"},{"date":"2026-10-21","event":"Palo Alto Networks said the management web interface of PAN-OS, Panorama and WF-500 appliances is affected, with no fixed releases yet. (Advisory updated again on 2026-10-23.)","source":{"title":"Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products","url":"https://security.paloaltonetworks.com/CVE-2026-109618","publisher":"Palo Alto Networks PSIRT"},"kind":"vendor"},{"date":"2026-10-21","event":"F5 published K000163821, listing BIG-IP Configuration utility and APM/SSLO as affected with no fixes yet. (From this morning's pack (rendered with headless Chrome); not re-fetched in this pass.)","source":{"title":"K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619","url":"https://my.f5.com/manage/s/article/K000163821","publisher":"F5"},"kind":"vendor"},{"date":"2026-10-21","event":"Sophos said no Sophos products are affected; its legacy MyUTM licensing portal ran an affected PHP and was taken offline.","source":{"title":"Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","publisher":"Sophos"},"kind":"vendor"},{"date":"2026-10-21T02:00:00Z","event":"Amazon saw the first public proof-of-concept exploits around 02:00 UTC and further attempts against its honeypots until 08:00 UTC, before the fix shipped. (PoCs noted as existing only; no links to exploit code.)","source":{"title":"Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","publisher":"AWS Security Blog"},"kind":"poc"},{"date":"2026-10-21T13:34:13Z","event":"PHP published its GitHub security advisories GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) and, at 13:34:25Z, GHSA-w8hw-w9fx-j79w (CVE-2026-109618). (Times from the GitHub API published_at field.)","source":{"title":"RCE via stale global state (GHSA-6wmf-4rv5-p3rp)","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","publisher":"PHP (php-src on GitHub)"},"kind":"disclosure","key":true},{"date":"2026-10-21T13:48:34Z","event":"The CVE records went public on cve.org: CVE-2026-109618 'RCE via OOM corruption' and, at 13:54:43Z, CVE-2026-109619 'RCE via stale global state', both CVSS 4.0 9.2.","source":{"title":"CVE-2026-109618 (CVE Services API record)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-109618","publisher":"CVE Program / PHP CNA"},"kind":"disclosure"},{"date":"2026-10-21T13:56:45Z","event":"Cloudflare said it had already pushed default WAF rules for the bugs before public disclosure.","source":{"title":"Cloudflare deploys protections against php2shell vulnerability","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","publisher":"Cloudflare Blog"},"kind":"vendor"},{"date":"2026-10-21T14:04:39Z","event":"CISA released KEV catalog version 2026.10.21; neither PHP CVE was in it.","source":{"title":"Known Exploited Vulnerabilities Catalog (JSON feed)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev"},{"date":"2026-10-21T14:17:09Z","event":"NVD published entries for both CVEs, later scoring them CVSS 3.1 9.8 (-109618) and 8.1 (-109619).","source":{"title":"NVD - CVE-2026-109618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","publisher":"NIST NVD"},"kind":"other"},{"date":"2026-10-21T14:19:57Z","event":"watchTowr published its PHP2Shell page, marking the bugs 'Exploited in the wild: Yes' based on its honeypots. (Honeypot observation of exploitation activity; not a confirmed compromise of a real system.)","source":{"title":"PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619","url":"https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","publisher":"watchTowr"},"kind":"exploited"},{"date":"2026-10-21T14:28:00Z","event":"Sophos CTU reissued its advisory after PHP's release, saying no active exploitation had been reported yet. (Original version at about 12:55 UTC, per the page.)","source":{"title":"Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","publisher":"Sophos Counter Threat Unit"},"kind":"vendor"},{"date":"2026-10-21T19:12:00Z","event":"Cisco published cisco-sa-php-october26-Jj384Daq, confirming URWB and Expressway as vulnerable and many products under investigation.","source":{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026 (cisco-sa-php-october26-Jj384Daq)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","publisher":"Cisco PSIRT"},"kind":"vendor"},{"date":"2026-10-21T21:30:00Z","event":"AWS bulletin 2026-143-AWS said AWS services are not impacted and listed customer guidance for Elastic Beanstalk, Lightsail, Amazon Linux and others. (Shown as 10/21/2026 14:30 PDT. AWS says no fix exists for -109618 on EOL branches 5.4-8.1, which conflicts with PHP's source backports for 7.4/8.0/8.1.)","source":{"title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","url":"https://aws.amazon.com/security/security-bulletins/2026-143-aws/","publisher":"AWS"},"kind":"vendor"},{"date":"2026-10-22","event":"HPE published HPESBNW05171: ClearPass Policy Manager affected, with 6.14.1/6.11.16 only partially mitigating.","source":{"title":"HPESBNW05171: Multiple \"PHP2Shell\" Vulnerabilities identified in PHP allow for Unauthenticated Remote Code Execution in HPE Networking ClearPass Policy Manager","url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05171.txt","publisher":"HPE Networking PSIRT"},"kind":"vendor"},{"date":"2026-10-22","event":"Splunk SVD-2026-1013 said no Splunk products are currently known to be affected, with OnCall, AppDynamics SaaS and Smartlook still under investigation. (Not a 'not affected' statement for the three products under investigation.)","source":{"title":"SVD-2026-1013: Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","publisher":"Splunk"},"kind":"vendor"},{"date":"2026-10-22","event":"Citrix said NetScaler management interfaces are affected and that it plans fixes for all supported versions on 27 Oct 2026. (Shown as 'Last updated on: October 22, 2026 (PDT)'. The first-posted date only appears as a relative time.)","source":{"title":"Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","publisher":"NetScaler Product Security (Citrix Community)"},"kind":"vendor"},{"date":"2026-10-22T09:48:00Z","event":"SecurityWeek quoted watchTowr's Jake Knott saying the exploits being sprayed either don't work, only test timing, or crash the target. (Shown as 5:48 AM ET. This is an emailed statement quoted by SecurityWeek, not a watchTowr publication.)","source":{"title":"PHP2Shell Exploitation Started Days Before Patches","url":"https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/","publisher":"SecurityWeek"},"kind":"poc"},{"date":"2026-10-22T12:05:00Z","event":"Searchlight Cyber released an open-source scanner to check whether hosts are exposed, per Help Net Security. (Shown as an update at 08:05 AM ET on 22 Oct.)","source":{"title":"PHP2Shell: Critical PHP vulnerabilities patched, update now!","url":"https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/","publisher":"Help Net Security"},"kind":"other"},{"date":"2026-10-22T16:18:00Z","event":"Sophos CTU updated its blog to report one successful PHP2Shell exploitation in customer environments. (Retracted at 21:21 UTC the same day (next entry).)","source":{"title":"Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","publisher":"Sophos Counter Threat Unit"},"kind":"exploited","key":true},{"date":"2026-10-22T16:30:48Z","event":"Imperva reported about 482k attack requests across about 22k sites in the first 24 hours, but said this was not confirmed successful exploitation.","source":{"title":"PHP2Shell: Early Attack Activity Through Imperva's Lens","url":"https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens/","publisher":"Imperva"},"kind":"exploited"},{"date":"2026-10-22T20:37:52Z","event":"VulnCheck told The Register it had built an exploit for CVE-2026-109618 that defeats ASLR on x86-64, shared only with its paying customers. (Not public, so no link and no details. The page shows 'Published thu 22 Oct 2026 // 21:37 UTC', while its metadata says 20:37:52Z; we use the metadata time.)","source":{"title":"PHP2Shell exploit bypasses protections designed to stop remote code execution","url":"https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883","publisher":"The Register"},"kind":"poc"},{"date":"2026-10-22T21:21:00Z","event":"Sophos CTU retracted its 'successful exploitation' claim: its telemetry showed only scanning and a few failed attempts, with no evidence of a successful compromise.","source":{"title":"Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","publisher":"Sophos Counter Threat Unit"},"kind":"retraction","key":true},{"date":"2026-10-22T23:00:00Z","event":"Cisco updated its advisory to revision 1.4 (Interim), revising the lists of products under investigation and products confirmed not vulnerable.","source":{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026 (cisco-sa-php-october26-Jj384Daq)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","publisher":"Cisco PSIRT"},"kind":"vendor"},{"date":"2026-10-22T23:18:22Z","event":"NVD last modified both entries; -109618 shows as Analyzed and -109619 as Modified.","source":{"title":"NVD - CVE-2026-109619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619","publisher":"NIST NVD"},"kind":"other"},{"date":"2026-10-22","event":"Hunt.io reported open-directory PHP2Shell tooling and a Mirai-style scanner, with zero confirmed shells.","source":{"title":"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)","url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","publisher":"Hunt.io"},"kind":"exploited","addedDate":"2026-10-22"},{"date":"2026-10-22T03:53:20Z","event":"Assetnote published php2shell-scanner, an open-source defender scanner for CVE-2026-109618 and CVE-2026-109619. (Repository created 22 Oct 2026.)","source":{"title":"assetnote/php2shell-scanner","url":"https://github.com/assetnote/php2shell-scanner","publisher":"Assetnote"},"kind":"other","addedDate":"2026-10-22"},{"date":"2026-10-22T23:00:00Z","event":"VulnCheck reported that one public PoC achieved an ASLR bypass on x86-64 with PHP 8.4.26 and the default heap only, and that it did not work outside that setup. (As of 7 PM ET on 22 Oct 2026. No exploit detail here.)","source":{"title":"PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","publisher":"VulnCheck"},"kind":"poc","addedDate":"2026-10-22"},{"date":"2026-10-23","event":"Palo Alto Networks updated its advisory with status changes for Cortex, Strata Cloud Manager and WildFire products, and added estimated availability dates for PAN-OS hotfixes. WildFire appliance remains ETA TBD.","source":{"title":"Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products","url":"https://security.paloaltonetworks.com/CVE-2026-109618","publisher":"Palo Alto Networks PSIRT"},"kind":"vendor","addedDate":"2026-10-23"},{"date":"2026-10-23","event":"PHP published an informational advisory for reserved CVE-2026-115560. It is not fixed by 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP asked operators to keep session.upload_progress.enabled=0 until the next regular bugfix release, and said a full advisory will come with that release.","source":{"title":"Informational advisory: Session upload progress","url":"https://www.php.net/archive/2026.php#2026-10-23-1","publisher":"PHP Group (php.net)"},"kind":"advisory","key":true,"addedDate":"2026-10-23"},{"date":"2026-10-23","event":"Siemens published SSA-566512, listing RUGGEDCOM APE1808 with PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 as affected. The advisory tells customers to contact support for patch and update information.","source":{"title":"SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html","publisher":"Siemens ProductCERT"},"kind":"vendor","addedDate":"2026-10-23"},{"date":"2026-10-23","event":"Red Hat published EUS and Extended Life RHSAs for CVE-2026-109618, including RHSA-2026:88561, RHSA-2026:88565, RHSA-2026:88533 and RHSA-2026:88532.","source":{"title":"CVE-2026-109618 (Red Hat CVE API)","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json","publisher":"Red Hat"},"kind":"vendor","addedDate":"2026-10-23"},{"date":"2026-10-23T14:36:00Z","event":"Re-checked the live KEV feed: it is still catalog version 2026.10.21 (released 2026-10-21T14:04:39Z, 1,754 entries), and neither PHP CVE is listed. (Checked 2026-10-23 22:36 SGT (UTC+8), evening.)","source":{"title":"Known Exploited Vulnerabilities Catalog (JSON feed)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","addedDate":"2026-10-23"},{"date":"2026-10-23T17:39:38Z","event":"John Hultquist (Google Threat Intelligence Group) wrote that GTIG has not validated exploitation in the wild and has no evidence of successful wide-scale exploitation, that some public PoCs appear incapable of RCE, and that some validated PoCs can achieve RCE against default mod_php but not PHP-FPM. He also wrote that exploitation may have already begun in a limited fashion.","source":{"title":"John Hultquist on X","url":"https://x.com/JohnHultquist/status/2113686799708991522","publisher":"Google Threat Intelligence Group"},"kind":"poc","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-23T22:20:00Z","event":"Google Cloud blog editor's note: updated 23 Oct 2026 at 3:20 p.m. PDT with Mandiant Consulting guidance on monitoring, patching and remediation, including 23 new Google SecOps curated detections (GLOBAL.26.015) and pre-patch hardening.","source":{"title":"Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","publisher":"Google Cloud"},"kind":"advisory","addedDate":"2026-10-24"},{"date":"2026-10-24","event":"Re-checked the live KEV feed: catalog version 2026.10.23 (released 2026-10-23T19:30:18Z, 1,756 entries). Neither CVE-2026-109618 nor CVE-2026-109619 is listed. (Checked 24 Oct 2026.)","source":{"title":"Known Exploited Vulnerabilities Catalog (JSON feed)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-27","event":"Citrix's planned release date for NetScaler fixes. This has not happened yet.","source":{"title":"Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","publisher":"NetScaler Product Security (Citrix Community)"},"kind":"vendor","planned":true,"key":true}],"openNotes":[{"title":"PHP release date: 21 Oct news vs 22 Oct ChangeLog","detail":"php.net news posts say 21 Oct 2026, but ChangeLog-8.php says 22 Oct 2026. The GHSAs went out on 21 Oct at 13:34Z and the CVE records at 13:48 and 13:54Z. This page uses 21 Oct.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP Group (php.net)"},{"url":"https://www.php.net/ChangeLog-8.php","date":"2026-10-22","publisher":"PHP Group"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","date":"2026-10-21T13:34:13Z","publisher":"PHP (php-src on GitHub)"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-109618","date":"2026-10-21T13:48:34Z","publisher":"CVE Program / PHP CNA"}]},{"title":"Planned embargo / release time: 21 Oct vs 22 Oct","detail":"The live php.net pre-announcement (20 Oct) says the release was scheduled for 21 Oct 14:00 UTC. watchTowr's 20 Oct post says everyone was meant to wait until 'Thursday at 11am ET' (22 Oct), and the earlier pack (Ubuntu) said 22 Oct 14:00 UTC. BleepingComputer reports that PHP brought the date forward after the leak, so the php.net page was likely edited. Unresolved.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-20-1","date":"2026-10-20","publisher":"PHP Group (php.net)"},{"url":"https://x.com/watchtowrcyber/status/2112611507749982605","date":"2026-10-20T18:26:48Z","publisher":"watchTowr (X)"},{"url":"https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/","date":"2026-10-21","publisher":"BleepingComputer (Sergiu Gatlan)"}]},{"title":"watchTowr 'exploited in the wild' vs sprayed-PoC quote","detail":"watchTowr's own page says 'Exploited in the wild: Yes' based on its honeypots. The line that sprayed exploits don't work, only test timing, or crash the target comes only from an emailed statement by Jake Knott quoted by SecurityWeek, not a watchTowr publication. Both are dated; neither is collapsed into a single verdict here.","sources":[{"url":"https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","date":"2026-10-21T14:19:57Z","publisher":"watchTowr"},{"url":"https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/","date":"2026-10-22T09:48:00Z","publisher":"SecurityWeek"}]},{"title":"AWS vs PHP on EOL branches","detail":"AWS bulletin 2026-143-AWS says there is no fix for CVE-2026-109618 on end-of-life branches 5.4–8.1. PHP published source-only backports for 7.4, 8.0 and 8.1. This is unresolved.","sources":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-143-aws/","date":"2026-10-21T21:30:00Z","publisher":"AWS"},{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP Group (php.net)"}]},{"title":"The Register timestamp for the VulnCheck report","detail":"The Register page shows 'Published thu 22 Oct 2026 // 21:37 UTC', while its metadata says 20:37:52Z. This page uses the metadata time 2026-10-22T20:37:52Z. VulnCheck's ASLR-bypass exploit for CVE-2026-109618 is private (customers only); there is no public exploit link.","sources":[{"url":"https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883","date":"2026-10-22T20:37:52Z","publisher":"The Register"}]},{"title":"@php_net on X is not used","detail":"The @php_net account is unverified and its release posts link to php-net.pro ('The Dev Dispatch'), not php.net. Treat it as unofficial. This page does not cite it.