Skip to content
PHP2Shell Vulnerabilities Exploited Before Public Disclosure

PHP2Shell Vulnerabilities Exploited Before Public Disclosure

First seen 25 Oct 2026, 16:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 18:13 UTC
  • •AWS detected exploitation of PHP2Shell vulnerabilities before public disclosure.
  • •Critical vulnerabilities allow remote command execution without authentication.
  • •Emergency patches were released, but many servers remain unpatched and vulnerable.

Amazon Web Services (AWS) detected attempts of a PHP vulnerability known as PHP2Shell on October 13, 2026, four days prior to its public disclosure on October 17. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute remote commands on vulnerable servers without authentication. The PHP security team released patches on October 20, 2026, but many servers, particularly in Latin America, remain at risk due to outdated PHP versions. The rapid exploitation highlights a concerning trend where attackers can adapt exploits within hours, leveraging automated tools. The potential impact includes data theft, malware installation, and server hijacking. Organizations using PHP for web services are urged to apply patches immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
Active exploitation detected
AWS observed attempts to exploit PHP2Shell vulnerabilities in their honeypots.
Ciberseguridadlatam
2026-10-17
Public disclosure of vulnerabilities
CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, detailing critical vulnerabilities in PHP.
Kaspersky
2026-10-20
Emergency patches released
The PHP security team released patches to address the vulnerabilities identified as PHP2Shell.
Kaspersky

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What are the CVEs associated with PHP2Shell?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
How urgent is the need to patch?
Immediate action is required as exploitation is confirmed in the wild, and unpatched systems are at high risk.
What systems are affected by PHP2Shell?
Any server running PHP, particularly those with outdated versions, is at risk of exploitation.