PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) appeared first on Unit 42 .

JPCERT/CCは、PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）についての注意喚起を公開した。悪用されると任意のコードを実行される恐れがあり、速やかな更新と侵害調査を呼び掛けている。これに加えてPHP開発元は、2026年12月31日にサポートが終了するPHP 8.2系からの移行も推奨している。

多くの日本企業を混乱の渦に巻き込んだPHP脆弱性問題。深夜のアップデート対応に追われた担当者もいることだろう。この問題はなぜ起きたのか。その背景には一朝一夕ではいかない開発者全体に関わる根深い課題があった。

Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619 . Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell. The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day. We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do . You may have safely skipped that news because you don’t run any servers — but unfortunately, the issue is not limited to businesses. Nearly 70% of websites run on PHP, including services we use every day: wikis, online stores, smart devices with web interfaces, home network-attached storage (NAS), smart-home controllers, and much more. Today, we explain how these vulnerabilities could affect you personally and what you can do to reduce the risks. How the vulnerabilities can affect home users Account and personal-data theft The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes — telling a website that the user has already signed in. As a result, an attacker may be able to access someone else’s account without entering a password or two-factor authentication code, putting messages, documents, delivery addresses, order histories, and other confidential information at risk. Loss of files on home devices If you have network-attached storage (NAS) or a video surveillance system at home that uses a vulnerable PHP version, it may also be at risk. Depending on what level of access they gain, attackers could potentially copy, delete or encrypt files they can access. Malware infection If an attacker gains access to a vulnerable website, they can use it in virtually any way they want: trick visitors into downloading a malicious file or clicking on a phishing link, display dangerous instructions, replace payment forms or login pages with malicious ones — the list goes on and on. As a result, someone visiting a legitimate website could not only lose access to their account, but also lose money or accidentally infect their device with malware. Below are examples of services directly affected by the vulnerabilities. Which services are affected by the PHP vulnerabilities Jeedom Jeedom is a smart-home platform that lets users control lighting, sensors, heating, blinds and home IoT devices. Attackers could abuse this in many ways: they could disable the alarm, track when the homeowner is away, access video from the door intercom, and more. The developers confirmed that the new vulnerability affects their application, and have already released an emergency update — Jeedom 4.6.2. Users need to run the update twice for it to work. The developers say a fully fixed version for home users will be released in the coming days. Websites we use every day As mentioned above, PHP is used by roughly 70% of websites. This doesn’t mean every one of them is vulnerable: it depends on the PHP version in use and whether the site owners have already updated it. Many government websites in Europe have already suspended operations because of the new vulnerability. Unfortunately, a website may still be vulnerable even if it appears to be working normally. An attacker could potentially take control of any legitimate website whose server hasn’t been patched yet. They could fake payment or login pages, host malicious files, or persuade users to download an “urgent update” that is actually malware. Ordinary users have no reliable way to check whether such instructions or files are safe, so be sure to use reliable anti-phishing and antivirus protection . If you suspect that your data may have been stolen, check the active sessions in your account settings. If you spot suspicious activity or devices you don’t recognize, sign out of all active sessions and change your password. Use a password manager   — it can generate a truly strong, unique password that you won’t have to memorize yourself. Computer games Bad news for gamers: some video games whose servers use PHP are also at risk. If you don’t want attackers to get hold of your accounts, be sure to update the passwords for your gaming platforms, stores and accounts. To buy time for updates, some developers temporarily took their services offline. Final Fantasy XIV , Pokemon Champions , games from Bandai Namco Entertainment, Uma Musume: Pretty Derby , Granblue Fantasy , Shadowverse: Worlds Beyond, and many others went into emergency maintenance. Nintendo Switch Online and the GOG and Steam stores were also affected . Unfortunately, there’ve also been more drastic consequences. Yesterday, the developers of World Quest announced that the game would shut down permanently after 15 years: it relied on outdated infrastructure that would have been extremely difficult and costly to fix. For the same reason, the mobile game Please Save My Pandemonium! shut down after more than ten years of operation. Home network-attached storage (NAS) “Home clouds” have become popular in recent years for good reason: many users prefer to keep backups of their data at home rather than online. A number of companies make NAS devices, and at least three — QNAP, Synology and ASUSTOR — have said the vulnerabilities affect their products. An update has also been released for Unraid , an operating system for home servers, network storage and media servers. QNAP The manufacturer confirmed that the vulnerabilities affect several versions of its NAS operating systems — QTS and QuTS hero — as well as applications including QuMagie , Note Station 3 and certain versions of QVR Surveillance . A successful attack could put photos, documents, notes and camera recordings at risk. At the time of publication of this blogpost, QNAP is still preparing updates, so the main priority is to temporarily disconnect NAS from the internet. QNAP recommends disabling port forwarding on the router — to prevent NAS from automatically opening ports — and allowing access to the management panel only from the home network or  through a VPN . Synology Both vulnerabilities have been officially confirmed in PHP packages 7.3, 7.4, and 8.0–8.4, as well as in Mail Station and Synology Calendar . Fixes have already been released for PHP, starting from version 7.4, as well as for Mail Station and Synology Calendar . PHP 7.3 won’t be fixed. The company separately notes that the PHP component built into its operating system cannot be reached from outside the device, so the risk of attack is very low. ASUSTOR ASUSTOR also officially confirmed both vulnerabilities , and immediately removed PHP 7, 7.3, 7.4, and 8.1 packages from App Central. The company recommends immediately backing up your data, removing older PHP packages, and using PHP 8.3 or 8.4. Unraid In today’s operating-system update , PHP was upgraded to version 8.4.27 with fixes for the vulnerabilities. The developers recommend that all users update to Unraid 7.3.4. Containers with their own PHP installation must be updated separately: the new PHP version in the operating system doesn’t replace PHP inside containers. At the time of publication, we haven’t found public confirmation from other major manufacturers (such as TerraMaster, UGREEN, Buffalo, or Western Digital) that their devices are affected by these vulnerabilities — only user discussions on forums. But the fact that only some NAS manufacturers have confirmed the problem so far doesn’t guarantee that your devices are safe — especially if they’re fairly old or come from a lesser-known or defunct manufacturer. In that case, first disconnect the devices from the internet while keeping them accessible only on the local network, and then investigate whether they’re vulnerable. Nextcloud cloud storage Nextcloud is a free, open-source platform for creating your own cloud storage, serving as an alternative to Google Drive, Dropbox, and Microsoft OneDrive. It lets you store and synchronize files across devices, share them with other users, and work with documents, photos, calendars and contacts. The data can be stored on your own server or NAS rather than on a third-party company’s servers. If you store important data in Nextcloud, check how your cloud instance is configured. If you use Nextcloud All-in-One , update to version 14.4.1 where the vulnerability has already been fixed. If your Nextcloud installation is configured differently, you need to update PHP yourself on the device or server. How to protect your devices and data Use phishing and malware protection . Our security solution  automatically blocks phishing pages and malware, even when attackers place them on legitimate websites. Keep an eye on updates . If you have network-attached storage, a smart-home system, a home server, a media server, or any other device with a web interface, first check the manufacturer’s website and install all available updates. If no update is available yet, temporarily disable internet access to the device. Use strong passwords . Most people reuse the same password, or variations of it, across multiple websites. If an attacker finds one of those passwords on a vulnerable server, they may be able to compromise your other accounts as well. We recommend generating and storing strong, unique passwords in Kaspersky Password Manager so you don’t have to remember your credentials yourself. Be sure to enable two-factor authentication on all important accounts — ideally using one-time codes generated by the same password manager . Keep an offline backup of important files. Don’t rely on cloud storage alone — make sure you keep a backup of all important documents on both a hard drive and an external device. For more information on how to make backups properly, see our article The internet remembers not quite everything . What other risks can your home devices face? Read our articles: Trojan TV, or the new risks of malicious proxies Ransomware now taking aim at personal backups Is your TV box renting out your network? Is your router secretly working for foreign intelligence? Three common attacks on Linux in homes How to secure your smart home