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP Group (php.net)"}]},{"title":"F5 advisory not re-fetched in this pass","detail":"F5 K000163821 is taken from this morning's pack (rendered with headless Chrome) and was not re-fetched in the 23 Oct 2026 11:10 SGT timeline/news pass.","sources":[{"url":"https://my.f5.com/manage/s/article/K000163821","date":"2026-10-21","publisher":"F5"}]},{"title":"Wiz vs PHP CVE-to-bug mapping","detail":"Wiz's bug-to-CVE mapping differs from PHP's GHSAs. This page uses PHP's mapping.","sources":[{"url":"https://www.wiz.io/blog/php2shell-php-rce","date":"2026-10-21","publisher":"Wiz Research"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","date":"2026-10-21T13:34:25Z","publisher":"PHP (php-src on GitHub)"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","date":"2026-10-21T13:34:13Z","publisher":"PHP (php-src on GitHub)"}]},{"title":"Related advisory: CVE-2026-115560 (informational, reserved)","detail":"On 23 Oct 2026 PHP published an informational advisory for reserved CVE-2026-115560. It is not PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and is not fixed by 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP asked operators to keep session.upload_progress.enabled=0 until the next regular bugfix release, and said a full advisory will come with that release. PHP describes an unusual serialize-handler switch at runtime while session upload progress is still enabled. This page does not treat it as a PHP2Shell CVE.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-23-1","date":"2026-10-23","publisher":"PHP Group (php.net)"}]},{"title":"Discovery-priority claims are not ranked here","detail":"A Calif researcher (@lcfr_hax) posted a bare hash on 5 Aug 2026; Calif later pointed to it as proof he found and exploited the bug class first. Wiz gives its own discovery date of 19 Aug. Sophos says PHP received first reports on 11 Aug. Dated claims only.","sources":[{"url":"https://x.com/calif_io/status/2112914613297668583","date":"2026-10-21T14:31:14Z","publisher":"Calif (X)"},{"url":"https://www.wiz.io/blog/php2shell-php-rce","date":"2026-10-21","publisher":"Wiz Research"},{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","date":"2026-10-21","publisher":"Sophos"}]}],"defenderActions":[{"title":"Patch PHP","detail":"Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP states updating is the only complete fix. Interim mitigations below are not complete.","priority":"now","links":[{"label":"PHP advisory","href":"https://www.php.net/archive/2026.php#2026-10-21-5"}]},{"title":"Keep session.upload_progress.enabled=0 (CVE-2026-115560 informational)","detail":"On 23 Oct 2026 PHP published an informational advisory for reserved CVE-2026-115560. It is not fixed by 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Keep session.upload_progress.enabled=0 until the next regular bugfix release. PHP will publish a full advisory with that release. If you already set this for CVE-2026-109619, keep it. The issue applies only under an unusual serialize-handler switch at runtime while session upload progress is still enabled.","priority":"now","links":[{"label":"PHP informational advisory","href":"https://www.php.net/archive/2026.php#2026-10-23-1"}]},{"title":"End-of-life PHP, or you cannot patch","detail":"CISA tells organisations on PHP 8.1 or earlier, or that cannot update, to take PHP systems offline. PHP 8.1 and older no longer get updates from the PHP project (source backports for 7.4/8.0/8.1 exist; see the open EOL note).","priority":"now","links":[{"label":"CISA","href":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching"},{"label":"EOL open question","href":"#caveats"}]},{"title":"Find PHP you do not manage directly","detail":"Look for PHP in appliances, NAS, hosting panels, containers, and CMS hosts. Check the downstream matrix below for your vendors. Treat “no statement yet” as unknown, not safe.","priority":"now","links":[{"label":"Downstream matrix","href":"#downstream"}]},{"title":"Restrict appliance management interfaces","detail":"Until your vendor ships a fix, restrict management interfaces to trusted admin networks. Several appliance vendors in the downstream matrix give this as the interim control.","priority":"now","links":[{"label":"Downstream matrix","href":"#downstream"}]},{"title":"Interim PHP mitigations are a bridge only","detail":"PHP lists, as incomplete bridges: memory_limit=-1 enforced administratively (CVE-2026-109618); low post_max_size; frontend limits on decoded size/parts/headers/nesting; do not use RLIMIT_AS/RLIMIT_DATA; session.upload_progress.enabled=0 and restart workers (CVE-2026-109619 session path); PHP 8.5 fatal_error_backtraces=0 (CVE-2026-109619 backtrace path); remove per-request INI that emits diagnostics; fix attacker-reachable fatal errors/timeouts.","priority":"soon","links":[{"label":"PHP advisory","href":"https://www.php.net/archive/2026.php#2026-10-21-5"}]},{"title":"Turn on WAF / IPS PHP2Shell signatures","detail":"Enable your WAF or IPS vendor's PHP2Shell signatures. Signature IDs stay in Detection.","priority":"soon","links":[{"label":"Detection","href":"#detection"}]},{"title":"Watch for vendor fixes and retractions","detail":"Subscribe to your vendors' PSIRTs and to this page's feed.","priority":"monitor","links":[{"label":"RSS","href":"/rss.xml"},{"label":"JSON feed","href":"/feed.json"}]},{"title":"Use your distro's PHP packages","detail":"On Ubuntu and other Linux distributions, apply the distro PHP packages, not a one-off upstream build, unless your vendor says otherwise.","priority":"now","links":[{"label":"Linux distributions","href":"#downstream-linux-distro"}]},{"title":"Reset workers after each request while patching","detail":"If you cannot patch every binary immediately, set pm.max_requests = 1 so each worker exits after one request. Google / Mandiant say some attacks need a reused worker. This is a bridge, not a fix.","priority":"soon","links":[{"label":"Google Cloud / Mandiant guidance (23 Oct update)","href":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}]},{"title":"Put PHP settings in the main php.ini","detail":"Put hardening settings in the main php.ini (or static FPM pool php_admin_value / php_admin_flag), not in .htaccess or per-request config. Google / Mandiant say warnings while loading temporary per-request settings can run too early and hit vulnerable paths. display_errors=Off alone is not enough; they say modern leaks can still use oversized session cookies or error pages.","priority":"soon","links":[{"label":"Google Cloud / Mandiant guidance (23 Oct update)","href":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}]},{"title":"Tighten multipart and chunked POSTs at the edge","detail":"Where an application does not need uploads, block multipart/form-data on those routes. Reject chunked Transfer-Encoding POSTs and restrict body complexity (size, nesting, parts). Google / Mandiant list these as edge controls while patching. They do not replace a PHP upgrade.","priority":"soon","links":[{"label":"Google Cloud / Mandiant guidance (23 Oct update)","href":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}]}],"detection":[{"title":"Imperva WAF telemetry (attempts, not confirmed successes)","detail":"Imperva reported 482,342 requests, 122,311 sessions and 21,998 sites across 103 countries in the first 24h, and says these do not represent confirmed successful exploitation.","logSource":"WAF / IPS event logs","kind":"generic","group":"waf-ips"},{"title":"AWS MadPot / AWS WAF","detail":"AWS MadPot saw an attempt on 17 Oct 2026 from 103.216.220.92 (anonymization network) and further attempts 21 Oct 02:00-08:00 UTC. AWS also published WAF mitigation guidance. Unclear whether attempts would have succeeded.","logSource":"WAF / IPS event logs","kind":"generic","group":"waf-ips"},{"title":"Sophos telemetry of failed attempts","detail":"After retraction, Sophos CTU: telemetry shows scanning and a small number of failed exploitation attempts; no evidence of a successful compromise. Mirai “Potassium” payload blocked.","logSource":"WAF / IPS event logs","kind":"generic","group":"waf-ips"},{"title":"watchTowr Attacker Eye honeypots","detail":"watchTowr says its Attacker Eye honeypots observed exploitation from 21 Oct. That is watchTowr's honeypot wording; see the open note on the SecurityWeek-quoted staff email.","logSource":"WAF / IPS event logs","kind":"generic","group":"waf-ips"},{"title":"Hunt.io: Mirai-style scanner and open-directory tooling (attempts only)","detail":"Hunt.io (22 Oct 2026) reported open-directory PHP2Shell tooling and a Mirai-style scanner, with zero confirmed shells. Quoted from Hunt.io, defanged: scanner IP 45.198.224[.]169; user-agent php2shell-109618. Attempts and staging only, not confirmed compromise.","logSource":"WAF / IPS event logs; web access logs","kind":"generic","group":"waf-ips","url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","date":"2026-10-22"},{"title":"PHP frontend size / multipart limits","detail":"PHP's incomplete mitigations include low post_max_size and frontend limits on decoded size, parts, headers, and nesting. Review reverse-proxy and web-server rejects of oversized or highly nested POSTs to PHP. Not a complete detector and not an exploit recipe.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"Akamai App & API Protector: rule 3000991","detail":"Adaptive Security Engine rule 3000991 v1 'PHP RCE Attack Detected (CVE-2026-109618, CVE-2026-109619)', released 2026-10-21.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core","date":"2026-10-21"},{"title":"AWS WAF: PHP rule group PHP2Shell_BODY / PHP2Shell_BODY_Extended","detail":"AWSManagedRulesPHPRuleSet v2.3 (2026-10-21) added PHP2Shell_BODY for CVE-2026-109619. v2.4 (2026-10-22) added PHP2Shell_BODY_Extended for CVE-2026-109618, improved in v2.5 the same day.","logSource":"AWS WAF event logs","kind":"vendor-signature","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2026-10-21"},{"title":"Azure Front Door WAF: DRS rule 99006001","detail":"Front Door DRS group MS-ThreatIntel-Response-CVEs rule 99006001 for PHP2Shell, disabled by default, rollout through 2026-10-28.","logSource":"Azure Front Door WAF logs (FrontDoorWebApplicationFirewallLog)","kind":"vendor-signature","url":"https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623","date":"2026-10-22"},{"title":"NetScaler WAF signatures: 998061 / 998062 (signature update v186)","detail":"NetScaler WAF signature update version 186: rule 998061 (CVE-2026-109619, upload_progress global stale state) and 998062 (CVE-2026-109618, multipart excessive headers). Compatible with 12.1, 13.0, 13.1 and 14.1. Docs page last published 2026-10-23.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-186.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: 7 PHP RCE rules (CVE-2026-109618, CVE-2026-109619)","detail":"Seven managed rules (...c438d5dd, ...0a0c2f64, ...545d163c, ...212afcc9, ...1867b12e, ...9d9c073d, ...48143645) added 2026-10-21, renamed 2026-10-22 to 'PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)'. Also in the Free managed ruleset.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://developers.cloudflare.com/waf/change-log/changelog/","date":"2026-10-21"},{"title":"F5 WAF signatures","detail":"F5 K000163821: WAF signatures 200103697 and 200204115 for CVE-2026-109618, 200204113 for CVE-2026-109619.","logSource":"F5 BIG-IP / Advanced WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2026-10-21"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2026-109618 / CVE-2026-109619","detail":"One combined virtual patch added 2026-10-21. Opt-in: enable it in Next-Gen WAF.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/","date":"2026-10-21"},{"title":"Fortinet FortiWeb: 1090502648 / 1090502651 / 1090502654","detail":"FortiWeb signatures listed in the FortiGuard PHP2Shell outbreak alert.","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/php2shell","date":"2026-10-23","dateKind":"checked"},{"title":"Google Cloud Armor: managed rules (no rule ID published)","detail":"Google states customers with active Cloud Armor managed rules receive PHP2Shell protection automatically; otherwise enable the File Upload and RFI categories. No rule ID published.","logSource":"Cloud Armor request logs (Cloud Logging)","kind":"vendor-signature","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-21"},{"title":"Google Security Operations: Mandiant Frontline Threats (GLOBAL.26.015)","detail":"Google says Security Operations has 23 new curated detections in the Mandiant Frontline Threats rule pack. Emerging Threats Center reference GLOBAL.26.015. No individual rule IDs published beyond that reference.","logSource":"Google Security Operations curated detections","kind":"vendor-signature","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23"},{"title":"Imperva Cloud WAF / Elastic WAF / WAF Gateway: PHP2Shell virtual patch","detail":"Cloud WAF protected out of the box. Elastic WAF needs a software update. WAF Gateway needs a software update plus ADC security content. No rule IDs published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/php2shell-vulnerability-updates/","date":"2026-10-21"},{"title":"Radware WAF rule 12330, DefensePro rule 22156","detail":"Cloud Application Protection, AppWall and Alteon WAF: rule 12330 in WAF Signature Update 8.0.0.638. DefensePro: rule 22156 in signature file 0009_0851_00.","logSource":"Radware AppWall / Cloud WAF / DefensePro security events","kind":"vendor-signature","url":"https://www.radware.com/blog/php2shell-guidance-for-protecting-your-environment/","date":"2026-10-22"},{"title":"Check Point IPS: CPAI-2026-15172","detail":"Protection 'PHP Remote Code Execution' for CVE-2026-109618 and CVE-2026-109619, published 2026-10-21.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-15172.html","date":"2026-10-21"},{"title":"Cisco Talos Snort rules","detail":"Cisco advisory lists Snort rules 67359/67360. Cisco PSIRT is not aware of malicious use.","logSource":"Snort / Cisco IPS event logs","kind":"vendor-signature","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","date":"2026-10-23"},{"title":"Fortinet FortiGuard IPS: 62657 / 62658","detail":"IPS signatures PHP.longjmp.Remote.Code.Execution (62657, CVE-2026-109618) and PHP.stale.global.state.Remote.Code.Execution (62658, CVE-2026-109619), both 2026-10-21.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2026-109618&engine=1","date":"2026-10-21"},{"title":"Palo Alto Networks Threat Prevention IDs","detail":"PAN and Unit 42 cite Threat IDs 543004 (from 20 Oct 22:21 PT per Unit 42) and 97622-97625. Use as vendor signatures, not as confirmed-compromise proof.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","date":"2026-10-21"},{"title":"Sophos Firewall IPS: 67359 / 67360 / 67375 / 2313184-2313188","detail":"Sophos Firewall IPS SIDs 67359, 67360, 67375, 2313184, 2313185, 2313187, 2313188. Endpoint IPS 2313184-2313189 (selected). IPS release 18.25.75 (2026-10-22) lists 'PHP session upload progress remote code execution attempt' for CVE-2026-109619.