Under imminent attack: the 'php2shell' vulnerability threatening two-thirds of the web

On the morning of October 21, 2026, system administrators across the internet received an unusual alert: the PHP security team had announced on October 20 that it would release an emergency update the following day at 14:00 UTC (10:00 AM Eastern Time, 4:00 PM Paris time) to fix two critical remote code execution (RCE) vulnerabilities in the core interpreter. The name researchers gave to the exploitation chain — php2shell — captures, without exaggeration, what's at stake: if successfully exploited, the vulnerability allows an unauthenticated attacker to take full control of the server hosting the application.

What's known — and what remains under wraps

The two flaws have been identified as CVE-2026-109618 and CVE-2026-109619. Both receive a CVSS v4.0 score of 9.2 — the official "critical" rating — as confirmed by the PHP security team in its announcement on php.net. Non-official reports, however, cite a score of 10.0, which, if confirmed, would place the vulnerability at the maximum severity level.

Tenable's research identified that the PHP security team issued an unusual advance warning, stating it could release patches even earlier if technical details leaked or if active exploitation was observed in the wild. So far, no confirmed exploitation has been reported, but Cloudflare, whose CTO Dane Knecht monitored the case on social media, indicated it was already seeing signs of emerging attacks.

According to Benjamin Harris, CEO of Israeli security firm watchTowr, which confirmed the existence of the vulnerabilities, they affect PHP branches 5, 6, 7, and 8. watchTowr stated it had reproduced CVE-2026-109618 in a controlled environment but chose to withhold technical details until patches were released.

The expected fixed versions are:

| Affected version | Expected fixed version | |---|---| | PHP 8.5.x | 8.5.12 | | PHP 8.4.x | 8.4.27 | | PHP 8.3.x | 8.3.36 | | PHP 8.2.x | 8.2.35 | | PHP 5.x to 8.1.x | No fix expected (EOL) |

The restriction of fixes to supported branches only (8.2+) is the most alarming part. According to W3Techs data, PHP is used by 69.3% of websites whose server-side language is known. Platforms like WordPress, Drupal, Joomla, Laravel, and Magento all depend on PHP. Researcher Silas Cutler estimates that more than 1.3 million internet-exposed hosts are potentially vulnerable.

Why the early leak is a problem

What distinguishes this situation from a routine security update is the premature disclosure of CVE information before coordinated disclosure. According to watchTowr, disclosure was originally scheduled for October 22 under embargo. However, CVE identifiers and vulnerability details circulated on Hacker News and social media on October 20, forcing the PHP team to advance the release.

This pattern of "leak before fix" is increasingly common in critical vulnerabilities. Once CVE identifiers are available, the security research community — and, unfortunately, malicious actors — can begin working on exploits. PHP has faced similar situations before, such as the famous Log4Shell vulnerability (though that was Java-related) and CVE-2024-4577, which allowed environment variable memory leaks.

The Session Upload Progress vulnerability

One of the most relevant details so far is researcher Kirill Firsov's mention of the exploitation chain, dubbed "php2shell" by those linked to the vulnerability's discovery. The temporary recommendation, shared by both Firsov and Japanese firm GMO Flatt Security, is to disable PHP's Session Upload Progress feature, which has been identified as the entry point for exploitation.

The `session.upload_progress.enabled` directive in the `php.ini` file can be set to `Off` to temporarily mitigate the vulnerability. However, this disables upload progress bars based on this functionality — a trade-off that server administrators need to balance between security and user experience.

Mozilla has previously studied the Session Upload Progress problem in earlier security contexts, when it discovered that the feature could be manipulated to create race conditions enabling access to sensitive resources. The accumulated experience of the security community suggests that this PHP feature has a problematic history.

What to expect in the coming hours

The exposure window is narrow. The PHP team has warned it may publish patches earlier if exploitation is observed in the wild. System administrators are urged to conduct an immediate inventory of all servers running PHP and prepare the update process.

The most delicate situation concerns hosts running EOL (end-of-life) versions of PHP — especially PHP 5 and PHP 7, which will not receive official fixes. Approximately 700,000 internet-exposed hosts run these outdated versions, according to Phoenix Security. For these servers, the only option is migration or isolation until the version is updated.

The question isn't if exploits will appear — it's when. What's expected in the coming hours is that the PHP team releases patches, which will immediately become targets for reverse engineering by researchers and, potentially, malicious actors. The global security community is on high alert.

Sources: Phoenix Security, Tenable, IT-Connect

✓ Independent sources cross-checked and verified before publishing