Researchers have developed a new exploit that shows how even Address Space Layout Randomization (ASLR) on an x86-64 server cannot stop the PHP2Shell vulnerability. VulnCheck, which made it available to only the company’s Initial Access Intelligence customers, also warned that threat actors are using AI to find even more ways to attack. The team told us that it’s a “significant advance” because up until now, ASLR has been a major barrier to exploiting PHP2Shell on real-world servers. They don't expect that to hold, though. “Adversaries are clearly spending time (and tokens) on this bug,” Spencer McIntyre, director of exploit development at VulnCheck, told The Register. The PHP2Shell mess grew even bigger on Thursday amid reports of attackers abusing the security flaws days before they were disclosed and UK government websites proactively going dark. Vulncheck's exploit targets CVE-2026-109618, a critical, out-of-memory corruption bug that leads to remote code execution (RCE) in PHP, and part of the PHP2Shell pair alongside CVE-2026-109619. The PHP Foundation officially disclosed and issued patches for both on Wednesday. Overnight, VulnCheck researchers developed what they believe is the first known exploit to achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration. ASLR is a built-in defense against memory-corruption bugs – like PHP2Shell – that randomly arranges memory locations of a program's key data areas. By scrambling these components live, in memory every time a program runs, ASLR prevents an attacker trying to achieve RCE from correctly guessing the target memory address – and thus prevents them from executing malicious code. While VulnCheck has seen “hundreds” of PHP2Shell proof-of-concept repositories on GitHub, “very few contain legitimate, working exploits,” McIntyre told us, adding that this is largely due to ASLR. “There's a significant difference between demonstrating a vulnerability and developing an exploit that can overcome the security protections found in real-world environments,” McIntyre said. “One of the biggest obstacles has been ASLR, a protection designed to make memory corruption vulnerabilities much harder to exploit.” The threat hunters’ new technique, we’re told, bypasses ASLR. It uses a confirmed memory leak chained into RCE on PHP 8.4.26, and they claim it works on x86-64 platforms even with ASLR enabled and PHP’s recommended display_errors=off production configuration. “We haven't identified another public or commercial exploit that achieves this under the same conditions,” McIntyre said. “Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome.” VulnCheck says it also works on ARM64, but the RCE is not currently functional on ARM-based systems. This should be a wake-up call to all organizations that, especially now in the era of AI bug hunting and exploit development, “the technical difficulty of exploiting a vulnerability shouldn't be confused with protection against it,” McIntyre said. “Organizations running vulnerable versions of PHP should prioritize patching rather than assume existing memory protections or configuration changes will stop an attack.” ®

The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. The figures were disclosed in the House of Lords on Thursday, where tech minister Baroness Lloyd of Effra outlined the disruption following the discovery of two critical flaws in PHP. "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers. "That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied." "We are working very carefully with departments to restore the services safely and securely following that remediation activity," she added. Whitehall has not published a full list of affected services, although the Office for Budget Responsibility (OBR) is among those known to have taken their websites offline, rather inconveniently with next week's Budget looming. Peers also raised reports of disruption affecting the DVLA and police services. Britain isn't alone in pulling the plug. Government websites in Germany, France, Belgium, Finland, and the Netherlands have also been taken offline as a precaution, along with Australia's own cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, although the US government has not publicly confirmed any website shutdowns. PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) warned organizations to patch immediately or consider pulling affected systems offline until they could be fixed. "The NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers," Lloyd said. Security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz separately uncovered both flaws with the help of AI tools. OpenAI then dug into the vulnerabilities itself and worked with vendors and government agencies to get the word out. The government established a cross-departmental incident response operation before public disclosure, Lloyd said. The NCSC also sent 50,000 warnings to businesses and other organizations. The disruption has spread beyond central government. Liberal Democrat peer Baroness Ludford pointed to several councils whose services had reportedly been taken offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet. She questioned why central government and local authorities remain outside the statutory duties proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday. "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," Lloyd told peers, later extending that assessment to the wider UK public sector. AWS says attackers were exploiting the flaws four days before they were publicly disclosed, while Cloudflare has since recorded millions of attempts to weaponize them. ®