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.25.75.html","date":"2026-10-22"},{"title":"Trend Micro Deep Security / Vision One 1012749 / 1012754, TippingPoint 48534","detail":"Deep Security / Vision One IPS rules 1012749 and 1012754. TippingPoint filter 48534 'HTTP: PHP Core Upload Progress Use-After-Free Vulnerability' (also policy filter 48514).","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0024789","date":"2026-10-23","dateKind":"checked"},{"title":"Cato IPS: CVE-2026-109618 / CVE-2026-109619 virtual patch","detail":"Cato IPS virtual patch. Opt-in protection 2026-10-21, global protection 2026-10-22. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","dateKind":"checked"}],"detectionRules":[{"id":"splunk-php-memory-exhaustion-multipart","title":"PHP Memory Exhaustion Exploitation Attempt via Multipart Request","language":"spl","query":"(\n    `apache_access_logs`\n    OR\n    `apache_error_logs`\n    OR\n    `nginx_access_logs`\n    OR\n    `nginx_error_logs`\n)\n(\n    \"multipart/form-data\"\n    OR\n    (\n        \"Allowed memory size of\"\n        AND\n        \"bytes exhausted\"\n    )\n)\n\n| rex field=_raw \"\\[pid\\s+(?<pid>\\d+)\"\n| rex field=_raw \"\\]\\s+(?<pid>\\d+)\\#\\d+\\:\"\n\n| rex field=_raw \"client\\:?\\s+(?<client>.*?)(?:,|\\]|$)\"\n| rex mode=sed field=client \"s/\\:\\d+$//g\"\n\n| rex field=_raw \"server\\:\\s+(?<server>.*?)(?:,\\s|$)\"\n\n| rex field=_raw \"request\\:\\s+\\\"(?<method>\\w+)\\s+(?<uri>.*?)\\s+HTTP\\/\\d+\\.\\d+\\\"(?:,\\s|$)\"\n\n| rex field=_raw \"(?i)PHP(?:\\s+\\w+){1,}:\\s+(?<error_message>.*?)$\"\n\n| eval pid=coalesce(worker_pid,pid)\n| eval message=coalesce(error_message,message)\n| eval src=coalesce(client,src,src_ip)\n| eval dest=coalesce(server,dest,dest_ip)\n| eval http_method=coalesce(method,http_method)\n| eval http_content_length=coalesce(content_length,http_content_length)\n| eval http_content_type=coalesce(content_type,http_content_type)\n| eval http_user_agent=coalesce(user_agent,http_user_agent)\n| eval http_referrer=coalesce(referrer,http_referrer)\n\n| stats count min(_time) as firstTime last(_time) as lastTime\n    dc(source) as dc_source\n    values(source) as source\n    values(http_method) as http_method\n    values(dest) as dest\n    values(dest_port) as dest_port\n    values(site) as site\n    values(uri) as uri\n    values(status) as status\n    values(memory_bytes) as memory_bytes\n    values(http_content_length) as http_content_length\n    values(http_content_type) as http_content_type\n    values(http_referrer) as http_referrer\n    values(http_user_agent) as http_user_agent\n    values(message) as message\n    by pid host src\n| where mvfind(source,\"access\")>=0 AND mvfind(source,\"error\")>=0\n\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `php_memory_exhaustion_exploitation_attempt_via_multipart_request_filter`","logSource":"Apache / Nginx access and error logs","author":"Onur Mustafa Erdogan, Raven Tait, Nasreddine Bencherchali, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_memory_exhaustion_exploitation_attempt_via_multipart_request.yml","sourceDate":"2026-10-22","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_memory_exhaustion_exploitation_attempt_via_multipart_request.yml"},{"id":"splunk-php-session-upload-progress-php-code","title":"PHP Session Upload Progress with PHP Code in Upload Filename","language":"spl","query":"`zeek_http`\nmethod=\"POST\"\nrequest_headers=\"*\"\n\n| eval src=coalesce(src, src_ip, 'id.orig_h'),\n       dest=coalesce(dest, dest_ip, 'id.resp_h'),\n       dest_port=coalesce(dest_port, 'id.resp_p')\n\n| eval has_phpsessid_field=if(match(request_headers, \"(?im)\\s*form-data;[^\\\\r\\\\n]*\\\\bname\\\\s*=\\\\s*\\\\\\\"?PHPSESSID\\\\\\\"?(?:;|[\\\\r\\\\n]|$)\"), 1, 0)\n\n| rex max_match=0 field=request_headers \"(?im)\\s*form-data;(?<part_disposition>[^\\\\r\\\\n]*)\"\n\n| eval php_open_tag_filenames=mvfilter(match(part_disposition, \"(?i)\\\\bfilename\\\\s*=.*(?:<\\\\?php\\\\b|<\\\\?=)\"))\n\n| where has_phpsessid_field=1 AND mvcount(php_open_tag_filenames)>0\n\n| stats count min(_time) as firstTime\n              max(_time) as lastTime\n              values(status_code) as status_code\n              values(user_agent) as user_agent\n              values(php_open_tag_filenames) as php_open_tag_filenames\n\n  by src dest dest_port uri\n\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `php_session_upload_progress_with_php_code_in_upload_filename_filter`","logSource":"Zeek HTTP logs (request headers)","author":"Raven Tait, Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_session_upload_progress_with_php_code_in_upload_filename.yml","sourceDate":"2026-10-22","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_session_upload_progress_with_php_code_in_upload_filename.yml"},{"id":"et-php2shell-multipart-header-amplification","title":"ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618)","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618)\"; flow:established,to_server; http.content_type; content:\"multipart/form-data|3b|\"; http.request_body; content:\"Content-Disposition|3a 20|form-data|3b|\"; fast_pattern; pcre:\"/^(?:(?:(?!\\x0d\\x0a\\x2d{2}).)+[\\x0d\\x0a]+[a-zA-Z0-9-]+\\x3a){100,}/R\"; http.method; content:\"POST\"; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072549; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2026-10-22","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP (TLS termination or decryption) to see request bodies.","tested":"untested"},{"id":"et-php2shell-upload-progress-code-injection","title":"ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619)","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619)\"; flow:established,to_server; http.content_type; content:\"multipart/form-data|3b|\"; http.request_body; content:\"name|3d 22|PHP_SESSION_UPLOAD_PROGRESS|22|\"; fast_pattern; content:\"filename|3d|\"; pcre:\"/^[\\x22\\x27][^\\x22\\x27\\x0d\\x0a]*?\\x3c\\x3f(?:php|\\x3b)/R\"; http.method; content:\"POST\"; reference:url,github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp; reference:cve,2026-109619; classtype:misc-attack; sid:2072554; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109619, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2026-10-22","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to see request bodies.","tested":"untested"},{"id":"v2s-sigma-php-oom-fatal-line-0","title":"PHP Out-Of-Memory Fatal Error On Line 0 In Web Server Error Logs","language":"sigma","query":"title: PHP Out-Of-Memory Fatal Error On Line 0 In Web Server Error Logs\nid: 22526123-fcec-50da-994e-8980dbd4c582\nstatus: experimental\ndescription: Hunts for PHP fatal \"Allowed memory size ... exhausted\" errors reported on \"Unknown on line 0\", the error pattern Elastic uses for possible PHP2Shell (CVE-2026-109618) attempts. Treat hits as attempts to triage, not confirmed compromise.\nreferences:\n    - https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml\n    - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\nauthor: vuln2shell\ndate: 2026-10-23\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2026-109618\nlogsource:\n    category: webserver\n    definition: 'Requirements: Apache, Nginx or PHP-FPM error logs must be collected'\ndetection:\n    keywords:\n        '|all':\n            - 'PHP Fatal error'\n            - 'Allowed memory size'\n            - 'bytes exhausted'\n            - 'Unknown on line 0'\n    condition: keywords\nfalsepositives:\n    - Legitimate requests that exceed memory_limit while PHP is still starting up the request\nlevel: medium","logSource":"Apache / Nginx / PHP-FPM error logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","sourceDate":"2026-10-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Sigma port of the message match in Elastic's PHP2Shell rule (Elastic License 2.0, kuery, listed in links). Same strings, no added indicators.","tested":"untested"},{"id":"v2s-kql-php-worker-spawns-shell","title":"Shell spawned by a PHP worker process","language":"kql","query":"// Hunt: Unix shell started by a PHP process (php-fpm, php-cgi, php) on a server\nDeviceProcessEvents\n| where Timestamp > ago(7d)\n| where InitiatingProcessFileName startswith \"php\"\n| where FileName in~ (\"sh\", \"bash\", \"dash\", \"zsh\", \"ksh\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName\n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Linux servers)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://x.com/0x534c/status/2113161833683280284","sourceDate":"2026-10-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Based on the behaviour Steven Lim describes for his php2shell detection (shell processes spawned by PHP worker processes) and on Splunk's Web or Application Server Spawning a Shell. His full query is linked in links.json. Expect noise from apps that shell out by design.","tested":"untested"},{"id":"v2s-logscale-php-worker-spawns-shell","title":"Shell spawned by a PHP worker process (Falcon)","language":"logscale","query":"#event_simpleName=ProcessRollup2 event_platform=Lin\n| ParentBaseFileName=/^php/i\n| FileName=/^(sh|bash|dash|zsh|ksh)$/i\n| groupBy([aid, ComputerName, ParentBaseFileName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/web_or_application_server_spawning_a_shell.yml","sourceDate":"2026-10-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Same parent/child logic as Splunk's Web or Application Server Spawning a Shell (which lists CVE-2026-109618/109619), written for Falcon telemetry.","tested":"untested"}],"detectionLinks":[{"title":"High-Fidelity php2shell KQL Detection","url":"https://detections.ai/share/rule/hSimK8os","author":"Steven Lim (@0x534c)","date":"2026-10-22","note":"Defender XDR query: internet-facing hosts, vulnerable PHP versions, shells under PHP workers. Query text sits behind the detections.ai viewer and is only an image on X, so linked, not copied."},{"title":"X post: High-Fidelity php2shell KQL Detection","url":"https://x.com/0x534c/status/2113161833683280284","author":"Steven Lim (@0x534c)","date":"2026-10-22"},{"title":"PHP2Shell ThreatLock (GreyNoise attacker IPs plus vulnerable PHP)","url":"https://detections.ai/share/rule/I4Gtmvm1","author":"Steven Lim (@0x534c)","date":"2026-10-23","note":"Correlates DeviceNetworkEvents with DeviceTvmSoftwareVulnerabilities. Linked only."},{"title":"X post: PHP2Shell ThreatLock","url":"https://x.com/0x534c/status/2113547744023339409","author":"Steven Lim (@0x534c)","date":"2026-10-23"},{"title":"GreyNoise php2shell attacker IP list (CSV)","url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/IOC/greynoise_php2shell_attacker_ips.csv","author":"Steven Lim (@0x534c)","date":"2026-10-23","note":"IOC list used by the ThreatLock query."},{"title":"Elastic: Potential PHP2Shell Exploitation Attempt","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","author":"Elastic","date":"2026-10-22","note":"Kibana query language (kuery) rule, Elastic License 2.0. Not in the rule list because kuery is not one of the site's languages; the Sigma port carries the same logic."},{"title":"Splunk analytic story: PHP2Shell","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/stories/php2shell.yml","author":"Splunk Threat Research Team","date":"2026-10-22","note":"Groups all Splunk PHP2Shell detections."},{"title":"Splunk: PHP Session Upload Progress Serialized Payload in Upload Filename","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_session_upload_progress_serialized_payload_in_upload_filename.yml","author":"Splunk Threat Research Team","date":"2026-10-22"},{"title":"ET Open emerging-exploit.rules (all php2shell sids 2072548 to 2072557)","url":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","author":"Emerging Threats","date":"2026-10-22"},{"title":"Assetnote php2shell-scanner (defender scanner)","url":"https://github.com/assetnote/php2shell-scanner","author":"Assetnote","date":"2026-10-22","note":"Open-source scanner for CVE-2026-109618 and CVE-2026-109619. Repository created 22 Oct 2026. Defender scanner only, not an exploit."}],"retrohunt":{"summary":"Search web and PHP error logs back to 17 Oct 2026 for multipart POSTs that coincide with Allowed memory size exhausted on line 0, then hunt for php-fpm / php-cgi spawning shells. Treat scanning as attempts unless a shell or persistence follows.","lookback":{"from":"2026-10-17","basis":"first-attempt","rationale":"Amazon's MadPot honeypots logged an exploitation attempt on 17 Oct 2026 from 103.216.220.92 while the bugs were still under embargo. Public PoCs and mass scanning followed on 21 Oct. Google Threat Intelligence (23 Oct) has not validated successful wide-scale exploitation.","sources":[{"url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","date":"2026-10-21","publisher":"AWS"},{"url":"https://x.com/JohnHultquist/status/2113686799708991522","date":"2026-10-23","publisher":"Google Threat Intelligence (John Hultquist)"}]},"logSources":[{"name":"Apache / nginx access and error logs","why":"Show multipart POSTs and PHP fatal memory errors.","required":true},{"name":"PHP-FPM / php-cgi error logs","why":"Allowed memory size ... exhausted on Unknown on line 0 is the Elastic/PHP2Shell error pattern.","required":true},{"name":"EDR process telemetry for php-fpm / php","why":"A successful exploit would show the PHP worker spawning a shell.","required":true},{"name":"WAF / IDS alerts for vendor PHP2Shell signatures","why":"Show attempt volume; do not treat them as confirmed shells.","required":false}],"steps":[{"title":"Search for the OOM-on-line-0 pattern","detail":"Elastic's rule hunts for PHP fatal Allowed memory size ... exhausted reported on Unknown on line 0. Treat hits as attempts to triage.","sources":[{"url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","date":"2026-10-22","publisher":"Elastic"}]},{"title":"Correlate with multipart POSTs","detail":"Splunk's analytic story ties memory exhaustion to multipart requests. Look for the same client and host.","sources":[{"url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/stories/php2shell.yml","date":"2026-10-22","publisher":"Splunk"}]},{"title":"Hunt PHP workers spawning shells","detail":"Look for php-fpm, php-cgi or php starting sh, bash, dash, zsh or ksh.","sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}]},{"title":"Check known scanner and staging IOCs","detail":"AWS logged 103.216.220.92 on 17 Oct. Hunt.io reported scanner IP 45.198.224.169 and user-agent php2shell-109618 with zero confirmed shells.","sources":[{"url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","date":"2026-10-21","publisher":"AWS"},{"url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","date":"2026-10-22","publisher":"Hunt.io"}]}],"queries":[{"id":"v2s-rh-spl-php2shell-oom","title":"PHP OOM on line 0 with multipart since 17 Oct 2026","language":"spl","query":"(sourcetype=access_combined OR sourcetype=nginx* OR sourcetype=apache* OR sourcetype=*php*) earliest=\"10/17/2026:00:00:00\"\n((\"Allowed memory size of\" AND \"bytes exhausted\") OR (\"Unknown on line 0\") OR \"multipart/form-data\")\n| rex field=_raw \"client\\:?\\s+(?<client>.*?)