PHP2Shell: Critical flaws exposed, Amazon warns of attacks

The PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday (October 21) around 14:00 UTC, addressing two critical remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell. The flaws allow an unauthenticated attacker to execute code on the server and were rated 9.2 on the CVSS v4.0 scale, according to Wiz Research, which discovered them, and the advisory from Qualys.

The fix was released earlier than expected. Details of the vulnerabilities leaked on October 20, along with an unconfirmed 10.0 rating that circulated widely, prompting PHP to advance the coordinated disclosure by 24 hours. According to Amazon Threat Intelligence, the company’s honeypots recorded an attempted exploitation on October 17, four days prior to the public advisory. Amazon now describes the exploitation as widespread.

The Exposed Surface Area

Wiz claims that PHP2Shell affects about 70% of the internet, aligning with the share of sites served by PHP. The company states that all versions since PHP 5.4 have at least one of the two flaws, indicating a defect present in the core of the language for over a decade. Wiz’s demonstration executed code without authentication against standard container images of WordPress, Drupal, and Joomla, with no modifications.

The highest risk is in installations using mod_php, the module that embeds the interpreter within Apache. In this scenario, the PHP project confirmed complete remote execution via HTTP with default limits, before any line of application code is executed. This bypasses protections typically controlled by development teams, such as input validation and authentication.

PHP 8.1 and earlier versions do not receive updates from the official project. Linux distributions are publishing backports: AlmaLinux announced that corrected packages are already in the production repositories for all PHP versions in their 8, 9, and 10 editions. The PHP project itself states that updating is the only safe option, as the available mitigations only close part of the vectors.

Exploitation Before the Patch

The timeline is the data that shifts priority for a CISO. Public proof-of-concept codes emerged around 2:00 UTC on October 21, approximately 12 hours before the end of the embargo, according to Amazon. Cloudflare reported attack traffic against the vulnerabilities, including attempts to circumvent its WAF rules, and Patchstack indicated it received reports of exploitation from hosting partners.

Amazon notes that the payloads and observed infrastructure vary, suggesting multiple actors, and it is still unclear if these attempts would succeed against real systems. The CISA had not included the two CVEs in its Known Exploited Vulnerabilities (KEV) catalog until the release of the SOCRadar advisory. For regulated companies using the KEV as a formal trigger for emergency patching, this interval creates a window where the internal deadline has not yet begun to count, but attacks have already commenced.

There is also data regarding how the flaw was discovered. Wiz and the security firm Calif utilized AI models in discovery and response, according to Gigazine and other reports from the 22nd. Tools that find long-standing defects in huge codebases shorten the time between discovery and exploitation for both sides.

Where PHP2Shell Has Greater Impact

In the United States and Europe, the risk is concentrated in corporate portals, intranets, and e-commerce sites running on WordPress, Drupal, or Magento on self-hosted servers, beyond the reach of automatic corrections from managed providers. Sansec, a company specializing in e-commerce, has published its own analysis on PHP2Shell, signaling that e-commerce has entered the scope of incident response teams.

In India and the Philippines, major hubs for web agencies and outsourced support, a single team often manages hundreds of customer sites on shared hosting. An outdated PHP version in this model replicates exposure across all clients simultaneously, and the fix depends on contract terms and who has access to the server.

In Brazil, PHP is common in public agency websites, medium-sized retailers, and internally developed legacy systems, many still operating on 7.x versions that the official project has not updated in this round. For these environments, the options are backporting from the distribution or forced version migration, with compatibility testing done under pressure.

The common standard across all three markets is that inventory comes before the patch. Most companies know how many Windows servers they have; few know how many instances of PHP are running on marketing sites, HR tools, and departmental systems contracted outside of IT.