Una vulnerabilità nel codice di PHP, uno dei linguaggi di programmazione più utilizzati sul web, sta provocando un’allerta internazionale, con la messa in crisi di tantissimi siti web e una corsa agli aggiornamenti di sicurezza. Con l’apporto di GPT-5.6 Sol di OpenAI la startup di cybersecurity Calif.io ha individuato una falla nel linguaggio PHP, utilizzato da gran parte dei siti web mondiali. Dopo la comunicazione e la scoperta di altre falle collegate , numerosi siti a livello globale, tanti in Europa di carattere governativo – sono rimasti irraggiungibili. In poche ore, Pubbliche Amministrazioni e operatori digitali sono dovuti intervenire rapidamente per proteggere i propri sistemi, anche rendendo temporaneamente offline i servizi. “ Le vulnerabilità, identificate con i codici CVE-2026-109618 e CVE-2026-109619 , potrebbero consentire agli aggressori di eseguire in remoto codice dannoso sui server vulnerabili senza autenticazione “, ha sottolineato l’ Enisa . Gli sviluppatori di PHP hanno poi pubblicato aggiornamenti di sicurezza urgenti, invitando tutti gli utenti ad applicarli immediatamente. Nel frattempo, diverse aziende tecnologiche hanno segnalato tentativi di sfruttamento delle vulnerabilità, alimentando i timori di una rapida diffusione degli attacchi. La NSA e autorità cyber di diversi Paesi hanno chiesto di applicare immediatamente la patch . L’importanza dell’AI nella scoperta L’aspetto più preoccupante, sottolinea la Reuters , è che le falle erano rimaste nascoste nel codice per anni. Secondo alcuni analisti, per più di un decennio. Senza l’ impiego dell’AI la scoperta non sarebbe mai avvenuta. E il problema è che PHP è alla base di una parte molto grande del web. Lo sfruttano, direttamente o indirettament,e piattaforme come WordPress, Drupal, Joomla e Magento , ma anche servizi di hosting, pannelli di controllo e numerosi software. Oltre alla patch , gli stessi sviluppatori di PHP hanno successivamente creato un gruppo di lavoro insieme a Calif.io, OpenAI, Google e altri soggetti per sviluppare una soluzione. Le minacce potenziali si moltiplicano Secondo gli analisti di Wiz , citati da The Information , le vulnerabilità potrebbero mettere a rischio fino al 70% dei siti web mondiali. Bisogna per questo applicare gli aggiornamenti rapidamenti. Gli esperti le hanno addiritturadefinite “ le vulnerabilità più gravi mai scoperte dall’AI, se non tra le più gravi nella storia del software ”. La priorità immediata per aziende, Pubbliche Amministrazioni e gestori di siti è quindi verificare rapidamente la versione di PHP utilizzata. In caso non si trattasse dell’ultima, dovranno quindi installare gli aggiornamenti messi a disposizione dagli sviluppatori. In caso contrario i pericoli possono moltiplicarsi. Le falle potrebbero infatti consentire, in determinate configurazioni, attacchi di Remote Code Execution. Un criminale informatico potrebbe cioè eseguire codice a distanza sul server compromesso, con la possibilità di installare malware, accedere ai database o intervenire sui file del sistema. Seguici anche sul nostro canale WhatsApp Vai al sito di Cybersecurity Italia. L'articolo PHP, OpenAI scopre una falla che mette al rischio fino al 70% dei siti a livello globale sembra essere il primo su CyberSecurity Italia .

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities: RCE via OOM corruption, CVE-2026-109618 ( GHSA-w8hw-w9fx-j79w ): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. RCE via stale global state, CVE-2026-109619 ( GHSA-6wmf-4rv5-p3rp ): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. Updating PHP is the only way to regain security. Do it now. More news . Good explanations .

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek .

Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That figure jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions. And the attackers aren't simply recycling the same exploit. Cloudflare said it has seen miscreants tweaking their payloads in an attempt to sneak past its web application firewall (WAF) protections, apparently using feedback from blocked requests to work out what might get through. Security outfit Hadrian also sounded the alarm on October 21, reporting that PHP2Shell was being "exploited in the wild at scale." "Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships," the company warned. More worrying, some attackers appear to have started before the vulnerabilities were even public knowledge. Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released. The activity was picked up by MadPot, Amazon's network of honeypots designed to lure attackers and record what they get up to. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said. The retail and cloud giant said it detected multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC, some 12 hours before the patches were released. Over the following six hours, further attempts arrived from different anonymized infrastructure, using a variety of payloads. Amazon reckons this points to multiple attackers rather than a single group. Whether any of those attempts would have worked against real-world systems remains unclear. The findings add another layer to an already messy disclosure. As The Register reported on Wednesday, the PHP Foundation has accused supply-chain security vendor Chainguard of putting websites at risk by publishing patched PHP builds before the agreed disclosure deadline. However, Amazon's October 17 detection suggests at least one cybercrim was already trying to exploit the bugs days before that incident. The vulnerabilities themselves are particularly nasty. Both carry a critical 9.2 severity rating and affect PHP's handling of memory, potentially allowing unauthenticated attackers to execute malicious code on vulnerable servers. Unlike flaws in individual plugins or applications, these bugs affect the PHP runtime itself, putting a potentially enormous number of websites at risk regardless of which content management system they use. Cloudflare says it has deployed WAF protections across its free and paid plans, although it has stressed that these are no substitute for patching. With attackers already trying their luck before the fixes were available, admins may have more than just a patching backlog to worry about. Amazon is advising organizations to investigate suspicious activity dating back to at least October 17, rather than assuming their systems were safe until the vulnerabilities became public. ®

Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. If you run PHP behind a web server, you need to … More → The post New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 appeared first on Help Net Security .

Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet. Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product so far: Fortinet is checking 12 products, Cisco 31 products and cloud services. Palo Alto says the … More → The post What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers appeared first on Help Net Security .

Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities

PHP脆弱性がこれほどまでに世間を騒がせたのは、その緊急性はもちろん、本来伏せておくべきだった情報の先出しが影響している。開発プロジェクトを支援するThe PHP Foundation（PHP財団）が経緯を公開した。