(?:,|\\]|$)\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(source) as sources by host, client\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Apache / Nginx / PHP error logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","sourceDate":"2026-10-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Adapted from Splunk and Elastic patterns. Multipart alone is not enough; keep the OOM line.","tested":"untested","timeRange":"From 2026-10-17"},{"id":"v2s-rh-kql-php2shell-shell","title":"PHP worker spawning a shell since 17 Oct 2026","language":"kql","query":"DeviceProcessEvents\n| where Timestamp >= datetime(2026-10-17)\n| where InitiatingProcessFileName startswith \"php\"\n| where FileName in~ (\"sh\", \"bash\", \"dash\", \"zsh\", \"ksh\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName\n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","sourceDate":"2026-10-23","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2026-10-17, limited by retention"},{"id":"v2s-rh-logscale-php2shell-shell","title":"PHP worker spawning a shell","language":"logscale","query":"// Set the time picker to start 2026-10-17\n#event_simpleName=ProcessRollup2 event_platform=Lin\n| ParentBaseFileName=/^php/i\n| FileName=/^(sh|bash|dash|zsh|ksh)$/i\n| groupBy([aid, ComputerName, ParentBaseFileName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","sourceDate":"2026-10-23","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2026-10-17"},{"id":"v2s-rh-spl-php2shell-scanner-ua","title":"php2shell-109618 user-agent since 17 Oct 2026","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx* OR sourcetype=apache*) earliest=\"10/17/2026:00:00:00\" \"php2shell-109618\"\n| stats count min(_time) as firstTime max(_time) as lastTime by clientip, host, uri\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web access logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","sourceDate":"2026-10-22","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunt.io reported this user-agent with a Mirai-style scanner; attempts only.","tested":"untested","timeRange":"From 2026-10-17"}],"thirdPartyQueries":[{"title":"Elastic: Potential PHP2Shell Exploitation Attempt","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","author":"Elastic","date":"2026-10-22","language":"eql","license":"Elastic License 2.0","origin":"vendor","note":"Already linked from Detection."},{"title":"Splunk analytic story: PHP2Shell","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/stories/php2shell.yml","author":"Splunk Threat Research","date":"2026-10-22","language":"spl","license":"Apache-2.0","origin":"vendor","note":"Already linked from Detection."},{"title":"Google SecOps Mandiant Frontline Threats GLOBAL.26.015","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","author":"Google Cloud / Mandiant","date":"2026-10-23","language":"secops","license":"product","origin":"vendor","note":"23 curated detections; product-only."},{"title":"GreyNoise php2shell attacker IP list","url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/IOC/greynoise_php2shell_attacker_ips.csv","author":"SlimKQL / GreyNoise","date":"2026-10-23","language":"csv","license":"see source","origin":"vendor","note":"Already linked from Detection."}],"artefacts":[{"kind":"device-log","value":"Allowed memory size of ... bytes exhausted ... Unknown on line 0","detail":"Error pattern Elastic uses for possible CVE-2026-109618 attempts.","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","sourceDate":"2026-10-22"},{"kind":"web-log","value":"multipart/form-data POSTs correlated with that error","detail":"Request shape from Splunk's analytic story.","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/php_memory_exhaustion_exploitation_attempt_via_multipart_request.yml","sourceDate":"2026-10-22"},{"kind":"process","value":"php-fpm / php-cgi / php spawning a Unix shell","detail":"Possible successful code execution.","sourceUrl":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","sourceDate":"2026-10-23"}],"iocs":[{"type":"ip","value":"103.216.220[.]92","context":"MadPot attempt on 17 Oct 2026 from anonymising infrastructure.","sourceUrl":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","sourceDate":"2026-10-21"},{"type":"ip","value":"45.198.224[.]169","context":"Hunt.io Mirai-style scanner (attempts only, zero confirmed shells).","sourceUrl":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","sourceDate":"2026-10-22"},{"type":"user-agent","value":"php2shell-109618","context":"Hunt.io scanner user-agent.","sourceUrl":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","sourceDate":"2026-10-22"}],"iocNote":"GreyNoise publishes a changing attacker IP list. Prefer the live GreyNoise tags and the SlimKQL CSV over a frozen copy.","hitMeaning":[{"level":"attempt","detail":"OOM-on-line-0, multipart scanning, WAF hits or Hunt.io-style scanner traffic. Google Threat Intelligence has not validated successful wide-scale exploitation as of 23 Oct 2026."},{"level":"likely-compromise","detail":"A PHP worker spawning a shell after such a request."},{"level":"confirmed-compromise","detail":"Interactive access, webshell or persistence on the host. Sophos retracted its 22 Oct customer-compromise claim the same day."}],"nextSteps":[{"title":"Patch PHP and reset workers","detail":"Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Google / Mandiant recommend pm.max_requests=1 as a bridge.","links":[{"label":"PHP news","href":"https://www.php.net/archive/2026.php#2026-10-21-5"},{"label":"Google Cloud guidance","href":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}]},{"title":"Do not treat scanners as shells","detail":"Imperva, Hunt.io and Google Threat Intelligence all describe heavy attempts without validated mass success."}],"limits":["Most public activity so far is scanning and failed PoCs.","OOM on line 0 can have other causes; always pivot to process telemetry."],"sources":[{"url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","date":"2026-10-21","publisher":"AWS"},{"url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","date":"2026-10-22","publisher":"Hunt.io"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"},{"url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","date":"2026-10-22","publisher":"Elastic"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"CVE-2026-109618 and CVE-2026-109619 are PHP core RCEs. PHP says all installations serving web requests are in scope, including PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, and LiteSpeed. Fixed upstream builds announced 21 Oct 2026: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older no longer get binaries from the PHP project.","checks":[{"id":"v2s-aia-php2shell-version-1","kind":"version","title":"Read the PHP runtime version","detail":"Compare to the PHP 21 Oct 2026 advisory table.","command":"php -v","affectedMeans":"8.5.x below 8.5.12; 8.4.x below 8.4.27; 8.3.x below 8.3.36; 8.2.x below 8.2.35; or any 8.1 / 8.0 / 7.x / 5.x build that has not received a vendor backport. Google Cloud restates vulnerable versions as PHP 5.4 through 8.5.11.","fixedMeans":"php -v shows 8.5.12 or later on 8.5, 8.4.27 or later on 8.4, 8.3.36 or later on 8.3, or 8.2.35 or later on 8.2, or a distro/LTS package that the vendor states includes these fixes. Restart the SAPI after upgrade; a new php -v on disk can still leave old workers loaded.","notes":"Check every SAPI (cli, fpm, apache2handler). Multiple PHP stacks on one host are common.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-21","publisher":"Google Cloud / Mandiant"}]},{"id":"v2s-aia-php2shell-package-2","kind":"package","title":"Query distro PHP packages","detail":"Linux distributions received patches in advance. Use the vendor package, not a one-off upstream binary, unless the vendor says otherwise.","command":"dpkg -l 'php*' 2>/dev/null; rpm -q php php-fpm 2>/dev/null; apk info -v php* 2>/dev/null","affectedMeans":"Installed php / php-fpm / libapache2-mod-php is below the fixed package for that release (examples from the catalog: Debian trixie php8.4 8.4.27-1~deb13u1; bookworm php8.2 8.2.35-1~deb12u1; RHEL 10 php 8.3.36-1.el10_2).","fixedMeans":"Package version matches or exceeds the distro security package that names CVE-2026-109618 / CVE-2026-109619. Verify with apt-get changelog php-fpm or rpm -q --changelog php-fpm | grep -E 'CVE-2026-109618|CVE-2026-109619' as Mandiant suggests.","notes":"Third-party RPM mirrors may lag. Confirm the changelog names these CVEs.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}]},{"id":"v2s-aia-php2shell-config-3","kind":"config","title":"Read session.upload_progress and related INI (precondition / bridge settings)","detail":"session.upload_progress.enabled is a documented path for CVE-2026-109619 and for reserved CVE-2026-115560. Also inventory memory_limit, post_max_size, and (on 8.5) fatal_error_backtraces if you applied PHP's incomplete bridges.","command":"php -i | grep -E 'session.upload_progress|memory_limit|post_max_size|fatal_error_backtraces|file_uploads'","affectedMeans":"session.upload_progress.enabled = On means the confirmed session path for CVE-2026-109619 (and the informational CVE-2026-115560 case) is still available on an unpatched build. A finite memory_limit remains a CVE-2026-109618 OOM path per PHP.","fixedMeans":"On a patched build, these INI values are not required for the two CVEs. If still unpatched: session.upload_progress.enabled=0 (and workers restarted) blocks the confirmed session path only. PHP 23 Oct informational advisory: keep that setting until the next regular bugfix for CVE-2026-115560.","notes":"Do not use ini_set() or .user.ini for this; PHP says apply in php.ini / FPM pool / server config before request parsing.","sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://www.php.net/archive/2026.php#2026-10-23-1","date":"2026-10-23","publisher":"PHP.net"}]},{"id":"v2s-aia-php2shell-exposure-4","kind":"exposure","title":"Find your own internet-facing PHP banners","detail":"Product-level only. Version is often missing or spoofable. Scope to your ranges.","command":"shodan search 'http.component:\"PHP\" net:<your-range>'","affectedMeans":"A host in your range advertises PHP. Confirm php -v on that asset before calling it vulnerable.","fixedMeans":"No PHP banners in your ranges, or each matching host runs a listed fixed build (or a vendor-stated backport) and the SAPI was restarted.","notes":"Censys 22 Oct 2026 counted hosts running PHP including non-affected versions. Catalog Shodan count on 2026-10-23 is global.","sources":[{"url":"https://www.shodan.io/search?query=http.component%3A%22PHP%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"},{"url":"https://censys.com/advisory/cve-2026-109618-cve-2026-109619/","date":"2026-10-22","publisher":"Censys"}]}],"limits":["php -v from CLI can differ from the Apache/FPM SAPI. Check the SAPI that serves HTTP.","Embedded PHP in appliances and hosting panels may not show up in dpkg/rpm on a management host.","Do not send multipart or upload-progress requests to test these bugs."],"sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-21","publisher":"Google Cloud / Mandiant"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"},{"url":"https://www.php.net/archive/2026.php#2026-10-23-1","date":"2026-10-23","publisher":"PHP.net"},{"url":"https://www.shodan.io/search?query=http.component%3A%22PHP%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"},{"url":"https://censys.com/advisory/cve-2026-109618-cve-2026-109619/","date":"2026-10-22","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"PHP documents incomplete bridges only and states that updating is the only complete fix. CISA tells organisations that cannot patch, or that run PHP 8.1 or earlier, to take PHP systems offline.","items":[{"title":"Set memory_limit=-1 administratively (CVE-2026-109618 bridge)","detail":"PHP: set memory_limit=-1 in a way applications cannot override (php_admin_value in the FPM pool or Apache configuration) and confirm no pool, directory, or application setting restores a finite limit.","limits":"Incomplete. Removes the controllable PHP memory-limit failure only. An underlying allocation failure can still reach the vulnerable path. Pair with a cgroup/container memory limit. Do not use RLIMIT_AS or RLIMIT_DATA. Mandiant: revert to a finite memory_limit after the patched build is installed.","verify":"php -i | grep memory_limit (must show -1 from the serving SAPI). Confirm the value is set via php_admin_value / main php.ini, not .htaccess.","source":{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"}},{"title":"Lower post_max_size and frontend body limits (CVE-2026-109618 bridge)","detail":"PHP: for apps that do not need uploads, post_max_size=8M; if uploads are required, post_max_size=32M; keep upload_max_filesize below post_max_size. Also consider web-server or proxy limits on decoded size, field count, multipart parts, headers, and nesting, including requests without Content-Length.","limits":"Incomplete. Does not make an installation safe. Mandiant adds tighter suggested values (upload_max_filesize=4M, max_input_nesting_level=16, max_input_vars=250, max_file_uploads=10, max_multipart_body_parts=100) as a pre-patch stopgap.","verify":"php -i | grep -E 'post_max_size|upload_max_filesize|max_input_nesting_level|max_file_uploads|max_multipart_body_parts'","source":{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"}},{"title":"Disable session.upload_progress and restart workers (CVE-2026-109619 session path)","detail":"PHP: session.upload_progress.enabled=0 in php.ini, FPM pool, or server config that applies before request parsing, then restart every worker. Keep this through the next regular bugfix for informational CVE-2026-115560 (23 Oct 2026).","limits":"Blocks the confirmed session paths only, not other CVE-2026-109619 variants. Do not rely on ini_set() or FPM .user.ini.","verify":"php -i | grep session.upload_progress.enabled  (expect Off). Confirm php-fpm / apache2 / httpd / frankenphp / lsws were restarted after the change.","source":{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"}},{"title":"On PHP 8.5, set fatal_error_backtraces=0 (CVE-2026-109619 backtrace path)","detail":"PHP: on PHP 8.5 set fatal_error_backtraces=0 and restart every worker.","limits":"Blocks the confirmed fatal backtrace path only.","verify":"php -i | grep fatal_error_backtraces  (expect Off on 8.5). Restart workers after the change.","source":{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"}},{"title":"Reset PHP-FPM workers after each request while patching","detail":"Mandiant: set pm.max_requests=1 so each worker exits after one request. Some attacks need a reused worker.","limits":"Bridge only. Higher process churn. Does not replace a PHP upgrade.","verify":"grep pm.max_requests /etc/php/*/fpm/pool.d/*.conf  (expect 1). Confirm php-fpm was reloaded.","source":{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}},{"title":"Take unpatchable or EOL PHP off the network","detail":"CISA (updated 23 Oct 2026): organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. A WAF may provide some protection until then.","limits":"Operational outage. WAF is not a complete fix. PHP provided only minimal source backports for 7.4 / 8.0 / 8.1 (no binaries).","verify":"Confirm the host no longer accepts public HTTP, or php -v shows a supported fixed line.","source":{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-21","publisher":"CISA"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Restart the serving SAPI after you patch so old workers unload. Google Threat Intelligence had not validated in-the-wild exploitation as of 23 Oct 2026. No public report of attacker persistence is indexed here.","containment":[{"title":"Patch or take the SAPI offline, then restart the running workers","detail":"Mandiant: upgrading packages on disk leaves vulnerable libphp.so or php-fpm binaries resident. Explicitly restart php8.x-fpm, apache2/httpd, frankenphp, or lsws. CISA: take PHP systems offline if you cannot patch, especially 8.1 or earlier.","sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-21","publisher":"CISA"}]},{"title":"If a host shows probing, capture worker memory before restart","detail":"Mandiant: if a server shows active probing or anomalous PHPSESSID cookies, capture worker memory before patching or rebooting. Restarting workers destroys volatile heap evidence.","sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}]},{"title":"Restrict egress and shelling from PHP workers if compromise is suspected","detail":"Mandiant lists blocking outbound internet from PHP servers and preventing php-fpm/httpd from spawning sh, curl, or wget as containment hygiene. CISA: watch for PHP workers launching shells or downloading tools.","sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-23","publisher":"CISA"}]}],"rotate":[{"item":"Application secrets and session material on any host with a PHP worker that spawned a shell","reason":"These bugs are unauthenticated RCE in the PHP process, so anything readable by that process is in scope after confirmed code execution. Google TI has not validated successful wide-scale ITW as of 23 Oct 2026, so rotate when host evidence shows a shell, not merely a WAF hit.","generic":true,"sources":[{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://x.com/JohnHultquist/status/2113686799708991522","date":"2026-10-23","publisher":"Google Threat Intelligence"}]}],"evidence":[{"title":"PHP / Apache / nginx error logs with OOM on line 0","detail":"Catalog and Elastic: Allowed memory size ... exhausted on Unknown on line 0, correlated with multipart POSTs. Treat as attempts until a shell follows.","sources":[{"url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","date":"2026-10-22","publisher":"Elastic"}]},{"title":"Process telemetry for php-fpm / php-cgi / httpd spawning shells","detail":"CISA and Mandiant: PHP workers launching sh, bash, curl, wget, nc, python. Preserve EDR/auditd before rebuild.