PHP2Shell Was Exploited Four Days Before Anyone Could Patch It

Start with the mechanism, because it decides what you do this week. Both are memory safety failures in how PHP handles a web request, and neither needs a flaw in your application. A site running PHP is exposed on the strength of the runtime alone.

CVE-2026-109618 trips when a request runs out of memory while its internal data is only half built. Cleanup then treats that invalid state as valid. CVE-2026-109619 is a stale state bug. Leftover globals from one request survive in the worker process, and the next request handled by that same worker reuses them. Anyone who can reach the server can run code as the PHP worker, with no login.

The fix is a version change, then a restart you cannot skip

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and published minimal backports for the end of life branches 7.4, 8.0 and 8.1. The watchTowr advisory puts the highest risk on Apache mod_php, where an unauthenticated request triggers the bug before your application code runs at all.

Amazon is direct about the limits of mitigation. There are no configuration-only workarounds that fully address both issues, and upgrading is the only complete remediation. Blocking multipart uploads is the suggested stopgap for estates that cannot patch today, and it will break file uploads somewhere. WAF rules reduce exposure while you work.

The second half of the fix is the worker. Because 109619 lives in state that survives between requests inside a long running worker, replacing the binary on disk does nothing for the processes already holding that state. Restart the pool, then confirm the restart actually happened.

Somebody was probing five days before you heard about it

Amazon’s MadPot honeypots logged an attempt on October 17 from an address on a commercial anonymization network. Amazon’s writeup cannot say how that actor learned of the bug, or whether the attempt would have worked on a real system. What it can say is that later probes came from varying anonymized infrastructure, which points at more than one actor.

The embargo did not hold. Details and the CVE identifiers surfaced publicly on October 20, a day before the scheduled release. Proof of concept code appeared around two in the morning UTC on October 21, and PHP pushed the patches a little earlier than planned. Cloudflare logged thousands of attempts in the ten hours before the release, tens of thousands in the next forty five minutes, and hundreds of thousands within two hours.

One million hosts that will never see this patch

VulnCheck put the number of internet-facing hosts running an end of life PHP at more than a million. Those branches get no security updates from upstream, only the one-off backport published this week. Small hosting resellers and WordPress shops are the tail that never gets patched, because a version bump breaks a plugin nobody maintains any more.

What the exploit developers did next is the part that matters. VulnCheck built an exploit that defeats address space layout randomization on x86-64 servers running PHP’s recommended production configuration, which had been the main barrier to an attack that works on real hardware. It shared that only with its paying intelligence customers. WordPress security firm Defiant reported more than 74,000 blocked attempts across the five million sites its firewall covers, with no confirmed compromise.

Neither flaw is in CISA’s known exploited catalog as of catalog version 2026.10.21, while Amazon now calls the flaws broadly exploited in the wild. Both statements are true and neither will stay true for long.

Just patch it sounds great until the update takes down your website, as John Strand of Black Hills Information Security told SiliconANGLE. An industry that can find a bug faster than it can read a plugin dependency graph will keep producing weeks like this one.

Three questions for your own estate. Which hosts run a PHP branch that stopped receiving security fixes? Does your web tier use a long running worker pool that a binary swap leaves untouched? And does your critical patch standard still assume a week of quiet between disclosure and exploitation?

Related reading. GitLab’s CVSS 10 arrived the same week from the regex engine underneath Ruby, and the LiteLLM credential stealer made the same point about code you did not write. The vulnerable layer keeps turning out to be the one nobody owns.