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network,

Il 20 ottobre 2026, il team di sicurezza di PHP ha pubblicato un avviso preliminare relativo a un rilascio di emergenza imminente, volto a risolvere due vulnerabilità critiche (entrambe con un punteggio CVSS di 9.2 ). Le patch sono state rilasciate mercoledì 21 ottobre 2026. Il rilascio è stato accelerato dopo che informazioni sulle vulnerabilità sono trapelate pubblicamente. In un post su Hacker News, un utente ha segnalato due falle di esecuzione di codice remoto (RCE) in PHP, che presumibilmente interessavano tutte le versioni a partire dalla 5.4.0. Le vulnerabilità in questione sono CVE-2026-109618 e CVE-2026-109619 . Al momento della pubblicazione, erano riservate ma non divulgate. Poco dopo la comparsa dell’articolo, i ricercprendilo hanno confermato l’esistenza delle vulnerabilità. Insieme ai dettagli trapelati, è apparso online un exploit ufficiosamente soprannominato PHP2Shell . Un video dimostrativo trapelato mostra l’ exploit in azione su server web che utilizzano WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal e WHMCS , che alimentano molti siti web moderni. L’autenticità della demo e il comportamento esatto dell’exploit non sono stati confermati in modo indipendente al momento della pubblicazione. Secondo il ricercatore che ha pubblicato il PoC , le vulnerabilità sono legate alla gestione del tipo multipart/form-data insieme al meccanismo di caricamento dell’avanzamento della sessione.  Le vulnerabilità si trovano nel core di PHP e rientrano nelle categorie Use-After-Free e corruzione della memoria . Ciò significa che le falle non possono essere corrette tramite codice applicativo: la soluzione è possibile solo aggiornando PHP sul server. L’attacco funziona senza autenticazione: un utente malintenzionato con accesso di rete a un’applicazione PHP può eseguire codice arbitrario per conto del processo PHP senza richiedere autorizzazione. Gli avvisi di sicurezza pubblicati da PHP il 21 ottobre confermano queste informazioni. Le vulnerabilità interessano le versioni 5, 6, 7 e 8 di PHP . Al momento della pubblicazione, sono supportate le versioni dalla 8.2 alla 8.5 . Le versioni precedenti, tra cui PHP 8.1, 8.0, 7.x e 5.x, hanno raggiunto la fine del ciclo di vita. Tuttavia, data l’elevata gravità delle vulnerabilità, sono state rilasciate patch di backport anche per le versioni 7.4, 8.0 e 8.1. Nel frattempo, il ricercatore di sicurezza informatica Kirill Firsov ha pubblicato un video con la dimostrazione dell’exploit PHP2Shell. S econdo i suoi dati, gli autori dell’exploit e del video sono i ricercatori lcfr_hax e calif_io. Nel video, PHP2Shell esegue codice su server di test con WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal e WHMCS. Inoltre, i giornalisti di Ars Technica menzionano un rapporto non confermato sul problema PHP2Shell apparso in rete, di cui non sono riusciti a trovare l’originale. Gli esperti di Sansec si aspettano che attacchi su larga scala alle nuove vulnerabilità di PHP possano iniziare già 15 minuti dopo il rilascio delle patch. Inoltre, gli amministratori sono invitati a prepararsi in anticipo per l’aggiornamento dagli esperti delle aziende Wordfence e Huntress , che hanno già emesso avvertimenti separati su PHP2Shell. Si consiglia agli amministratori di preparare in anticipo un elenco di applicazioni PHP e server, di creare backup dei siti e dei database e di pianificare l’aggiornamento immediatamente dopo il rilascio delle patch. Raccomandiamo vivamente agli amministratori responsabili dei server web PHP accessibili pubblicamente di adottare le seguenti misure prima del rilascio della patch: Eseguire un inventario di tutti i sistemi che utilizzano PHP nell’infrastruttura (inclusi server web, pannelli di controllo, software di terze parti, ecc.). Disabilitare l’avanzamento del caricamento:session.upload_progress.enabled = Offcon l’aiuto diflag_amministratore_phpnei pool PHP-FPM. Bloccare le richieste multipart sui server nginx e Apache. Si consiglia di isolare temporaneamente le applicazioni PHP esposte a Internet fino al rilascio delle correzioni. Assicurarsi che la patch sia pronta per l’installazione immediata non appena viene pubblicata. Pianificare la migrazione al ramo PHP corrente per i server con versioni non supportate (8.1 e precedenti). L'articolo PHP2Shell è allarme PHP! Due falle critiche aprono la strada agli hacker nei server web di tutto il mondo proviene da Red Hot Cyber .