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-23","publisher":"CISA"},{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}]},{"title":"Worker memory and oversized PHPSESSID cookies","detail":"Mandiant: PHPSESSID headers over 256 bytes as a possible heap-leak signal; capture memory before restart if present.","sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"}]}],"sources":[{"url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","publisher":"Google Cloud / Mandiant"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-21","publisher":"CISA"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-23","publisher":"CISA"},{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","date":"2026-10-21","publisher":"PHP.net"},{"url":"https://x.com/JohnHultquist/status/2113686799708991522","date":"2026-10-23","publisher":"Google Threat Intelligence"},{"url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/initial_access_potential_php2shell_exploitation_attempt.toml","date":"2026-10-22","publisher":"Elastic"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"Critical remote code execution vulnerabilities in PHP core","url":"https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"AWS","title":"AWS Managed Rules changelog: PHP application rule group","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Azure","title":"Addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619): upgrade guidance and Azure WAF","url":"https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Barracuda","title":"PHP vulnerabilities: Barracuda product impact advisory","url":"https://trust.barracuda.com/security/php-vulnerabilities","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2026-15172 PHP Remote Code Execution","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-15172.html","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Check Point","title":"PHP2Shell: what we know about the leaked critical PHP vulnerabilities","url":"https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Cisco Talos","title":"Cisco advisory: PHP vulnerabilities October 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Citrix","title":"Protecting NetScaler management access from PHP CVE-2026-109618 / CVE-2026-109619","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Citrix","title":"CTX697263 Citrix security advisory","url":"https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.html","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Citrix","title":"NetScaler signature update version 186","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-186.html","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619","dateKind":"checked"},{"vendor":"Cloudflare","title":"Cloudflare WAF changelog","url":"https://developers.cloudflare.com/waf/change-log/changelog/","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"F5","title":"F5 attack signatures reference (200103697, 200204113, 200204115)","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Fastly","title":"Added virtual patch for CVE-2026-109618 and CVE-2026-109619","url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2026-109618","url":"https://www.fortiguard.com/search?q=CVE-2026-109618&engine=1","date":"2026-10-21","cve":"CVE-2026-109618"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2026-109619","url":"https://www.fortiguard.com/search?q=CVE-2026-109619&engine=1","date":"2026-10-21","cve":"CVE-2026-109619"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: PHP2Shell","url":"https://www.fortiguard.com/outbreak-alert/php2shell","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619","dateKind":"checked"},{"vendor":"Google Cloud","title":"Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Imperva","title":"PHP2Shell: When PHP runs out of memory at the wrong moment","url":"https://www.imperva.com/blog/php2shell-vulnerability-updates/","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Imperva","title":"PHP2Shell: Early attack activity through Imperva's lens","url":"https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens/","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Palo Alto Networks","title":"PAN advisory CVE-2026-109618","url":"https://security.paloaltonetworks.com/CVE-2026-109618","date":"2026-10-21","cve":"CVE-2026-109618"},{"vendor":"Palo Alto Networks","title":"Threat Brief: critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Radware","title":"PHP2Shell: Guidance for protecting your environment","url":"https://www.radware.com/blog/php2shell-guidance-for-protecting-your-environment/","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Sophos","title":"Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Sophos","title":"Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.25.75","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.25.75.html","date":"2026-10-22","cve":"CVE-2026-109619"},{"vendor":"Trend Micro","title":"Critical PHP vulnerabilities: analysis and guidance","url":"https://www.trendaisecurity.com/en-us/php2shell-critical-php-vulnerabilities","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Trend Micro","title":"SECURITY ALERT: PHP Critical RCE Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)","url":"https://success.trendmicro.com/en-US/solution/KA-0024789","date":"2026-10-23","cve":"CVE-2026-109618, CVE-2026-109619","dateKind":"checked"},{"vendor":"Zscaler","title":"CVE-2026-109618 and CVE-2026-109619: PHP2Shell (ThreatLabz, no signature names published)","url":"https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce","date":"2026-10-21","cve":"CVE-2026-109618, CVE-2026-109619"},{"vendor":"Zscaler","title":"Zscaler Trust advisory: PHP2Shell (no impact to Zscaler)","url":"https://trust.zscaler.com/zscaler.net/posts/32396","date":"2026-10-22","cve":"CVE-2026-109618, CVE-2026-109619"}],"coverage":[{"title":"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet","publisher":"Wiz Research","url":"https://www.wiz.io/blog/php2shell-php-rce","date":"2026-10-21","type":"research"},{"title":"php2shell by Calif Research","publisher":"Calif","url":"https://calif.io/php2shell/","date":"2026-10-21","type":"research"},{"title":"PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619","publisher":"watchTowr","url":"https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","date":"2026-10-21","type":"research"},{"title":"Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot","publisher":"AWS Security Blog","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","date":"2026-10-21","type":"research"},{"title":"Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)","publisher":"Sophos Counter Threat Unit","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","date":"2026-10-21","type":"research"},{"title":"Cloudflare deploys protections against php2shell vulnerability","publisher":"Cloudflare Blog","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","date":"2026-10-21","type":"vendor"},{"title":"PHP2Shell: Early Attack Activity Through Imperva's Lens","publisher":"Imperva","url":"https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens/","date":"2026-10-22","type":"research"},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619","publisher":"Palo Alto Networks Unit 42","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","date":"2026-10-21","type":"research"},{"title":"Critical Vulnerabilities in PHP Require Immediate Patching","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","date":"2026-10-21","type":"government"},{"title":"Critical security issue affecting PHP","publisher":"NCSC (UK)","url":"https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php","date":"2026-10-21","type":"government"},{"title":"PHP ships emergency patches for critical PHP2Shell flaws","publisher":"BleepingComputer (Sergiu Gatlan)","url":"https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/","date":"2026-10-21","type":"news"},{"title":"PHP2Shell: Critical PHP vulnerabilities patched, update now!","publisher":"Help Net Security (Mirko Zorz)","url":"https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/","date":"2026-10-21","type":"news"},{"title":"PHP2Shell Exploitation Started Days Before Patches","publisher":"SecurityWeek (Ionut Arghire)","url":"https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/","date":"2026-10-22","type":"news"},{"title":"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","publisher":"The Hacker News (Ravie Lakshmanan)","url":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","date":"2026-10-22","type":"news"},{"title":"PHP2Shell exploit bypasses protections designed to stop remote code execution","publisher":"The Register (Jessica Lyons)","url":"https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883","date":"2026-10-22","type":"news"},{"title":"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)","publisher":"Hunt.io","url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","date":"2026-10-22","type":"research","addedDate":"2026-10-22"},{"title":"PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution","publisher":"Arctic Wolf Labs","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","date":"2026-10-23","type":"research","addedDate":"2026-10-23"},{"title":"Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","publisher":"SecurityWeek (Eduard Kovacs)","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/","date":"2026-10-23","type":"news","addedDate":"2026-10-23"},{"title":"PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","publisher":"The Hacker News (Ravie Lakshmanan)","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html","date":"2026-10-23","type":"news","addedDate":"2026-10-23"},{"title":"PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches","publisher":"The Hacker News (Swati Khandelwal)","url":"https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html","date":"2026-10-23","type":"news","addedDate":"2026-10-23"},{"title":"Informational advisory: Session upload progress (CVE-2026-115560)","publisher":"PHP Group (php.net)","url":"https://www.php.net/archive/2026.php#2026-10-23-1","date":"2026-10-23","type":"vendor","addedDate":"2026-10-23"},{"title":"Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (Mandiant update)","publisher":"Google Cloud","url":"https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619","date":"2026-10-23","type":"vendor","addedDate":"2026-10-24"},{"title":"Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal","publisher":"VirusTotal (Joseliyo Sanchez)","url":"https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html","date":"2026-10-21","type":"news","addedDate":"2026-10-24"}],"posts":[{"author_name":"watchTowr","handle":"watchtowrcyber","url":"https://x.com/watchtowrcyber/status/2112611507749982605","date":"2026-10-20T18:26:48Z","text":"We were all supposed to wait until Thursday at 11am ET. \n\nInformation has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619\n\nWe cannot share further information right now. Take this seriously and apply patches when available. https://t.co/kguM8fpq13"},{"author_name":"NCSC UK","handle":"NCSC","url":"https://x.com/NCSC/status/2112848265074847828","date":"2026-10-21T10:07:35Z","text":"The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.\n\nFor more⬇️ \nhttps://t.co/l6TDtVurJN"},{"author_name":"Cloudflare","handle":"Cloudflare","url":"https://x.com/Cloudflare/status/2112911026437935381","date":"2026-10-21T14:16:59Z","text":"Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://t.co/OQG4x6x858"},{"author_name":"Calif","handle":"calif_io","url":"https://x.com/calif_io/status/2112914613297668583","date":"2026-10-21T14:31:14Z","text":"Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/I88EQFrUHa\n\nHis work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches."},{"author_name":"CISA Cyber","handle":"CISACyber","url":"https://x.com/CISACyber/status/2112947079458717969","date":"2026-10-21T16:40:15Z","text":"🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 https://t.co/8vu6SvNzfB https://t.co/LUWik7aQcG"},{"author_name":"Andrew Thompson","handle":"ImposeCost","url":"https://x.com/ImposeCost/status/2113432090591072743","date":"2026-10-23T00:47:30Z","text":"\"The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities.\" https://t.co/BC5caSSSiR"},{"author_name":"John Hultquist","handle":"JohnHultquist","url":"https://x.com/JohnHultquist/status/2113686799708991522","date":"2026-10-23T17:39:38Z","text":"We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be \"vibe-coded\" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM. Nonetheless, exploitation may have already begun in a limited fashion."}],"research":[{"title":"PHP Group: 21 Oct 2026 releases / advisory","url":"https://www.php.net/archive/2026.php#2026-10-21-5","authors":"PHP Group (php.net)","date":"21 Oct 2026"},{"title":"PHP Group: 23 Oct 2026 informational advisory (CVE-2026-115560)","url":"https://www.php.net/archive/2026.php#2026-10-23-1","authors":"PHP Group (php.net)","date":"23 Oct 2026"},{"title":"PHP Group: 20 Oct 2026 pre-announcement","url":"https://www.php.net/archive/2026.php#2026-10-20-1","authors":"PHP Group (php.net)","date":"20 Oct 2026"},{"title":"GHSA-w8hw-w9fx-j79w: CVE-2026-109618 RCE via OOM corruption","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","authors":"PHP (php-src GitHub, published by bukka)","date":"Oct 21, 2026"},{"title":"GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 RCE via stale global state","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","authors":"PHP (php-src GitHub, published by bukka)","date":"Oct 21, 2026"},{"title":"PHP ChangeLog 8.x (lists the four releases as 22 Oct 2026)","url":"https://www.php.net/ChangeLog-8.php","authors":"PHP Group","date":"Version 8.x.y 22 Oct 2026"},{"title":"CVE-2026-109618 CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-109618","authors":"CVE (CNA: php)","date":"2026-10-21T13:48:34Z"},{"title":"CVE-2026-109619 CNA record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-109619","authors":"CVE (CNA: php)","date":"2026-10-21T13:54:43Z"},{"title":"CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching","url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","authors":"CISA","date":"Release Date October 21, 2026"},{"title":"CISA KEV catalog JSON (neither CVE listed; catalog 2026.10.23)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.23, last verified 24 Oct 2026"},{"title":"NVD: CVE-2026-109618 (CVSS 3.1 9.8, Analyzed)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109618","authors":"NVD","date":"Analyzed / 2026-10-22T23:18:22Z"},{"title":"NVD: CVE-2026-109619 (CVSS 3.1 8.1, Modified)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619","authors":"NVD","date":"Modified / 2026-10-22T23:18:22Z"},{"title":"Palo Alto Networks PSIRT: impact on PAN products","url":"https://security.paloaltonetworks.com/CVE-2026-109618","authors":"Palo Alto Networks PSIRT","date":"Published 2026-10-21, Updated 2026-10-23"},{"title":"Citrix TechZone: protecting NetScaler management access","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","authors":"NetScaler Product Security (Citrix TechZone)","date":"Last updated on: October 22, 2026 (PDT); first posted 21 Oct 2026 per page relative date"},{"title":"Citrix CTX697263: other on-prem products (date not shown on source)","url":"https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.html","authors":"Cloud Software Group / Citrix","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"F5 K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619","url":"https://my.f5.com/manage/s/article/K000163821","authors":"F5","date":"Published Oct 21, 2026, Updated Oct 23, 2026"},{"title":"HPE HPESBNW05171: ClearPass Policy Manager","url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05171.txt","authors":"HPE Networking PSIRT","date":"Publication 2026-Oct-22, Last Updated 2026-Oct-22"},{"title":"Splunk SVD-2026-1013","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","authors":"Splunk","date":"Published 2026-10-22, Last Updated 2026-10-22"},{"title":"Cisco cisco-sa-php-october26-Jj384Daq","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","authors":"Cisco PSIRT","date":"First Published 2026 October 21 19:12 GMT; rev 1.4 2026-OCT-22"},{"title":"Sophos advisory sophos-sa-20261021-php2shell","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","authors":"Sophos","date":"First Published 2026 Oct 21, Updated 2026 Oct 22"},{"title":"Sophos CTU blog (includes 22 Oct 21:21 UTC correction)","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","authors":"Sophos Counter Threat Unit","date":"updates 21 Oct 14:28 UTC ... 