PHP2Shell: CISA Confirms Attackers Are Exploiting Two Critical PHP Flaws
PHP quietly runs a huge share of the internet, from small blogs to enterprise portals and the web interfaces of network devices. So when two critical flaws in PHP itself start being exploited, the number of potentially exposed systems is enormous. That is the situation behind PHP2Shell.
What CISA announced
On Monday, October 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog, which confirms they are being used in real attacks. Both flaws are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution, meaning an attacker does not need a login to run code on a vulnerable server. CVE-2026-109618 is an out-of-memory corruption flaw, and CVE-2026-109619 is a stale internal request-state flaw.
Proof from a honeypot
The decision followed concrete evidence. Adel Karimi, who leads detection and response at Perplexity, confirmed on October 24 that remote code execution had succeeded against honeypot systems, which are decoy servers set up to catch attackers. He said this was confirmed code execution with usable memory disclosure, not merely a crash followed by a suspicious process, and noted that the attack returned a very large dump of memory data. He was also careful about the limits of the evidence: it shows the attack chain working on an intentionally favorable single-worker setup, and it is not a measurement of how reliable the exploit would be on other configurations, PHP builds or applications.
How big is the exposure
PHP is used by roughly 70% of all websites, according to W3Techs. Censys estimates that more than 32.5 million PHP services are still running an affected version. That scale explains why so many companies have issued advisories, including Dell, Citrix, F5, IBM, Siemens, Schneider Electric, Synology, QNAP, Veeam, WordPress and many others. The flaws can sit inside products that bundle PHP, such as network gear and management portals, so organizations may be exposed without realizing they run PHP at all.
The fix
The PHP project released patched versions on October 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. U.S. federal agencies have until October 29 to apply them. Anyone running an older release in those lines should update, and vendors who ship PHP inside appliances or applications will need to provide their own updates, so it is worth checking those advisories too.
A related flaw: Broccoli2Shell
The article also mentions a separate vulnerability, CVE-2026-111497, nicknamed Broccoli2Shell. It is an out-of-bounds write in the Brotli decompression library that could lead to privilege escalation and unauthenticated remote code execution. Because Brotli is widely embedded, the flaw also reaches Node.js, Bun, Envoy Proxy, Istio, .NET and Python. Fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1. On October 26 the PHP Foundation released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address it. In PHP on Windows, the vulnerable decoder can be reached through the cURL extension when automatic decompression of HTTP responses is enabled. That setting is off by default, but applications and HTTP client libraries can turn it on.
What you should do
Update PHP to one of the patched versions as soon as possible, starting with internet-facing servers. Then look for PHP hidden inside other products, such as routers, NAS devices, management consoles and business software, and apply the vendor patches as they are released. Keep an eye on web server logs for unusual requests and unexpected processes, and treat any server that was exposed and unpatched during the past week as potentially compromised until you have checked it.
Final thoughts
Bugs in a core language runtime are especially dangerous because the exposure is so widespread and so hard to inventory. The practical lesson is to know where PHP, and shared libraries like Brotli, live in your environment before an emergency makes you search for them.
Comments