October 22, 2026: We updated this post to add the AWS WAF PHP application managed rule group. Version 2.3 of the rule group adds the PHP2Shell_BODY rule for CVE-2026-109619, and AWS made it the default version. On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 (Critical) under CVSS v4.0, and both allow an unauthenticated attacker to run code on a vulnerable server. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Patching is the only complete fix, and you should upgrade PHP as your first priority. But patching a fleet takes time: you need to inventory where PHP runs, schedule maintenance windows and test applications against the new builds. This post shows you how to use AWS Web Application Firewall ( AWS WAF ) to help reduce your exposure during that window. The simplest step is an AWS managed rule. AWS released version 2.3 of the AWS WAF PHP application managed rule group, which adds the PHP2Shell_BODY rule for CVE-2026-109619. AWS also promoted version 2.3 to the default version globally. If your protection pack (web ACL) already uses this rule group at the default version, the rule is already active. This post shows you how to confirm that and how to add the rule group if you don’t use it yet. It also covers the custom rules that still add defense in depth. It also explains where AWS WAF protection ends, so you don’t develop a false sense of safety. For how Amazon threat intelligence detected PHP2Shell exploitation before public disclosure, see Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot . For AWS service status and the AWS WAF rule that AWS recommends, see AWS Security Bulletin 2026-143-AWS . IMPORTANT: Patching is the only complete fix, and you should upgrade PHP as your first priority. The vulnerabilities in brief Both PHP2Shell vulnerabilities are unauthenticated RCE issues rooted in how PHP handles multipart/form-data request processing (the request format browsers use for file uploads) before your application code runs, which is why the AWS WAF rules in this post focus on multipart traffic, request body size, and the session upload progress field. At a high level, CVE-2026-109618 corrupts memory when PHP runs out of memory mid-request, and CVE-2026-109619 lets one request leave behind stale data that a later request on the same worker process reuses. For the root-cause analysis, affected versions, and PHP’s own guidance, see the official PHP advisories and release announcement: CVE-2026-109618 (out-of-memory corruption) – PHP advisory GHSA-w8hw-w9fx-j79w CVE-2026-109619 (stale global state) – PHP advisory GHSA-6wmf-4rv5-p3rp PHP security release announcement, October 21, 2026 Where AWS WAF fits in your response AWS WAF is a defense-in-depth control in this situation, not a replacement for the PHP upgrade. The PHP advisories are explicit: updating to a patched release is the only complete mitigation. One of the two vulnerabilities is largely outside the reach of any web application firewall, as explained later. Treat the managed rules and the custom rules in this post as mitigating controls that help reduce exposure while you patch, then remove them or keep them as supporting controls after you’ve patched. AWS WAF inspects HTTP requests at the edge. It doesn’t parse the internal structure of a multipart body, and it has no visibility into PHP worker memory or server-side configuration. The following table maps each attack element to whether AWS WAF can help mitigate it. Attack element AWS WAF coverage Request patterns that match CVE-2026-109619 Yes. The PHP2Shell_BODY rule in the PHP application managed rule group, version 2.3 or later. Session upload progress field in a multipart POST ( PHP_SESSION_UPLOAD_PROGRESS , the form field that turns on PHP’s upload-tracking feature) Yes. The custom rule in this post blocks requests that carry that field. Multipart upload path ( multipart/form-data , the request type used for file uploads and the entry point for both vulnerabilities) Yes, if the application has no legitimate multipart uploads. Block multipart/form-data. Out-of-memory condition from an oversized body Partial. Cap the request body size with the Core rule set SizeRestrictions_BODY rule or a custom rule. Neither catches header amplification (many small part headers that cost far more memory to represent than their size on the wire) that stays under the cap. Repeated attempts against the same worker (the reused PHP process that handles many requests) Partial. A rate-based rule reduces the volume an exploit needs, but it doesn’t stop a single successful request. fatal_error_backtraces producer (a PHP 8.5 setting that stores crash-trace state across a request) No. This is a server configuration setting ( fatal_error_backtraces=0 ). Invalid or deprecated INI diagnostics as a consumer (warnings PHP raises when applying bad configuration settings) No. This path runs server-side, not over client HTTP. Where an application does not accept multipart uploads, an edge rule that blocks multipart/form-data removes the multipart out-of-memory path that works against any application, plus the session-upload-progress trigger, which is a defense-in-depth control during the patch window. If your application does use multipart uploads, AWS WAF reduces risk but does not close the vulnerability, because header amplification (a few kilobytes of part headers that expand into far more memory inside PHP) stays within size limits and the firewall cannot parse the headers inside individual body parts. In that case, prioritize the PHP upgrade and apply the server-side mitigations described later. Start with the AWS WAF PHP application managed rule group The PHP application managed rule group ( AWSManagedRulesPHPRuleSet ) contains rules that block request patterns associated with the exploitation of vulnerabilities specific to PHP. Version 2.3, released on October 21, 2026, adds the PHP2Shell_BODY rule. The rule inspects the request body for requests that match CVE-2026-109619, and its default action is Block. The AWS WAF documentation describes the rule group as containing a virtual patch for CVE-2026-109619 that helps protect your application until you patch it. The rule group uses 100 web ACL capacity units (WCUs). Like the other AWS managed baseline and use-case rule groups, it has no charge beyond standard AWS WAF pricing. What you need to do depends on how your web ACL uses the rule group: You use the default version. AWS moved the default version to Version_2.3 , so PHP2Shell_BODY is already evaluating your traffic. Confirm that you haven’t overridden the whole rule group to Count, and review your AWS WAF logs for matches. You pin a static version. Your web ACL doesn’t have PHP2Shell_BODY until you change the version to Version_2.3 . AWS recommends that you keep static versions as close as you can to the latest version. You don’t use the rule group yet. Add it to the web ACL in front of each PHP workload, as shown in the following example. To see the current default version and the version that a web ACL uses, run the following commands. Both are read-only. aws wafv2 list-available-managed-rule-group-versions \ --vendor-name AWS --name AWSManagedRulesPHPRuleSet --scope REGIONAL aws wafv2 get-web-acl --name <web-acl-name> --id <web-acl-id> --scope REGIONAL \ --query "WebACL.Rules[?Statement.ManagedRuleGroupStatement.Name=='AWSManagedRulesPHPRuleSet']" For web ACLs associated with Amazon CloudFront, use --scope CLOUDFRONT and the US East (N. Virginia) Region. A rule without a Version field uses the default version. The following rule adds the rule group at the default version. The RuleActionOverrides entry sets PHP2Shell_BODY to Count so you can review its matches before it blocks. Remove the override when you’re satisfied. Given how quickly exploitation followed disclosure, measure that review period in hours, not days. To pin the rule group instead, add "Version": "Version_2.3" to the ManagedRuleGroupStatement . { "Name": "AWS-AWSManagedRulesPHPRuleSet", "Priority": 0, "Statement": { "ManagedRuleGroupStatement": { "VendorName": "AWS", "Name": "AWSManagedRulesPHPRuleSet", "RuleActionOverrides": [ { "Name": "PHP2Shell_BODY", "ActionToUse": { "Count": {} } } ] } }, "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AWS-AWSManagedRulesPHPRuleSet" } } If PHP2Shell_BODY matches legitimate requests, keep the rule in Count and add a label-based exception after the rule group. The rule group adds the label awswaf:managed:aws:php-app:PHP2Shell_Body to requests that match the rule, and the following rule blocks those requests everywhere except one path. Requests to the excluded path aren’t protected by this rule, so keep the exception as narrow as you can and patch that application first. Labels are case sensitive: confirm the label name in the rule group’s available labels (the DescribeManagedRuleGroup API) before you deploy. For the full pattern, see Creating exceptions in the AWS WAF best practices guide . { "Name": "PHP2Shell-Body-Exception", "Priority": 1, "Action": { "Block": {} }, "Statement": { "AndStatement": { "Statements": [ { "LabelMatchStatement": { "Scope": "LABEL", "Key": "awswaf:managed:aws:php-app:PHP2Shell_Body" } }, { "NotStatement": { "Statement": { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "PositionalConstraint": "STARTS_WITH", "SearchString": "/path/to/legitimate-upload", "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } } } } ] } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellBodyException" } } You can also return a web ACL to Version_2.2 while you tune, but that version doesn’t include PHP2Shell_BODY . Treat a rollback as removing the CVE-2026-109619 protection, and prefer the Count override and exception. Two limits apply to the managed rule. First, PHP2Shell_BODY inspects the request body only up to the web ACL body inspection limit. That limit is 8 KB on Application Load Balancer and AWS AppSync. On AWS services such as CloudFront and Amazon API Gateway it is 16 KB by default and up to 64 KB. The rule uses the Continue option for content beyond that limit, so pair it with a body size rule. Second, the PHP application rule group doesn’t target CVE-2026-109618. For that CVE, AWS recommends the SizeRestrictions_BODY rule in the Core rule set ( AWSManagedRulesCommonRuleSet ), which blocks request bodies over 8 KB (8,192 bytes). If you set that rule to Count because of upload paths, use a label-based exception scoped to those paths instead. That keeps the rule in Block everywhere else. Additional WAF Rules to consider The managed rule groups cover two of the rules in this section. PHP2Shell_BODY in the PHP application rule group covers CVE-2026-109619. That is the same CVE as the custom rule from the security bulletin. SizeRestrictions_BODY in the Core rule set caps request bodies at 8 KB for CVE-2026-109618. No AWS managed rule group blocks all multipart requests or rate-limits POST requests, so those two rules remain custom. Use them where they fit your application. The following rules are in AWS WAF JSON format. Add each one to the protection pack (web ACL) associated with the CloudFront distribution, Application Load Balancer, or API Gateway stage in front of your PHP workloads. Adjust the priorities to fit your web ACL. The AWS WAF best practices guide describes a recommended rule order, with managed rule groups before the label-based exceptions that depend on them. IMPORTANT: Before you change anything, turn on AWS WAF logging so you can see what each rule matches. Start every rule in Count mode, confirm it doesn’t match legitimate traffic, then switch to Block. Request body inspection limits AWS WAF inspects a bounded portion of the request body. On Application Load Balancer and AWS AppSync, the limit is a fixed 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB, and you can raise it to 32, 48, or 64 KB through the web ACL AssociationConfig , as shown in the following example. Any part of the body beyond the inspection limit counts as oversize. Choose the limit that fits the rules you deploy, because a body size rule can only enforce a cap up to the inspected size. aws wafv2 update-web-acl ... --association-config \ 'RequestBody={CLOUDFRONT={DefaultSizeInspectionLimit=KB_64}}' Custom rule for CVE-2026-109619 (if you can’t use the managed rule group) Use this custom rule from the AWS security bulletin if you would prefer to use a custom rule instead of a managed rule group. It targets CVE-2026-109619 and blocks a request only when all three conditions in its AndStatement are true at once: The method is exactly POST , matched on the HTTP method with no transformation. A PHP session identifier is present (the nested OrStatement , so either sub-condition satisfies this leg): PHPSESSID appears as a cookie key (exact match on the key, scanning all cookies), or PHPSESSID appears anywhere in the request body (contains match). The body contains PHP_SESSION_UPLOAD_PROGRESS , the form field that activates PHP’s session upload progress feature. Pair the rule with session.upload_progress.enabled=0 on the server, which turns the feature off. This is the rule from the AWS security bulletin with the action set to Count. Change it to Block after you confirm it doesn’t match legitimate traffic. { "Name": "PHP2Shell", "Priority": 0, "Statement": { "AndStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "POST", "FieldToMatch": { "Method": {} }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "OrStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, { "ByteMatchStatement": { "SearchString": "PHP_SESSION_UPLOAD_PROGRESS", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, "Action": { "Count": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2Shell" } } Block multipart requests when the application has no uploads NOTE: This rule, in Block mode, breaks applications that require file uploads. If your application doesn’t require file uploads, blocking removes the multipart out-of-memory path that works against any application for both CVEs at the edge. AWS WAF inspects a single named header in full, with no 8 KB header limit, so matching the Content-Type header is reliable. { "Name": "Block-Multipart-FormData", "Priority": 1, "Action": { "Count": {} }, "Statement": { "ByteMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "content-type" } }, "PositionalConstraint": "CONTAINS", "SearchString": "multipart/form-data", "TextTransformations": [ { "Priority": 0, "Type": "LOWERCASE" } ] } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellBlockMultipart" } } Cap the request body size Capping body size reduces the out-of-memory condition behind CVE-2026-109618 and the stale state it can leave behind. It also covers request bodies larger than the inspection limit, which body-inspecting rules such as PHP2Shell_BODY evaluate only in part. If you use the Core rule set, its SizeRestrictions_BODY rule blocks bodies over 8 KB by default. The AWS security bulletin recommends that rule for CVE-2026-109618. Use the following custom rule when you need a different threshold or don’t use the Core rule set. It uses OversizeHandling: MATCH with a size constraint so that any body larger than the threshold is blocked, including bodies that exceed the inspection limit. To enforce a cap of N bytes, the web ACL body inspection limit must be at least N. Note that you can’t cap the numeric Content-Length with a size constraint, because the constraint measures the length of the header value string, not the number it contains. If your application has legitimate large uploads, scope this rule to non-upload paths with an AndStatement on the URI path, or it will break those uploads. { "Name": "Block-Oversize-Body", "Priority": 2, "Action": { "Count": {} }, "Statement": { "SizeConstraintStatement": { "FieldToMatch": { "Body": { "OversizeHandling": "MATCH" } }, "ComparisonOperator": "GT", "Size": 8192, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellBlockOversizeBody" } } NOTE: If a specific managed rule breaks legitimate traffic, override that rule to Count rather than disabling the whole group. Rate-limit repeated attempts A rate-based rule on POST requests limits how many requests one IP address can send. That lowers the chance of triggering either vulnerability through volume. It also makes the stale-state path harder, because that path needs a producer request and a consumer request to land on the same worker. Set the limit from your normal per-IP POST rate; 100 requests per 60 seconds is a starting point. This rule complements a server setting of pm.max_requests=1 , which recycles the worker on each request. { "Name": "RateLimit-Posts", "Priority": 3, "Action": { "Count": {} }, "Statement": { "RateBasedStatement": { "Limit": 100, "EvaluationWindowSec": 60, "AggregateKeyType": "IP", "ScopeDownStatement": { "ByteMatchStatement": { "FieldToMatch": { "Method": {} }, "PositionalConstraint": "EXACTLY", "SearchString": "POST", "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } } } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellRateLimitPosts" } } Server-side mitigations that complement AWS WAF These host and runtime changes address the parts of CVE-2026-109619 that sit below the HTTP layer a WAF inspects, so they fall outside its scope by design. Apply them alongside the AWS WAF rules as the host and runtime layer of your defense. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. This is the only complete fix. PHP 8.1 and earlier are no longer supported upstream, so check with your distribution or long-term support vendor for a backported fix, or plan a move to a supported branch. Address CVE-2026-109618 at the PHP level. Set memory_limit=-1 so applications cannot override it, and keep post_max_size low (8M where the application accepts no uploads, 32M where it does). Enforce memory bounds through container or cgroup limits, never through RLIMIT_AS or RLIMIT_DATA , which trigger the vulnerable out-of-memory path. Set fatal_error_backtraces=0 on PHP 8.5 and restart every worker. This disables the setting that stores crash-trace state across a request, one of the confirmed ways the vulnerability is triggered. Set session.upload_progress.enabled=0 and restart every worker. This turns off the upload-tracking feature that’s the other confirmed trigger, and is prudent to keep off even after patching. Prefer php.ini , FPM pool, or server startup configuration over per-request INI overrides (settings applied per request through .htaccess , php_value , or FastCGI PHP_VALUE) . Remove obsolete directives so they don’t raise diagnostic warnings. Eliminate fatal errors and execution timeouts on attacker-reachable routes, including upload, import, error-page, shutdown, serialization, and extension paths. Set pm.max_requests=1 if performance allows , so each worker process is recycled after one request, which breaks the link between the request that plants stale data and a later request that would reuse it. Turn on error logging ( log_errors=On , a working error_log , error_reporting=E_ALL ) and review your Apache, FPM, or proxy logs for repeated warnings, deprecations, fatal errors, and timeouts on attacker-controlled routes. The absence of errors is not proof of safety. Getting started Complete the following steps to get started: Inventory where PHP runs and which versions and server APIs (mod_php, FPM, FrankenPHP, LSAPI) are in use. Identify any public endpoint that accepts a request body. Check the web ACL in front of each PHP workload. If it uses the PHP application rule group at the default version, PHP2Shell_BODY is already active. If it pins a static version, change it to Version_2.3 . Add the PHP application rule group and the Core rule set where they’re missing. Then decide whether each application uses multipart uploads, which determines whether you can add the rule that blocks multipart requests. Add the applicable custom rules in Count mode. Raise the body inspection limit on CloudFront or API Gateway if a rule needs it. Watch the sampled requests and Amazon CloudWatch metrics for each rule. Confirm that legitimate uploads and large JSON POSTs aren’t matched. Switch the rules to Block after the metrics are clean. Test the custom rules with a benign multipart/form-data POST, an oversized body, and a POST request that has a PHPSESSID cookie and PHP_SESSION_UPLOAD_PROGRESS in the body. After you switch to Block, expect a 403 response and the matching rule metric. In parallel, apply the PHP upgrade and the configuration mitigations. Remove or retain the AWS WAF rules as supporting controls after your fleet is patched. Conclusion The PHP2Shell vulnerabilities—CVE-2026-109618 and CVE-2026-109619—are unauthenticated RCE vulnerabilities that reach PHP before your application code runs. AWS WAF gives you a way to help narrow the attack surface during the patch window. Turn on the PHP application managed rule group at version 2.3 or later and the Core rule set. Then add the custom controls that fit your application: block multipart requests where no uploads are expected, cap request body size, and rate-limit repeated attempts. These mitigating controls can help reduce exposure, but they don’t close the vulnerabilities. Upgrade PHP to a fixed release, apply the server configuration changes, and treat AWS WAF as the edge layer that supports those fixes rather than the fix itself. To learn more, see the PHP application managed rule group and the AWS Managed Rules changelog , managed rule group versioning , the web ACL body inspection limit , oversize request component handling , and the AWS re:Post article on handling oversize HTTP request bodies . For tuning and exceptions, see the AWS WAF best practices guide . For the vulnerability details, see the PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp , and the PHP session upload progress manual . Alex Waddell Alex Waddell is a Principal Solutions Architect at AWS specializing in security within the Worldwide Specialist Organization, based in Scotland. Alex has been working in the security domain since 1999 and joined AWS in 2021 to work with customers across EMEA on cloud security architecture, identity, threat detection and application security. When he is not working, Alex enjoys spending time sampling rum from around the world (Alex is one of those rarely found Scottish people that doesn’t like whisky), walking his dogs in the local forest trails and traveling. Lawton Pittenger Lawton is a Worldwide Security Specialist Solutions Architect at AWS, based in New York City. He specializes in helping customers design and implement effective network security controls. At AWS, he works with customers at scale and collaborates closely with service teams to drive continuous improvement in security services based on customer needs and feedback. Outside of work, his interests include skateboarding, snowboarding, and spending time in nature. Ian Olson Ian is a Senior Security Specialist Solutions Architect at AWS. He helps customers automate security services to safeguard against threats like DDoS and web exploitations. Through intelligent automation, he delivers security solutions tailored to organizations of any scale. When he’s not working, Ian enjoys spending quality time with his two young children.

