Skip to content
Critical PHP2Shell Vulnerabilities Exploited in the Wild

Critical PHP2Shell Vulnerabilities Exploited in the Wild

First seen 28 Oct 2026, 16:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 04:09 UTC

Two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on October 21, 2026, allowing unauthenticated remote code execution. The vulnerabilities affect PHP installations serving web requests, including popular web servers like Apache and PHP-FPM, impacting approximately 70% of websites globally. CISA added these vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, 2026, confirming active exploitation. Reports indicate over 50,000 exploit attempts and successful shell executions on honeypots. The PHP Foundation released patches for affected versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35), urging immediate updates. Organizations using older PHP versions must upgrade or apply backported fixes to mitigate risks. The urgency is heightened as attackers are actively exploiting these flaws, necessitating prompt action from administrators.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2012-05-11
CVE-2012-1823 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-13
CVE-2026-96951 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
PHP2Shell vulnerabilities disclosed
PHP announced critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, allowing remote code execution.
Threatlocker
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
Public exploit for CVE-2026-115560 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-26
CISA adds vulnerabilities to KEV catalog
CISA confirmed active exploitation of PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities list.
Marketscale
2026-10-28
Patch deadline for federal agencies
CISA set a deadline of October 29 for federal agencies to patch the PHP vulnerabilities to prevent exploitation.
IT Pro

More articles in this cluster (51)

Following this threat?

Track PHP Foundation and CVE-2012-1823 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (51)

1 / 4

Common questions

Which PHP versions are affected?
Versions prior to 8.5.12, including 8.4.27, 8.3.36, and 8.2.35, are affected.
Is there evidence of exploitation?
Yes, CISA confirmed active exploitation with over 50,000 attempts recorded.
What should organizations do now?
Organizations must immediately apply patches or upgrade to supported PHP versions to mitigate risks.