As you’ve all probably heard by now, on October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.
Our fleet and demos have all been fully upgraded to the patched versions of PHP. To see the timeline on mitigation and patching, see the incident on our status page. We have no evidence that any of our hosted fleet’s data has been compromised.
Docker users can get the updated version by pulling from latest. (see this issue for how to check.)
Self-hosted users are urged to upgrade their version of PHP immediately, and check for any Indicators of Compromise (IOCs):
- Potential pre-exploit indicators: Bursts of requests to one endpoint, PHP worker crashes, out-of-memory, or fatal errors in logs, and multipart
POSTs carryingPHP_SESSION_UPLOAD_PROGRESS(one sample confirmed path, but not the only one). - Potential post-exploit indicators: Monitor for behaviors that indicate an attacker has already gained code execution on a PHP host. New or changed
.phpfiles, shells spawned by PHP, unusual outbound connections. New cron jobs,systemdunits, users, or SSHauthorizedkeys, changes toautoprepend_fileinphp.ini,.user.ini, or.htaccess, unexpected PHP extensions, or new outbound connections from the web user.
Via Huntress:
“Florian Roth, who released a free tool called process-watcher (a Linux-based process monitoring tool aimed at detecting exploitation) put it well: exploitation of these bugs will most likely show up as suspicious child processes spawned by PHP.
In practice, that means a PHP worker process like php-fpm, php-cgi, php-cgi.exe, httpd, or apache2 would launch something abnormal:
- Shells like
sh,bash,cmd.exe, orpowershell.exe - Interpreters like
pythonorperl - Download or networking tools like
curl,wget,nc, orcertutil.exe
It’s worth taking a closer look at command lines that include reverse shell patterns:
/dev/tcp/fsockopenmkfifo
It’s also worth looking at quick reconnaissance commands like whoami, id, uname -a, or ipconfigrun straight from the web server.”
Special thanks to Remi Collet for pushing those updates to his repo on his vacation. If you’re a self-hosted user and you use his repo, you should consider donating via his PayPal button.
Additional references:
- https://www.php.net/archive/2026.php#2026-10-21-5
- https://www.php2shell.com
- https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/
- https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
- https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/
