ReconXWatchtower

Where this stands

First reported 19/10/2026 17:11

  1. 1Unconfirmed reportnot observed
  2. 2Corroborated19/10/2026 17:11Rapid7 blog
  3. 3Confirmed20/10/2026 22:32PHP news
  4. 4Exploited now22/10/2026 15:09BleepingComputer

Unconfirmed report was never seen on its own: the first report we had was already stronger.

PHP remote code execution (PHP2Shell)

PHP · Critical

CVE-2026-109618 CVE-2026-109619 CVE-2026-115560 CVE-2026-88771 CVE-2026-88779

Published 24/10/2026 16:05

Timeline

4 events over 4 d 22 h

  1. 19/10/2026 17:11CorroboratedRapid7 blog+1 d 5 h
  2. 20/10/2026 22:32ConfirmedPHP news+1 d 16 h
  3. 22/10/2026 15:09ExploitedBleepingComputer+2 d
  4. 24/10/2026 16:05Published on WatchtowerPro CISO

In short

CVE-2026-109618 and CVE-2026-109619 in PHP allow remote code execution (known as PHP2Shell). The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Amazon Threat Intelligence says attackers began targeting these flaws about four days before the patches were released (reported by BleepingComputer on 22/10/2026).

Affected versions

  • PHP installations that serve web pages, on branches older than the fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Apache mod_php carries the highest risk.
  • PHP 8.1 and older (including 7.4, 8.0 and PHP 5) get no official fixed release. CrowdStrike's analysis, quoted on the oss-security list, says the flaw behind CVE-2026-109618 dates to PHP 7.3.0 and the flaws behind CVE-2026-109619 go back to PHP 7.1 and PHP 5.4. Older branches are therefore probably affected too, even though the vendor advisories only name PHP 8.2 to 8.5.
  • Products that include PHP are also affected, especially when the PHP web interface is reachable. This includes firewalls, load balancers and other network components. Palo Alto firewalls, Citrix NetScaler and HPE System Management Homepage are reported to run PHP with ASLR disabled. The management interface is the main risk.
  • On PHP-FPM, Red Hat calls remote code execution 'difficult in practice'. Sansec says the public exploits do not work against a default PHP in

Fixed in

  • 8.2 branch: 8.2.35
  • 8.3 branch: 8.3.36
  • 8.4 branch: 8.4.27
  • 8.5 branch: 8.5.12

What to do now

  • Update PHP to a fixed release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On a distribution package, install the fixed package instead: Debian 12 8.2.35-1~deb12u1 (DLA-4848-1), Debian 13 8.4.27-1~deb13u1 (DSA-6574-1), Ubuntu 22.04 8.1.2-1ubuntu2.28, Ubuntu 24.04 8.3.6-0ubuntu0.24.04.13. Then restart every PHP process (Apache with mod_php, or PHP-FPM).
  • Check your network products that include PHP: Palo Alto firewalls, Citrix NetScaler, HPE System Management Homepage on ProLiant servers, and other firewalls or load balancers with a web interface. Install the vendor update when it is available. Palo Alto is reported to plan its patches for next week. Until then, do not expose their management interfaces to the internet.
  • If you run PHP 8.1 or older, there is no official fixed release. Move to a supported branch (8.2 or newer) as soon as possible. Backports from the PHP security team exist only as source for 7.4, 8.0 and 8.1, and there is nothing official for PHP 5. For Enterprise Linux 6 and 7 with PHP 5, an individual researcher has published an unofficial backport of the fix on the oss-security list. It is not vendor-supported, so test it carefully before use.
  • Until you have updated, apply PHP's temporary measures in php.ini: session.upload_progress.enabled=0 (then restart every PHP worker); on 8.5 also fatal_error_backtraces=0; a fixed memory_limit=-1 that applications cannot override; and a low post_max_size. The same measures are reported to also cover the separate unpatched flaw CVE-2026-115560.
  • Be aware that these temporary measures only reduce exposure and do not make the server safe. PHP says so itself, and watchTowr calls .ini changes ineffective. Updating is the only real fix.
  • Look for signs of compromise on internet-facing PHP servers. Indicators drawn from working proof-of-concept exploits are published in the ifin.network PHP2Shell write-up and its MISP feed. Password-spray traffic has been seen alongside exploit attempts.
  • Do not download or run public 'PoC' exploi

ReconX customers see the full notice - and their own systems

In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run PHP, at which version, fixed or not - and what each one needs.

Sign in to ReconXAbout ReconX

Main sources

Upcoming Critical PHP Security Release Vendor · PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) Vendor · Critical PHP Security Release Vendor

← All Watchtower notices

Pro CISO publishes Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.