PHP developers have accused software supply chain security shop Chainguard of effectively revealing critical bugs in the open-source scripting language ahead of a planned official disclosure. On Wednesday, just hours after releasing emergency patches for the two bugs collectively called PHP2shell, PHP maintainers published a blog about how the vulnerabilities were found and fixed. They credited researchers at Calif, OpenAI, and Wiz with finding the security holes between August and September. All three companies have said they used AI models to find the vulnerabilities, which are now tracked as CVE-2026-109618 and CVE-2026-109619, and can allow an unauthenticated attacker to execute code on servers running PHP. This is especially serious because PHP powers huge chunks of the public web. It also adds a dose of irony to the “leak and disrupted disclosure” part of the blog, which blames Chainguard - a company that aims to secure software supply chains by hardening open source code - for the messy disclosure. The trouble, according to PHP developers, started on Tuesday around 15:00 UTC, when “two CVE IDs began circulating on online forums and social media,” along with incorrect information about the release time and CVSS severity rating. At that point, no technical details leaked. The rumors, however, prompted PHP maintainers to warn people in advance about the critical flaws, and move the planned disclosure forward a day, from Thursday to Wednesday. “Distributors were still packaging the fix, so releasing immediately would have left many users without an easy way to update,” the PHP Foundation blog says. “Moving the release forward by one day was the best compromise between acting quickly, giving people time to prepare, and making sure everyone had a simple update path when the vulnerabilities were disclosed.” A couple of hours later, Calif “mistakenly” published a video showing a proof-of-concept exploit and “additional, though limited” information about the bugs, we’re told. “Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well,” the PHP blog says, but it does not name these providers. And then it throws Chainguard under the bus: “On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.” Chainguard CEO: 'We made the call' Chainguard CEO Dan Lorenc spoke with The Register on Wednesday, and while he doesn’t dispute the timeline, said his company "didn't leak." “These things are messy,” Lorenc said. Chainguard learned “something was coming in PHP” on Friday from one of the researchers that found the bugs, Lorenc told us. Later that night, using his company’s AI harness and a frontier model, the CEO and the Chainguard team independently found the same memory corruption vulnerabilities. All it took was a “basic prompt of ‘find bad vulnerabilities in PHP,’” Lorenc wrote in a subsequent LinkedIn post. On Saturday, Chainguard began working with the PHP maintainers, confirmed that some of its findings matched the bug reports, and helped test the patches. “The patches are crazy - this is not a simple vulnerability,” Lorenc told The Register. “It really did take them months to build a real, working patch for it. And then on Monday, the rumors started, and yesterday it just spiraled.” Some people published POCs on social media, other security vendors reported seeing real-world exploitation, and late Tuesday night Lorenc told us he decided to ship the fixes, and notified the PHP coordinated disclosure channel about his plans. “People were getting hit in advance” of the official PHP disclosure, “so we made the call to ship the fixes under that,” Lorenc said. “It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild.” Also on Tuesday night, Chainguard published built artifacts and made them accessible to anyone, not just customers. “And then I woke up this morning and saw that this was all our fault,” Lorenc said. When asked if he would do anything differently, given the fallout from Chainguard’s early disclosure, Lorenc said no. “This process and policy is based on trying to coordinate as much as possible until shit hits the fan and people start weaponizing things,” he said. “It sucks, because we really are all on one team, and there's bad guys over there doing stuff.” Chainguard’s honeypots trapped IPs from China and Russia targeting the vulnerabilities on Wednesday, Lorenc added. “Just being told there's a vulnerability in a piece of software - even something as big as PHP - is enough to find it,” he told us. “I did that myself without any other knowledge on Friday." "I think this is kind of the new normal. People are able to build an exploit in hours without even knowing what the vulnerability is." What we know about the CVEs and how to exploit them While we still don’t know the scope of exploitation - or what will happen to vulnerable legacy systems that don’t have security fixes - threat hunters predict it’s going to be a doozy. “Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them,” Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz warned on Wednesday, adding the oft-quoted stat that PHP powers 70 percent of all websites in the world. “Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4,” the Wiz kids wrote. “Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.” Both bugs are related to how PHP handles memory management and error handling, and both lead to remote code execution (RCE). They can cause a corrupted internal PHP state when a request ends unexpectedly, and then a later request can reuse that state, leading to memory disclosure or RCE. “Both are memory corruption vulnerabilities,” VulnCheck researcher Patrick Garrity explained. “If an attacker can shape the memory PHP trusts, they can potentially hijack what it does next, and in these cases that means remote code execution.” CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) leads to RCE via out-of-memory corruption. “If a request reached PHP's memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory,” the project maintainer wrote. “On Apache with mod_php, an unauthenticated request can trigger this before any application code runs.” CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) allows RCE via stale state. “A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request,” according to the PGP Foundation. “A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.”®

