EMERGENCY ADVISORY: Critical PHP Flaws (“PHP2Shell”) Need Action Today

Severity: CRITICAL (CVSS 9.2) | Issued: October 22, 2026

On October 21, two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, were disclosed. Together they’re nicknamed “PHP2Shell”. Either one can let an attacker take over a web server without logging in. Public proof-of-concept exploits exist, and exploitation attempts have been reported.

PHP runs a large share of the web, including WordPress, Laravel, customer portals and many vendor products. If your business has a website or web application, you probably have PHP somewhere.

CyberHoot Status

CyberHoot reviewed and patched all relevant systems. No action is required of CyberHoot customers for our platform.

Your Goal Today: Find It, Then Fix It

Step 1: Audit Internet-facing systems first. Public websites, customer portals, web apps, and anything reachable from the Internet. Confirm whether PHP is present and which version.

Step 2: Audit internal systems second. Intranets, internal tools, containers, appliances and vendor products that bundle PHP.

Step 3: Patch as soon as possible. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or get a confirmed vendor-backported fix. Then restart the web server or PHP workers, because the fix doesn’t take effect until you do.

Can’t patch right now?

Take the system offline, or remove it from the public Internet until it’s patched.

A web application firewall helps only partially.

PHP 8.1 and older get no routine upstream fixes. Ask your vendor for a backport or plan a migration.

Check Whether You’ve Already Been Hit

Patching closes the door, but it doesn’t tell you whether someone already got in. Have your IT team or MSP look back to October 17, using logs and endpoint data, for:

• Unusual multipart POST requests
• PHP_SESSION_UPLOAD_PROGRESS in requests
• PHP memory-exhaustion errors at request startup
• New or unexpected PHP files, and unexpected processes launched by the web server
• Unfamiliar scheduled tasks (cron jobs)

Tools that may help:

There are free tools out there that can help you assess your exposure to these PHP risks. Here are two we’ve been made aware of but have not tested ourselves. Use at your own risk.

1. Corelight PHP2Shell Detect Zeek and Suricata detections built for this incident. Spots suspicious HTTP traffic. Shows attempts, but can’t prove a successful compromise. Encrypted traffic needs inspection visibility.
2. PHP2Shell Guard Free, community-built Bash tool for Linux. Its hunt command checks for signs of compromise since October 17. New, unvalidated third-party code. Review the source before running it with elevated privileges.

If you find anything suspicious: preserve logs and evidence before you rebuild or wipe anything, then escalate for forensic review.

Your Trusted Cybersecurity Partner: CyberHoot. Laugh. Learn. Hoot Up!

---

Sources

• CISA Alert
• Canadian Cyber Centre AL26-026
• Rapid7 Analysis
• Wiz Research
• PHP.net ChangeLog
• Download the one-page “What to Do Today” handout (below).

---

Secure your business with CyberHoot Today!