22 Oct 21:21 UTC (correction)"},{"title":"Wiz Research: PHP2Shell","url":"https://www.wiz.io/blog/php2shell-php-rce","authors":"Wiz Research","date":"October 21, 2026"},{"title":"Imperva: PHP2Shell vulnerability updates (21 Oct)","url":"https://www.imperva.com/blog/php2shell-vulnerability-updates/","authors":"Imperva (Nadav Avital, Bar Menachem)","date":"Oct 21, 2026"},{"title":"Imperva: early attack activity (22 Oct telemetry)","url":"https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens/","authors":"Imperva","date":"Oct 22, 2026"},{"title":"Unit 42 Threat Brief: CVE-2026-109618 / CVE-2026-109619","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","authors":"Palo Alto Networks Unit 42","date":"Published October 21, 2026; updated Oct 22, 2026 4:30 p.m. PT"},{"title":"watchTowr: PHP remote code execution (PHP2Shell)","url":"https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/","authors":"watchTowr","date":"Published Oct 21, 2026 14:19 UTC; Last updated October 22, 2026"},{"title":"watchTowr: CVE-2026-109618 FAQ","url":"https://watchtowr.com/intelligence/php-cve-2026-109618-faq/","authors":"watchTowr","date":"Published Oct 20, 2026 19:35 UTC; Updated Oct 22, 2026"},{"title":"watchTowr on X: reproduced, will not publish details","url":"https://x.com/watchtowrcyber/status/2112611507749982605","authors":"watchTowr (X)","date":"2026-10-20T18:26:48Z"},{"title":"SecurityWeek quoting Jake Knott (watchTowr) on sprayed PoCs","url":"https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/","authors":"SecurityWeek (Ionut Arghire), quoting watchTowr","date":"October 22, 2026 (5:48 AM ET)"},{"title":"AWS: MadPot exploitation attempts prior to public disclosure","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","authors":"AWS Security Blog (CJ Moses)","date":"21 OCT 2026"},{"title":"AWS bulletin 2026-143-AWS","url":"https://aws.amazon.com/security/security-bulletins/2026-143-AWS/","authors":"AWS","date":"Published 10/21/2026 14:30 PDT; Last Updated 10/22/2026 14:00 PDT"},{"title":"AWS: using AWS WAF for PHP2Shell mitigations","url":"https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/","authors":"AWS","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"Calif (lcfr_hax): discovery-priority claim","url":"https://x.com/calif_io/status/2112914613297668583","authors":"Calif (X)","date":"2026-10-21T14:31:14Z"},{"title":"NCSC: critical security issue affecting PHP","url":"https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php","authors":"NCSC","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"Ubuntu: PHP2Shell vulnerability fixes available","url":"https://ubuntu.com/blog/php2shell-vulnerability-fixes-available","authors":"Ubuntu","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"Datadog Security Labs: PHP2Shell","url":"https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/","authors":"Datadog Security Labs","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"oss-security list: PHP2Shell","url":"http://www.openwall.com/lists/oss-security/2026/10/21/6","authors":"oss-security","date":"not shown in fetched text (fetched 2026-10-23)"},{"title":"VulnCheck: PHP2Shell vulnerabilities (public PoC ASLR-bypass limitation)","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","authors":"VulnCheck","date":"22 Oct 2026 (as of 7 PM ET)"},{"title":"Hunt.io: leaked PHP2Shell tooling in open directories","url":"https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories","authors":"Hunt.io","date":"22 Oct 2026"},{"title":"Siemens SSA-566512: RUGGEDCOM APE1808 / PAN-OS","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html","authors":"Siemens ProductCERT","date":"23 Oct 2026"},{"title":"Red Hat CVE-2026-109618 (includes 23 Oct EUS / Extended Life RHSAs)","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json","authors":"Red Hat","date":"23 Oct 2026 (EUS/Extended Life RHSAs)"},{"title":"Arctic Wolf Labs: PHP2Shell critical PHP vulnerabilities","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","authors":"Arctic Wolf Labs","date":"22 Oct 2026 (updated 23 Oct 2026)"},{"title":"Assetnote php2shell-scanner","url":"https://github.com/assetnote/php2shell-scanner","authors":"Assetnote","date":"22 Oct 2026"}],"impact":{"kind":"shared-component","component":"PHP core (Zend engine / SAPI request lifecycle)","matrixNote":"CloudLinux, Ubuntu and Plesk backport fixes while keeping older version strings, so version-only scanners may report false positives.","downstream":[{"product":"PHP 8.5","vendor":"PHP Group","type":"php-upstream","status":"affected","versions":"8.5.12","vendorStatement":{"date":"21 Oct 2026","url":"https://www.php.net/archive/2026.php#2026-10-21-5","quote":"Affected: <8.5.12 affected. Patched 8.5.12. php.net news 21 Oct 2026; ChangeLog lists 22 Oct 2026."}},{"product":"PHP 8.4","vendor":"PHP Group","type":"php-upstream","status":"affected","versions":"8.4.27","vendorStatement":{"date":"21 Oct 2026","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","quote":"Affected: <8.4.27 affected. Both GHSAs: affected <8.4.27; patched 8.4.27."}},{"product":"PHP 8.3","vendor":"PHP Group","type":"php-upstream","status":"affected","versions":"8.3.36","vendorStatement":{"date":"21 Oct 2026","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","quote":"Affected: <8.3.36 affected. Both GHSAs: affected <8.3.36; patched 8.3.36."}},{"product":"PHP 8.2","vendor":"PHP Group","type":"php-upstream","status":"affected","versions":"8.2.35","vendorStatement":{"date":"21 Oct 2026","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","quote":"Affected: <8.2.35 affected; EOL 31 Dec 2026. Both GHSAs: affected <8.2.35; patched 8.2.35. Branch EOL 31 Dec 2026."}},{"product":"PHP 8.1 and older (EOL; 7.4/8.0/8.1 source backports)","vendor":"PHP Group","type":"php-upstream","status":"affected","versions":"Minimal source backports for 7.4/8.0/8.1 (no binaries). AWS: no fix for CVE-2026-109618 on EOL. Unresolved.","vendorStatement":{"date":"21 Oct 2026","url":"https://www.php.net/archive/2026.php#2026-10-21-5","quote":"Affected: PHP 8.1 and older no longer get updates from the PHP project. CVE record does not enumerate pre-8.2.. PHP provided minimal source backports for 7.4, 8.0 and 8.1 (branches PHP-7.4/8.0/8.1-CVE-2026-109618-109619). No binaries. See open note vs AWS bulletin 2026-143-AWS."}},{"product":"PAN-OS 12.2 / 12.1 / 11.2 / 11.1 / 10.2","vendor":"Palo Alto Networks","type":"network-security","notes":"Restrict management to a jump box (management web interface HTTPS UI and XML API; GlobalProtect and Captive Portal are not affected per PAN). Hotfix ETAs copied from the 23 Oct 2026 advisory update. No fixed releases have shipped yet.","status":"affected","versions":"12.2: >= 12.2.4-h1 (ETA: 10/28)\n12.1: >= 12.1.4-h13 (ETA: 10/29)\n12.1: >= 12.1.7-h11 (ETA: 10/28)\n12.1: >= 12.1.10-h3 (ETA: 10/30)\n11.2: >= 11.2.4-h23 (ETA: 10/30)\n11.2: >= 11.2.7-h23 (ETA: 10/29)\n11.2: >= 11.2.10-h16 (ETA: 10/26)\n11.2: >= 11.2.13-h4 (ETA: 10/27)\n11.2: >= 11.2.16-h1 (ETA: 10/28)\n11.1: >= 11.1.4-h38 (ETA: 10/29)\n11.1: >= 11.1.6-h40 (ETA: 10/29)\n11.1: >= 11.1.7-h12 (ETA: 10/30)\n11.1: >= 11.1.10-h36 (ETA: 10/28)\n11.1: >= 11.1.13-h16 (ETA: 10/27)\n11.1: >= 11.1.16-h4 (ETA: 10/26)\n10.2: >= 10.2.7-h39 (ETA: 10/30)\n10.2: >= 10.2.10-h42 (ETA: 10/29)\n10.2: >= 10.2.13-h27 (ETA: 10/27)\n10.2: >= 10.2.16-h12 (ETA: 10/28)\n10.2: >= 10.2.18-h13 (ETA: 10/26)\nNo fixed releases shipped yet.","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: All versions; management web interface (HTTPS UI and XML API) only. Product CVSS-B 8.7 (availability-only vector). GlobalProtect and Captive Portal are not affected. Hotfix ETAs added 23 Oct 2026."},"addedDate":"2026-10-23"},{"product":"Panorama","vendor":"Palo Alto Networks","type":"network-security","status":"affected","versions":"No fixed releases (ETA: TBD)","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: All versions. Included in PAN advisory of impact on Palo Alto Networks products."}},{"product":"WildFire WF-500 / WF-500-B","vendor":"Palo Alto Networks","type":"network-security","status":"affected","versions":"No fixed releases (ETA: TBD)","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: All versions. Appliance WildFire listed affected; WildFire Cloud is a separate row. Advisory still lists ETA: TBD for WF-500 and WF-500-B."}},{"product":"RUGGEDCOM APE1808","vendor":"Siemens","type":"network-security","notes":"SSA-566512, 23 Oct 2026. Also referenced in the CVE-2026-109618 ADP the same day. See advisory for patch and update information.","status":"affected","versions":"Contact customer support to receive patch and update information","vendorStatement":{"date":"23 Oct 2026","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html","quote":"RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All). Remediation: Contact customer support to receive patch and update information. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications."},"addedDate":"2026-10-23"},{"product":"GlobalProtect","vendor":"Palo Alto Networks","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable (not the affected surface)","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: Not the affected surface in the PAN advisory. Only the management web interface is affected; GlobalProtect and Captive Portal are not."}},{"product":"Captive Portal","vendor":"Palo Alto Networks","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable (not the affected surface)","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: Not the affected surface in the PAN advisory. Only the management web interface is affected; GlobalProtect and Captive Portal are not."}},{"product":"Cortex XCORE","vendor":"Palo Alto Networks","type":"cloud-container-hosting","status":"affected","versions":"Patched 21 Oct 2026","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: Cloud service. Cortex XCORE was patched on 21 Oct."}},{"product":"WildFire Cloud","vendor":"Palo Alto Networks","type":"cloud-container-hosting","status":"affected","versions":"Patched 22 Oct 2026","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://security.paloaltonetworks.com/CVE-2026-109618","quote":"Affected: Cloud service. WildFire Cloud was patched on 22 Oct."}},{"product":"NetScaler ADC / Gateway management interfaces","vendor":"Citrix","type":"network-security","notes":"Citrix plans to release fixes for all supported NetScaler software versions on October 27, 2026. That is a planned date, not a shipped fix in this pack. Until then, restrict management access with ACLs (CTX228148).","status":"affected","versions":"Planned 27 Oct 2026 (not shipped in this pack)","vendorStatement":{"date":"22 Oct 2026","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","quote":"Affected: All supported versions: NSIP GUI, management-enabled SNIP, Cluster IP GUI/API. Citrix plans to release fixes for all supported NetScaler software versions on October 27, 2026. Mitigation: restrict management access with ACLs (CTX228148)."}},{"product":"NetScaler Console","vendor":"Citrix","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"22 Oct 2026","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","quote":"Affected: Not impacted per TechZone post. NetScaler Console and SVM are not impacted."}},{"product":"SVM","vendor":"Citrix","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"22 Oct 2026","url":"https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/","quote":"Affected: Not impacted per TechZone post. NetScaler Console and SVM are not impacted."}},{"product":"Other Citrix on-prem products (CTX697263)","vendor":"Citrix","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.html","quote":"Affected: Listed as Not Impacted in CTX697263. CTX697263 lists the other Citrix on-prem products as Not Impacted. Shown date was not in the fetched text (fetched 2026-10-23)."}},{"product":"BIG-IP Configuration utility (all modules, control plane)","vendor":"F5","type":"network-security","notes":"For affected BIG-IP versions (21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3), F5's interim mitigation is /etc/php.ini.d/K000163821.ini (memory_limit=-1, session.upload_progress.enabled=0, etc.) plus an httpd restart. F5 lists no software fixes (None) in K000163821 as of the pack.","status":"affected","versions":"None","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: 21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3. High / CVSS v3.1 7.5. Interim: /etc/php.ini.d/K000163821.ini plus httpd restart."}},{"product":"BIG-IP APM and SSLO data plane (access profile)","vendor":"F5","type":"network-security","status":"affected","versions":"None","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: 21.1.0, 17.5.0-17.5.1, 17.1.0-17.1.3. High / CVSS v3.1 8.1."}},{"product":"F5 AI Gateway 1.x","vendor":"F5","type":"network-security","status":"under-investigation","versions":"Still under research","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"F5 AI Gateway 1.x is still under research."}},{"product":"BIG-IP Next","vendor":"F5","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable."}},{"product":"BIG-IQ","vendor":"F5","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable."}},{"product":"F5OS","vendor":"F5","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable."}},{"product":"NGINX","vendor":"F5","type":"cms-app","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable."}},{"product":"F5 Distributed Cloud","vendor":"F5","type":"cloud-container-hosting","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://my.f5.com/manage/s/article/K000163821","quote":"Affected: Vendor stated not vulnerable. BIG-IP Next, BIG-IQ, F5OS, NGINX and Distributed Cloud are not vulnerable."}},{"product":"ClearPass Policy Manager","vendor":"HPE Aruba","type":"network-security","notes":"CPPM 6.14.1 and 6.11.16 partially mitigate by moving them from an unauthenticated vulnerability to an authenticated vulnerability requiring cluster-admin privileges. Full fixes are still in development. Advisory status Investigating.","status":"affected","versions":"Partial: 6.14.1 and 6.11.16 (full fixes in development)","vendorStatement":{"date":"22 Oct 2026","url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05171.txt","quote":"Affected: 6.14.0 and below; 6.11.15 and below. HPESBNW05171 rev 1, status Investigating, severity Critical. CPPM 6.14.1 and 6.11.16 partially mitigate by requiring cluster-admin authentication. HPE scores both CVEs CVSS 3.1 9.8."}},{"product":"Splunk products","vendor":"Splunk","type":"cms-app","notes":"Currently, no Splunk products are known to be affected. Splunk OnCall, AppDynamics SaaS and Smartlook are still under investigation, not a flat not affected.","status":"none-currently-known-affected","versions":"Not a flat “not affected”","vendorStatement":{"date":"22 Oct 2026","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","quote":"Affected: No products currently known affected; Splunk OnCall, AppDynamics SaaS and Smartlook under investigation. Currently, no Splunk products are known to be affected. Splunk OnCall, AppDynamics SaaS and Smartlook are still Under Investigation."