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure. The PHP embargo window was set to be lifted on 2026-10-21 1400 UTC. On the day of the release, Amazon Threat Intelligence identified multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC. Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence identified additional exploitation attempts of PHP2Shell targeting MadPot from additional anonymized infrastructure. The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems. The actual release of the embargo window was 2026-10-21 1400 UTC. Once the embargo was lifted and the patch was released, additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild. Two lessons from this event apply well beyond this one vulnerability: An embargo protects defenders only until someone else finds the same bug. Coordinated disclosure is still the right model. But defenders should not assume the public disclosure date is the earliest date of exploitation. With PHP2Shell, compromise may predate the advisory. The time from patch to working exploit is shrinking for structural reasons. In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them. That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed. For security leaders, this changes several working assumptions: For critical vulnerabilities in internet-facing systems, measure patch and mitigation timelines in hours. A 7-day or 30-day SLA assumes a delay that no longer exists. Start investigations from the earliest known exploitation, not from the disclosure date. For PHP2Shell, investigate from at least starting on October 17th. Invest in detections that don’t rely on a signature for a specific CVE. The first exploitation will often come before those signatures exist. How AWS helps protect customers AWS deploys multiple layers of protection to help safeguard customers. Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability. We analyze over 200 billion events per minute and integrate threat intelligence from our MadPot honeypot network to identify and block known exploitation attempts in real time. Our honeypot system provides us with early detection of exploitation attempts, enabling rapid response and threat analysis. Immediate recommended actions Upgrade immediately to the fixed PHP versions. Upgrading is the only complete remediation for both CVE-2026-109618 and CVE-2026-109619. There are no configuration-only workarounds that fully address both issues. Consider blocking multi-part file uploads in PHP deployments that cannot be patched immediately, but determine how this would affect your application prior to deploying. Look for POST requests with the PHP_SESSION_UPLOAD_PROGRESS string in form uploads. Review web server logs for suspicious activity. Check for unexpected process execution or file modification on web application servers. Indicators of Compromise (IOCs) IP Address Observed Date 103.216.220.92 10/17/2026 31.223.184.166 10/21/2026 37.19.200.5 10/21/2026 134.209.159.64 10/21/2026 103.114.163.188 10/21/2026 95.217.98.37 10/21/2026 The identified IP addresses include shared anonymization infrastructure and are not exclusive to this threat activity. Organizations should investigate any observations involving these addresses as opposed to blocking. See how to use AWS Web Application Firewall to help reduce your exposure while you patch in our blog post Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) . If you have questions, start a new thread on AWS re:Post or reach out to AWS Support . CJ Moses CJ Moses is the CISO of Amazon Integrated Security. In his role, CJ leads security engineering and operations across Amazon. His mission is to enable Amazon businesses by making the benefits of security the path of least resistance. CJ joined Amazon in December 2007, holding various roles including Consumer CISO, and most recently AWS CISO, before becoming CISO of Amazon Integrated Security September of 2023. Prior to joining Amazon, CJ led the technical analysis of computer and network intrusion efforts at the Federal Bureau of Investigation’s Cyber Division. CJ also served as a Special Agent with the Air Force Office of Special Investigations (AFOSI). CJ led several computer intrusion investigations seen as foundational to the security industry today. CJ holds degrees in Computer Science and Criminal Justice, and is an active SRO GT America GT2 race car driver.

Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-accessible data, or cause denial of service on affected PHP workers. Customers running affected PHP versions (8.2–8.5 below the fixed releases, and end-of-life 5.4–8.1) should upgrade immediately to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35); configuration changes alone are not complete mitigations. AWS has identified a limited set of services that run affected PHP versions and is actively deploying mitigations and updates. Review the full bulletin for per-service status, mitigation guidance, and AWS WAF compensating controls. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.

Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP, allegedly affecting all versions starting with PHP 5.4.0. The vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619. Shortly after the post appeared, researchers confirmed the existence of the vulnerabilities. Along with the leak of details, an exploit unofficially named PHP2Shell appeared online. In the leaked demo video, the exploit is shown in action on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS — platforms that power many modern websites. The authenticity of the demonstration and the exact behavior of the exploit had not been independently verified at the time of publication. According to the researcher who published the PoC, the vulnerabilities are related to the handling of the multipart/form-data MIME type in conjunction with the session upload progress mechanism ( session.upload_progress ) in the PHP core and fall under the categories of use-after-free and memory corruption. This means that the flaws cannot be patched via application code, and the only possible fix is to update PHP on the server. The attack works without authentication: an attacker with network access to a PHP application can execute arbitrary code on behalf of the PHP process without needing to authenticate. Security advisories issued by PHP on October 21 confirm this information. The vulnerabilities affect PHP versions 5, 6, 7, and 8. As of this publication, branches from 8.2 to 8.5 are supported. Older branches, including PHP 8.1, 8.0, 7.x, and 5.x, have reached the end of their lifecycle; however, due to the critical severity of the vulnerabilities, backported patches have also been released for versions 7.4, 8.0, and 8.1. Sansec experts estimate that widespread exploitation could begin within 15 minutes of the update’s release. We strongly recommend that administrators responsible for publicly accessible PHP web servers take the following steps before the patch is available: Conduct an inventory of all PHP-based systems in the infrastructure (including web servers, control panels, third-party software, etc.). Disable upload-progress: set session.upload_progress.enabled = Off using the php_admin_flag in PHP-FPM pools. Block multipart requests on nginx and Apache servers. Consider temporarily isolating PHP applications that connect to the Internet until fixes are released. Ensure readiness to install the patch immediately upon its release. Plan to migrate servers running unsupported versions (8.1 and earlier) to the latest PHP branch. Detection by Kaspersky solutions Kaspersky solutions detect the described malicious activity at various stages of the attack. Possible detection scenarios are listed below. When an attempt is made to exploit these RCE vulnerabilities,  Kaspersky Endpoint Detection and Response promptly alerts the user to suspicious actions performed in the context of a web server, on both Linux and Windows machines. This activity is detected by the following rules: creating_windows_shell_from_a_web_servers_process ; possible_web_shell_creating_via_exploit ; spawning_process_from_webserver_more_filters_linux ; webserver_interpreter_execution_linux ; executable_file_in_www_folder . Detection of the PHP2Shell vulnerability exploit by KEDR Exploitation of the PHP2Shell vulnerability in network traffic is detected by Kaspersky Anti Targeted Attack (KATA) . This solution detects such activity with the following verdicts: Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C . Detection of the PHP2Shell vulnerability exploit by KATA Our Kaspersky Endpoint Security solution, now available as Kaspersky Next , also detects malicious post-exploitation activity using the Behavior Detection component , such as PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.