PHP2Shell flaws are now being exploited. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

In brief

Developing. Last updated 28 October 2026, 17:15 Dubai time (UTC+4).

Update, 28 October 2026: Palo Alto Networks says both flaws are being actively exploited against PAN-OS management interfaces exposed to the internet. That covers the web UI and XML API, including dataplane interfaces with a management profile attached, on PA-Series and VM-Series firewalls and on Panorama. It rates the issue critical, CVSS-B 9.2. Hotfixes are rolling out by branch through 30 October. Until a fix is installed, Palo Alto advises letting only a jump box reach the management interface. The SANS Internet Storm Center also reports the exploitation.

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October. Both allow unauthenticated remote code execution, and CISA calls the pair "php2shell". US federal civilian agencies must act by 29 October and check for signs of compromise as well as patch.

PHP's 21 October advisory puts the fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its php-src advisories rate both flaws critical, CVSS 4.0 9.2.

What is affected

• PHP 8.2, 8.3, 8.4 and 8.5 before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. NVD's records also cover older releases.
• Every way of serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php the highest risk, because a demonstrated exploit triggers before any application code runs.
• End-of-life versions. PHP 8.1 and older get no official releases. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1. CISA says systems that cannot be updated immediately should be taken offline.
• PAN-OS. Palo Alto says only the management web interface is affected, plus dataplane interfaces with a management profile attached. GlobalProtect and Captive Portal are not affected. Its advisory lists the fixed hotfix for each minor release. For example, 12.2.4-h1, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13 are out. 12.1.4-h13 and 10.2.10-h42 are due on 29 October, and 12.1.10-h3, 11.2.4-h23, 11.1.7-h12 and 10.2.7-h39 on 30 October.

CISA has not said who is exploiting the flaws. TechCrunch reports that researchers found evidence of exploitation before CISA's listing. ByteNib has not seen that evidence.

How to patch and check

1. Find every PHP runtime, including inside other products and container images.
2. Check versions with php -v and php-fpm -v. Distributions often backport fixes without changing the version number, so confirm against your vendor's notice.
3. Update and restart every PHP-FPM pool and web server.
4. Hunt for compromise. CISA advises watching for PHP workers that launch shells or download tools, and has published a SIGMA rule.
5. Treat mitigations as a stopgap. PHP says interim settings such as memory_limit=-1 and session.upload_progress.enabled=0 "do not make an installation safe". In an informational advisory on 23 October, PHP suggested keeping session upload progress disabled until its next regular release, against an unlikely variant tracked as CVE-2026-115560. Palo Alto says that variant does not affect PAN-OS.

Sources and scope

• CISA, Known Exploited Vulnerabilities catalogue entries for CVE-2026-109618 and CVE-2026-109619 (date added 26 October 2026, due date 29 October 2026, forensic triage "Yes"), read from the catalogue's JSON feed, version 2026.10.26. Also CISA's alert Critical Vulnerabilities in PHP Require Immediate Patching, first published 21 October and last revised 26 October 2026.
• The PHP project, security advisory of 21 October 2026 and informational advisory of 23 October 2026, and the PHP 8 ChangeLog, which lists both fixes under 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• php-src GitHub security advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), both published 21 October 2026, for the affected ranges, severity and CVSS score.
• NVD, CVE-2026-109618 and CVE-2026-109619. NVD's analysis starts the affected range at PHP 7.3.0 and 5.4.0 respectively.
• Palo Alto Networks, advisory for CVE-2026-109618 and CVE-2026-109619, updated 28 October 2026, for PAN-OS status, fixed versions, release estimates and mitigations.
• SANS Internet Storm Center, Stormcast, 28 October 2026, the second source for PAN-OS exploitation.
• TechCrunch, US government says hackers are now exploiting critical PHP web bugs, by Zack Whittaker, 27 October 2026. It is used only for the attributed report that researchers had seen exploitation before the KEV listing.

Sources were checked on 27 October 2026, and the Palo Alto and SANS sources on 28 October. Exploitation is confirmed by CISA, but no source we checked names the attackers, the targets or the scale. Distribution package versions vary by vendor and were not checked individually. This article does not link to exploit code. The prioritisation and the checking steps are ByteNib editorial analysis based on the PHP and CISA guidance.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.