}},{"product":"Splunk OnCall","vendor":"Splunk","type":"cms-app","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"22 Oct 2026","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","quote":"Affected: Under investigation. Splunk OnCall is still Under Investigation."}},{"product":"AppDynamics SaaS","vendor":"Splunk","type":"cms-app","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"22 Oct 2026","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","quote":"Affected: Under investigation. AppDynamics SaaS is still Under Investigation."}},{"product":"Smartlook","vendor":"Splunk","type":"cms-app","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"22 Oct 2026","url":"https://advisory.splunk.com/advisories/SVD-2026-1013","quote":"Affected: Under investigation. Smartlook is still Under Investigation."}},{"product":"Ultra-Reliable Wireless Backhaul (URWB)","vendor":"Cisco","type":"network-security","notes":"Cisco lists no workarounds. URWB (CSCwx37073) fix in 27.1.1 (Feb 2027), admin auth required, CVSS 6.6.","status":"affected","versions":"27.1.1 (Feb 2027)","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: CSCwx37073; admin auth required; CVSS 6.6. Confirmed vulnerable. No workarounds. Revision 1.4 (Interim)."}},{"product":"Expressway / Expressway Select","vendor":"Cisco","type":"network-security","notes":"Cisco lists no workarounds. Expressway and Expressway Select (CSCwx37062) fix in 15.5.21 (TBD). Several products remain under investigation.","status":"affected","versions":"15.5.21 (TBD)","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: CSCwx37062. Confirmed vulnerable. No workarounds."}},{"product":"ISE Portal Builder","vendor":"Cisco","type":"network-security","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: Under investigation. Several products are still under investigation, including ISE Portal Builder."}},{"product":"Catalyst Center","vendor":"Cisco","type":"network-security","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: Under investigation. Several products are still under investigation, including Catalyst Center."}},{"product":"WAE","vendor":"Cisco","type":"network-security","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: Under investigation. Several products are still under investigation, including WAE."}},{"product":"Meraki Dashboard","vendor":"Cisco","type":"cloud-container-hosting","status":"under-investigation","versions":"Still under investigation","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq","quote":"Affected: Under investigation. Several products are still under investigation, including Meraki Dashboard."}},{"product":"Sophos products","vendor":"Sophos","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","quote":"Affected: Advisory: no Sophos products are affected. sophos-sa-20261021-php2shell says no Sophos products are affected."}},{"product":"Legacy MyUTM licensing portal","vendor":"Sophos","type":"network-security","status":"affected","versions":"Taken offline 21 Oct 2026","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell","quote":"Affected: Ran an affected PHP version; taken offline 21 Oct. The legacy MyUTM licensing portal ran an affected PHP version and was taken offline on 21 Oct, with no evidence of exploitation found so far."}},{"product":"AWS services","vendor":"AWS","type":"cloud-container-hosting","notes":"AWS published a separate blog on using AWS WAF to apply mitigations for CVE-2026-109618 and CVE-2026-109619. AWS services themselves are not impacted per bulletin 2026-143-AWS.","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://aws.amazon.com/security/security-bulletins/2026-143-AWS/","quote":"Affected: Bulletin 2026-143-AWS. AWS services are not impacted (bulletin 2026-143-AWS)."}},{"product":"Ubuntu PHP packages","vendor":"Ubuntu","type":"linux-distro","notes":"Ubuntu backports keep older version strings, so version-only scanners may report a false positive.","status":"affected","versions":"Fixes available (see advisory)","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://ubuntu.com/blog/php2shell-vulnerability-fixes-available","quote":"Ubuntu published “PHP2Shell vulnerability: fixes available”. Shown date is not in the source pack; link only."}},{"product":"php8.4 (trixie), php8.2 (bookworm)","vendor":"Debian","type":"linux-distro","notes":"DSA-6574-1, DLA-4848-1. Tracker also lists php8.2 (unstable) as unfixed.","status":"affected","versions":"php8.4 8.4.27-1~deb13u1 (trixie); php8.2 8.2.35-1~deb12u1 (bookworm). Forky still listed vulnerable.","vendorStatement":{"date":"21 Oct 2026","url":"https://security-tracker.debian.org/tracker/CVE-2026-109618","quote":"Fixed in trixie-security and bookworm-security; forky still listed vulnerable; sid fixed for php8.4."}},{"product":"RHEL 10, 9, 8, 7; OpenShift Dev Spaces 3","vendor":"Red Hat","type":"linux-distro","notes":"RHSB-2026-013. Red Hat rates both Important (CVSS 3.1 8.1). Some updates are already available, with additional updates in progress. 23 Oct EUS and Extended Life RHSAs from the Red Hat CVE API.","status":"affected","versions":"RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070), php8.4 8.4.27 (RHSA-2026:87071); RHEL 8 php:7.4 (RHSA-2026:87080); further RHSAs for RHEL 8/9. 23 Oct 2026 EUS and Extended Life: RHSA-2026:88561 (RHEL 10.0 EUS php 8.3.19-1.el10_0.2); RHSA-2026:88565 (RHEL 8.4 AUS and EUS Long-Life php:7.4); RHSA-2026:88533 (RHEL 8.6 AUS and EUS Long-Life php:7.4); RHSA-2026:88532 (RHEL 8.8 TUS and E4S php:7.4). Additional updates in progress.","vendorStatement":{"date":"21 Oct 2026 (updated 23 Oct 2026)","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json","quote":"RHEL 7-10 directly affected (RHEL 7: only CVE-2026-109619; the vulnerable code required to exploit CVE-2026-109618 is not present). OpenShift Dev Spaces 3 affected at Moderate. Bulletin status Ongoing, impact Important. 23 Oct 2026 RHSAs: RHSA-2026:88561, RHSA-2026:88565, RHSA-2026:88533, RHSA-2026:88532."},"addedDate":"2026-10-23"},{"product":"php8 on SLES 15 SP6/SP7, SLES for SAP, openSUSE Leap 15.6","vendor":"SUSE","type":"linux-distro","status":"affected","versions":"php8 8.2.35 (SUSE-SU-2026:4843-1, 15 SP6 / Leap 15.6); php8 8.3.36 (SUSE-SU-2026:4844-1, 15 SP7). Other products still in progress.","vendorStatement":{"date":"21 Oct 2026","url":"https://www.suse.com/security/cve/CVE-2026-109618.html","quote":"SUSE overall state Pending, rated important; fixed packages released for SLE 15 SP6 (8.2.35) and SP7 (8.3.36)."}},{"product":"php83, php84, php85 (edge, 3.24 community)","vendor":"Alpine Linux","type":"linux-distro","notes":"No date shown on the tracker page. Older Alpine branches (3.21-3.23) and php82 were not confirmed from the tracker.","status":"affected","versions":"php83 8.3.36-r0; php84 8.4.27-r0; php85 8.5.12-r0 (edge and 3.24-community)","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://security.alpinelinux.org/srcpkg/php84","quote":"Fixed (Alpine security tracker)."}},{"product":"AlmaLinux 8, 9, 10 (all PHP streams)","vendor":"AlmaLinux","type":"linux-distro","status":"affected","versions":"Patched packages for every stream; e.g. AlmaLinux 10 php 8.3.36-1.el10_2 (ALSA-2026:87070)","vendorStatement":{"date":"21 Oct 2026","url":"https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/","quote":"AlmaLinux 8, 9, and 10 all ship affected PHP versions. Patched packages for every stream in production repos."}},{"product":"Rocky Linux 10 php","vendor":"Rocky Linux","type":"linux-distro","status":"affected","versions":"php 8.3.36 (RLSA-2026:87070)","vendorStatement":{"date":"22 Oct 2026","url":"https://errata.rockylinux.org/RLSA-2026:87070","quote":"Fixed (Important: php security update)."}},{"product":"AL2023 php8.2-8.5; AL2 PHP 8.2 Extras; AL2027 Preview","vendor":"Amazon Linux","type":"linux-distro","notes":"Separate from the AWS services bulletin. No Fix Planned is a vendor status, not not affected.","status":"affected","versions":"AL2023: ALAS2023-2026-3301 to 3304; AL2 php8.2 Extra: ALAS2PHP8.2-2026-015; AL2027 Preview: ALAS2027-2026-243. No fix planned for AL2 core php and AL2023 php8.1.","vendorStatement":{"date":"21 Oct 2026","url":"https://explore.alas.aws.amazon.com/CVE-2026-109618.html","quote":"Fixed for AL2023 php8.2/8.3/8.4/8.5, AL2 php8.2 Extra and AL2027 Preview; No Fix Planned for AL2 core php and AL2023 php8.1."}},{"product":"php (Fedora 43, Fedora 44)","vendor":"Fedora","type":"linux-distro","status":"affected","versions":"F43: php-8.4.27-2.fc43 (FEDORA-2026-d5f8446449); F44: php-8.5.12-1.fc44 (FEDORA-2026-a9eba4bbc3)","vendorStatement":{"date":"21 Oct 2026 (stable 22 Oct 2026)","url":"https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449","quote":"Security update pushed to stable (severity high)."}},{"product":"Oracle Linux 10 php8.4","vendor":"Oracle Linux","type":"linux-distro","status":"affected","versions":"php8.4-8.4.27-1.el10_2 (ELSA-2026-87071)","vendorStatement":{"date":"21 Oct 2026","url":"https://linux.oracle.com/errata/ELSA-2026-87071.html","quote":"Fixed (php8.4 security update)."}},{"product":"dev-lang/php","vendor":"Gentoo","type":"linux-distro","status":"affected","versions":"Upgrade to >= 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (GLSA 202610-02)","vendorStatement":{"date":"21 Oct 2026","url":"https://security.gentoo.org/glsa/202610-02","quote":"Affected < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. There is no known workaround."}},{"product":"php82/php83/php84/php85 ports","vendor":"FreeBSD","type":"linux-distro","status":"affected","versions":"8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","vendorStatement":{"date":"21 Oct 2026","url":"https://vuxml.freebsd.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html","quote":"VuXML entry: affected below fixed versions."}},{"product":"Ubuntu 14.04-20.04 ESM PHP","vendor":"Ubuntu","type":"linux-distro","notes":"Ubuntu backports keep older version strings, so version-only scanners may report a false positive.","status":"affected","versions":"Fixed under ESM (see USN-8948-2 for per-release package versions)","vendorStatement":{"date":"21 Oct 2026","url":"https://ubuntu.com/security/notices/USN-8948-2","quote":"Fixed under ESM (USN-8948-2 follows USN-8948-1)."}},{"product":"cPanel & WHM, EasyApache 4 ea-php","vendor":"cPanel","type":"hosting-panel","status":"affected","versions":"cPanel & WHM 11.110.0.153 / 11.134.0.66 / 11.136.0.50 / 11.138.0.18 (WP Squared 11.138.1.17); ea-php74 7.4.33-19 through ea-php85 8.5.12. Older than 7.4: TuxCare ELS.","vendorStatement":{"date":"22 Oct 2026","url":"https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619","quote":"All shipped PHP versions are suspected to be vulnerable; updates released for ea-php74 and above."}},{"product":"PHP shipped with Plesk Obsidian (Linux, Windows) and Plesk sw-engine/plesk-engine","vendor":"Plesk","type":"hosting-panel","notes":"Plesk EOL builds keep the same version number and differ by build date, so version-only scanners may report a false positive. The panel's own management engine runs PHP and needed its own fix.","status":"affected","versions":"PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; EOL 7.4.33, 8.0.30, 8.1.34 fixed in builds dated 21 Oct 2026 (Linux only); Plesk UI engine fixed in Obsidian 18.0.80 Update 11 and 18.0.81 Update 4","vendorStatement":{"date":"22 Oct 2026","url":"https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk","quote":"All PHP versions shipped with Plesk are also affected; fixes available."}},{"product":"DirectAdmin CustomBuild PHP","vendor":"DirectAdmin","type":"hosting-panel","notes":"Staff forum post (DirectAdmin Announcements, administrator fln), not a formal advisory.","status":"affected","versions":"PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor patches for 7.4 / 8.0 / 8.1 (same version number). PHP 7.3-5.6 did not yet have a patch at the time. Needs da update + da build php.","vendorStatement":{"date":"21 Oct 2026","url":"https://forum.directadmin.com/threads/critical-php-updates.82726/page-3","quote":"New DA build released to current and stable channels; PHP 8.2-8.5 bumped, patches added for 8.1, 8.0, 7.4; PHP versions 7.3 - 5.6 does not yet have a patch."}},{"product":"alt-php, ea-php, native CloudLinux PHP, TuxCare ELS PHP","vendor":"CloudLinux","type":"hosting-panel","notes":"CloudLinux backports keep older version strings, so version-only scanners may report a false positive. CLSA-2026:87070 dated 22 Oct 2026.","status":"affected","versions":"alt-php82 8.2.35-1, alt-php83 8.3.36-1, alt-php84 8.4.27-1, alt-php85 8.5.12-1 (CL 8/9); earlier backports e.g. alt-php85 8.5.11-5, ea-php84 8.4.26-2.el8.cloudlinux.1","vendorStatement":{"date":"23 Oct 2026","url":"https://cloudlinux.statuspage.io/","quote":"Fixed packages in stable for alt-php and native PHP; alt-php/ea-php fixes are backports carrying the old version number."}},{"product":"DSM PHP packages, Mail Station, Synology Calendar","vendor":"Synology","type":"nas-consumer","status":"affected","versions":"PHP 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051, 8.4.27-0051; Calendar 3.0.4-21435; Mail Station 30000002.3.19-20333. PHP 7.3: no fix will be provided. DSM built-in PHP patch scheduled for a subsequent DSM release.","vendorStatement":{"date":"22 Oct 2026","url":"https://www.synology.com/en-us/security/advisory/Synology_SA_26_14","quote":"Advisory status Resolved, severity Critical. The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low. Synology Drive is not affected."}},{"product":"Multiple QNAP products","vendor":"QNAP","type":"nas-consumer","notes":"QSA-26-18. Interim guidance: keep NAS off the internet, use VPN, restrict management ports.","statusLabel":"Affected (multiple products), no fix yet","status":"affected","versions":"No fix yet","vendorStatement":{"date":"22 Oct 2026","url":"https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance","quote":"Multiple QNAP products are affected. QNAP is working on fixes, and updated versions will be released as they become available."}},{"product":"TrueNAS CE/Enterprise (SCALE), CORE, TrueCommand, TrueNAS Connect","vendor":"TrueNAS","type":"nas-consumer","status":"vendor-stated-not-affected","versions":"No platform fix needed","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://security.truenas.com/scale/impact-statements/php2shell-2026/","quote":"Not Affected. The TrueNAS platform does not ship or use PHP."}},{"product":"TrueNAS app catalog (PHP-based apps)","vendor":"TrueNAS","type":"nas-consumer","status":"affected","versions":"Updated Nextcloud app image being published; other PHP apps as upstream images ship","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://security.truenas.com/scale/impact-statements/php2shell-2026/","quote":"PHP-based catalog apps (e.g. Nextcloud) are affected via their own container images."}},{"product":"Nighthawk RAX28, RAX29, RAX30, RAXE290, RAXE300, CAX30","vendor":"NETGEAR","type":"nas-consumer","notes":"Severity MEDIUM. This advisory will be updated when fixed firmware versions are available.","status":"under-investigation","versions":"No fixed firmware yet","vendorStatement":{"date":"22 Oct 2026","url":"https://kb.netgear.com/000070960/","quote":"Only the Nighthawk models listed below were found to include PHP components and their actual impact is under review. PHP is LAN/WiFi-only management, not accessible from the Internet by default."}},{"product":"Other NETGEAR products and services","vendor":"NETGEAR","type":"nas-consumer","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"22 Oct 2026","url":"https://kb.netgear.com/000070960/","quote":"No other NETGEAR product or service is exposed to these vulnerabilities based on our assessment."}},{"product":"FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS","vendor":"Fortinet","type":"network-security","status":"under-investigation","versions":"No fixed versions listed","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://www.fortiguard.com/psirt/FG-IR-26-186","quote":"Under investigation: FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS."}},{"product":"FortiOS, FortiProxy, FortiWeb, FortiMail, FortiManager, FortiAnalyzer, FortiSIEM, FortiSandbox, FortiNAC, FortiADC, FortiSASE, FortiAuthenticator, FortiClient","vendor":"Fortinet","type":"network-security","notes":"FG-IR-26-186 lists further products as not impacted. Known Exploited: No.","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026 (updated 22 Oct 2026)","url":"https://www.fortiguard.com/psirt/FG-IR-26-186","quote":"Products confirmed NOT Impacted include FortiOS, FortiProxy, FortiWeb, FortiMail, FortiManager, FortiAnalyzer, FortiSIEM, FortiSandbox, FortiNAC, FortiADC, FortiSASE, FortiAuthenticator and FortiClient (all platforms)."}},{"product":"Check Point firewall web interfaces","vendor":"Check Point","type":"network-security","statusLabel":"IPS protection CPAI-2026-15172 published","status":"under-investigation","versions":"See vendor blog","vendorStatement":{"date":"21 Oct 2026","url":"https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/","quote":"IPS protection CPAI-2026-15172 released."}},{"product":"ESG, Cloud-to-Cloud Backup, Cloud Archiving Service, Web Security Gateway/Agent, WAF / Load Balancer ADC / WAF Control Center, WAF-as-a-Service / Active DDoS Protection, Vulnerability Manager, Advanced Threat Protection, Data Inspector, Incident Response & Impersonation Protection, RMM, BarracudaONE, Message Archiver","vendor":"Barracuda","type":"network-security","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://trust.barracuda.com/security/php-vulnerabilities","quote":"Not affected (explicit) for ESG, Cloud-to-Cloud Backup, Cloud Archiving Service, Web Security Gateway/Agent, WAF / Load Balancer ADC / WAF Control Center, WAF-as-a-Service / Active DDoS Protection, Vulnerability Manager, Advanced Threat Protection, Data Inspector, Incident Response & Impersonation Protection, RMM, BarracudaONE, Message Archiver."}},{"product":"CloudGen Firewall, SecureEdge, Cloud Control, Email Gateway Defense, XDR, Security Awareness Training, MSP/Maestro, Backup Service (BBS), Firewall Insights","vendor":"Barracuda","type":"network-security","status":"under-investigation","versions":"None listed","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://trust.barracuda.com/security/php-vulnerabilities","quote":"Under investigation: CloudGen Firewall, SecureEdge, Cloud Control, Email Gateway Defense, XDR, Security Awareness Training, MSP/Maestro, Backup Service (BBS), Firewall Insights."}},{"product":"All WatchGuard products","vendor":"WatchGuard","type":"network-security","notes":"WGSA-2026-0032, severity Informational. This is an initial assessment, not a final not-affected statement.","statusLabel":"Initial assessment: not affected","status":"vendor-stated-not-affected","versions":"No solution published","vendorStatement":{"date":"21 Oct 2026","url":"https://psirt.watchguard.com/WGSA-2026-0032/","quote":"WatchGuard's initial assessment is that none of our products are affected by this vulnerability. We are continuing to review."}},{"product":"pfSense Plus 26.07 / 26.03.1, pfSense CE 2.9.0 / 2.8.1","vendor":"Netgate","type":"network-security","status":"affected","versions":"Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36 (install from shell, not the GUI)","vendorStatement":{"date":"21 Oct 2026","url":"https://www.netgate.com/blog/critical-php-security-update","quote":"Affect pfSense software installations; concern only if the PHP GUI or Captive Portal is exposed to attackers (GUI is LAN-only by default, Captive Portal off by default)."}},{"product":"OPNsense Community Edition, Business Edition","vendor":"OPNsense","type":"network-security","status":"affected","versions":"CE 26.7.7 (PHP 8.5.12); BE 26.4.2p3 (PHP 8.3.36); restart captive portal after update","vendorStatement":{"date":"21 Oct 2026","url":"https://forum.opnsense.org/index.php?topic=53191.0","quote":"Hotfix released for two critical PHP vulnerabilities."}},{"product":"WordPress.com, WordPress VIP, WP Cloud, Pressable, Tumblr","vendor":"Automattic","type":"cms-app","status":"affected","versions":"Platform patched","vendorStatement":{"date":"21 Oct 2026","url":"https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/","quote":"Your site is already protected. There is nothing you need to do."}},{"product":"WP Engine hosting platform","vendor":"WP Engine","type":"cms-app","status":"affected","versions":"Platform patched","vendorStatement":{"date":"22 Oct 2026","url":"https://wpengine.com/blog/php-vulnerability-update/","quote":"All customer sites are running fully patched versions of PHP."}},{"product":"Drupal sites (PHP runtime)","vendor":"Drupal","type":"cms-app","notes":"Informational PSA-2026-10-20. Not a statement that Drupal itself is or is not affected.","status":"affected","versions":"No Drupal release; update PHP","vendorStatement":{"date":"21 Oct 2026","url":"https://www.drupal.org/psa-2026-10-20","quote":"Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation. Site owners are responsible for the hosting platform."}},{"product":"Nextcloud All-in-One; Nextcloud servers on PHP","vendor":"Nextcloud","type":"cms-app","notes":"Mastodon post (21 Oct 2026): the issue would affect all online PHP servers and operations including Nextcloud.","status":"affected","versions":"AIO v14.4.1 ships updated PHP dependencies; self-hosted: update PHP","vendorStatement":{"date":"21 Oct 2026","url":"https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1","quote":"AIO v14.4.1: PHP CVEs. Upgrade to this version now!"}},{"product":"moodle.org and Moodle HQ public-facing / client sites","vendor":"Moodle","type":"cms-app","notes":"About Moodle HQ's own hosting, not a Moodle LMS product advisory.","status":"affected","versions":"Update PHP (no Moodle release)","vendorStatement":{"date":"22 Oct 2026","url":"https://moodle.org/mod/forum/discuss.php?d=482882","quote":"Moodle HQ took its public sites offline as a precaution; We have patched this site and is patching other public/client sites. Urges self-hosters to update PHP."}},{"product":"Passbolt Cloud and self-hosted images","vendor":"Passbolt","type":"cms-app","status":"affected","versions":"Cloud, Docker, AWS AMI, OVA, Helm fixed; DigitalOcean fixed, awaiting marketplace review","vendorStatement":{"date":"21 Oct 2026","url":"https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2","quote":"All Passbolt versions running on an unpatched PHP affected; Cloud, Docker, AWS AMI, OVA, Helm fixed; DigitalOcean fixed, awaiting marketplace review."}},{"product":"BookStack (PHP runtime guidance)","vendor":"BookStack","type":"cms-app","status":"affected","versions":"PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35","vendorStatement":{"date":"21 Oct 2026","url":"https://www.bookstackapp.com/blog/php-security-release-critical/","quote":"Guidance: update PHP; notes Ubuntu backports keep old version numbers."}},{"product":"Docker Official Images (php), Docker Hardened Images","vendor":"Docker","type":"cloud-container-hosting","status":"affected","versions":"DHI: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Official php tags list 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35","vendorStatement":{"date":"22 Oct 2026","url":"https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/","quote":"Official Images have already been updated and released to Docker Hub and mirrored to Amazon ECR; DHI updated."}},{"product":"Cloudflare WAF (Managed + Free rulesets)","vendor":"Cloudflare","type":"cloud-container-hosting","notes":"WAF mitigation only; it does not replace patching PHP.","statusLabel":"WAF protections deployed","status":"none-currently-known-affected","versions":"n/a (WAF mitigation)","vendorStatement":{"date":"21 Oct 2026 (changelog 22 Oct 2026)","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","quote":"WAF protections deployed about 9 hours ahead of public disclosure; 22 Oct emergency release renamed seven existing rules to the CVE IDs. Detection logic and rule actions remain unchanged."}},{"product":"App & API Protector","vendor":"Akamai","type":"cloud-container-hosting","notes":"WAF mitigation only; it does not replace patching PHP.","statusLabel":"WAF rule released","status":"none-currently-known-affected","versions":"n/a (ASE 3000991 v1)","vendorStatement":{"date":"21 Oct 2026","url":"https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core","quote":"Customers are protected because we have released security updates; Adaptive Security Engine rule 3000991 v1."}},{"product":"Next-Gen WAF","vendor":"Fastly","type":"cloud-container-hosting","notes":"WAF mitigation only; it does not replace patching PHP.","statusLabel":"Virtual patch available","status":"none-currently-known-affected","versions":"n/a (opt-in virtual patch)","vendorStatement":{"date":"21 Oct 2026","url":"https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/","quote":"Virtual patch available covering both CVEs (opt-in)."}},{"product":"Google Cloud platform","vendor":"Google Cloud","type":"cloud-container-hosting","notes":"GCP-2026-070.","status":"vendor-stated-not-affected","versions":"Not applicable","vendorStatement":{"date":"21 Oct 2026","url":"https://cloud.google.com/support/bulletins","quote":"While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable."}},{"product":"App Engine Standard, Cloud Run, Cloud Run functions","vendor":"Google Cloud","type":"cloud-container-hosting","notes":"GCP-2026-070.","status":"affected","versions":"Redeploy with PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Some workloads may be auto-patched where automatic updates are on.","vendorStatement":{"date":"21 Oct 2026","url":"https://cloud.google.com/support/bulletins","quote":"Users of this language running on Google Cloud may be vulnerable. Some workloads may be auto-patched on App Engine Standard / Cloud Run with automatic updates."}},{"product":"Azure App Service (Linux built-in PHP, Windows PHP, WordPress on App Service); Azure WAF","vendor":"Microsoft Azure","type":"cloud-container-hosting","notes":"Azure WAF managed rule rollout expected to complete by 28 October 2026, per Microsoft Tech Community (updated 22 Oct 2026).","status":"affected","versions":"App Service Linux: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (rollout completed 21 Oct 2026). Windows built-in PHP runtimes are EOL: no security patch currently planned. Older Alpine-based WordPress images will not receive these security patches.","vendorStatement":{"date":"21 Oct 2026","url":"https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html","quote":"Linux built-in PHP images patched in Latest and Standard channels (Extended later). Windows built-in PHP runtimes are EOL: No security patch for these runtimes is currently planned. Older Alpine-based WordPress images will not receive these security patches."}},{"product":"Vercel WAF / PHP on Vercel","vendor":"Vercel","type":"cloud-container-hosting","notes":"WAF mitigation only; customers still need to upgrade PHP.","statusLabel":"WAF protections deployed","status":"none-currently-known-affected","versions":"n/a (WAF); customers upgrade PHP","vendorStatement":{"date":"21 Oct 2026","url":"https://vercel.com/kb/bulletin/php2shell-security-bulletin","quote":"WAF protections deployed before disclosure; do not replace patching."}},{"product":"Heroku PHP runtime","vendor":"Heroku","type":"cloud-container-hosting","status":"affected","versions":"PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","vendorStatement":{"date":"21 Oct 2026","url":"https://devcenter.heroku.com/changelog-items/3845","quote":"Fixed PHP versions available; Redeploy your apps to pick up the fixed versions."}},{"product":"Kinsta managed WordPress hosting","vendor":"Kinsta","type":"cloud-container-hosting","status":"affected","versions":"PHP 7.4-8.5 patched platform-wide","vendorStatement":{"date":"22 Oct 2026","url":"https://status.kinsta.com/incidents/c0c6xl1ghpb2","quote":"Resolved: All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches."}},{"product":"Upsun Cloud PHP runtime images","vendor":"Upsun","type":"cloud-container-hosting","status":"affected","versions":"PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (plus vendor backports for older). Composable image update still in progress.","vendorStatement":{"date":"22 Oct 2026","url":"https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check","quote":"Upsun Cloud has patched every php runtime image from PHP 7.4 to 8.5 and redeployed the affected environments; composable image update still in progress."}},{"product":"Scalingo PaaS, PHP buildpack","vendor":"Scalingo","type":"cloud-container-hosting","status":"affected","versions":"PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available 21 Oct 2026; customers must redeploy","vendorStatement":{"date":"21 Oct 2026","url":"https://doc.scalingo.com/security/bulletins/ssb-2026-005","quote":"PHP applications hosted on Scalingo are potentially affected; all four fixed PHP versions now available; router blocks multipart requests by default."}},{"product":"Adobe Commerce / Magento","vendor":"Adobe","type":"cms-app","notes":"No Adobe statement found for these CVEs.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://helpx.adobe.com/security.html"}},{"product":"Ivanti products","vendor":"Ivanti","type":"network-security","notes":"No vendor statement found for these CVEs.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://forums.ivanti.com/s/topiccatalog/Security%20Advisories"}},{"product":"Joomla","vendor":"Joomla","type":"cms-app","notes":"Joomla Security Centre had no PHP2Shell entry when checked.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://developer.joomla.org/security-centre.html"}},{"product":"Juniper products","vendor":"Juniper","type":"network-security","notes":"No JSA found for these CVEs.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://supportportal.juniper.net/s/"}},{"product":"SonicWall products","vendor":"SonicWall","type":"network-security","notes":"No SonicWall PSIRT advisory or notice found for these CVEs.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://www.sonicwall.com/psirt"}},{"product":"Ubiquiti products","vendor":"Ubiquiti","type":"network-security","notes":"No Ubiquiti statement found for these CVEs.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://community.ui.com/"}},{"product":"Zyxel products","vendor":"Zyxel","type":"network-security","notes":"Zyxel security advisories index had no PHP / PHP2Shell entry when checked.","status":"no-statement-yet","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://www.zyxel.com/global/en/support/security-advisories"}}]},"pocs":[{"title":"Public PoC with limited ASLR bypass (unnamed; VulnCheck)","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","source":"VulnCheck","validationStatus":"validated","validationDate":"2026-10-22","notes":"VulnCheck reported on 22 Oct 2026 that one public PoC achieved an ASLR bypass on x86-64 with PHP 8.4.26 and the default heap only, and that it did not work outside that setup. Dated and sourced from the VulnCheck blog (as of 7 PM ET on 22 Oct). VulnCheck did not name the public repository. No exploit detail here. VulnCheck's own ASLR-bypass exploit for CVE-2026-109618 remains customers-only, as reported by The Register.","addedDate":"2026-10-22"},{"title":"Google Threat Intelligence: some unnamed public PoCs validated as capable of RCE against default mod_php, not PHP-FPM","url":"https://x.com/JohnHultquist/status/2113686799708991522","source":"Google Threat Intelligence Group (John Hultquist)","validationStatus":"validated","validationDate":"2026-10-23","notes":"Hultquist wrote on 23 Oct 2026 that GTIG validated some public PoCs as capable of RCE against default deployments of mod_php but not PHP-FPM, and that many circulating PoCs appear incapable of RCE. Google did not name the repositories. No exploit detail here.","addedDate":"2026-10-24"}],"pocEmptyState":"No other public PoC is indexed here. VulnCheck told The Register it had a private ASLR-bypass exploit for CVE-2026-109618, shared only with paying customers. Google Threat Intelligence did not name the public repositories it validated. No public link for those unnamed PoCs.","_feed":{"page":"https://vuln2shell.com/vulns/php2shell","json":"https://vuln2shell.com/vulns/php2shell.json","iocsCsv":"https://vuln2shell.com/vulns/php2shell/iocs.csv","stix":"https://vuln2shell.com/vulns/php2shell/stix.json"}}