PHP RCE Vulnerabilities Tested Days Before Patch, Mass Exploitation Follows Update

Remote code execution on web servers is the primary goal for attackers targeting PHP2Shell. To achieve this, they needed valid proof-of-concept code and access to vulnerable instances. Amazon reports that threat actors began probing for these flaws on October 17, while the vulnerabilities remained under embargo. The initial attempt originated from a commercial anonymization network, suggesting organized activity rather than opportunistic scanning. This early access indicates that exploit details circulated before the coordinated disclosure schedule.

How it unfolded

• On October 17, Amazon detected the first exploitation attempt against its MadPot honeypot.
• On October 20, details about the flaws leaked online, accelerating the spread of proof-of-concept exploits.
• On October 21, patches for CVE-2026-109618 and CVE-2026-109619 were released, followed by mass exploitation.

Who is affected

The vulnerabilities affect any website using PHP versions released in the last decade, including version 5.4. This encompasses approximately 69.7% of websites with known server-side languages, according to W3Techs data. Major platforms such as WordPress, Drupal, Joomla, and Magento rely on PHP, making them potential targets. Organizations running these systems on unpatched servers face the risk of server takeover through unauthenticated remote code execution.

The fix

Patches for both CVE-2026-109618 and CVE-2026-109619 were released on October 21. The PHP Foundation and industry partners worked to build and verify these updates. PHP core developer Gina Peter Banyard stated that applying the official security patches is the only permanent defense. The UK National Cyber Security Centre advised organizations to update PHP servers immediately or take them offline until patched.

What made it possible

Remote code execution vulnerabilities in widely used interpreters like PHP create a high-value target for attackers. When such flaws are disclosed, threat actors often race to deploy proof-of-concept exploits before administrators can patch their systems. This dynamic relies on the time gap between vulnerability disclosure and widespread remediation. Security teams usually monitor for unusual traffic patterns from anonymized networks during this window. Checking server logs for failed execution attempts helps identify early probing activity before full compromise occurs.

Background: Proof-of-concept exploits

Proof-of-concept exploits demonstrate that a vulnerability is exploitable in a real environment. They help you move beyond theoretical severity scores to understand actual impact. This evidence drives faster, more accurate patching decisions and prevents waste on low-risk issues.

Read the full guide: Why Proof-of-Concept Exploits Define Your Security Response

What to do and how to stay safe: PHP

• Verify that all PHP installations are updated to the latest patched versions immediately.
• Monitor server logs for unusual activity originating from anonymization networks or VPNs.
• Take critical unpatched systems offline until updates can be applied and verified.
• Review access controls to ensure that administrative interfaces are not exposed to the public internet.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did the first PHP2Shell exploitation attempt occur?

The first attempt was detected on October 17, four days before the patches were released on October 21.

Are the proof-of-concept exploits functional?

Multiple organizations, including WatchTowr and the PHP team, reported that circulating proof-of-concept exploits were unsuccessful or crashed targets.

Which PHP versions are vulnerable to PHP2Shell?

Any PHP version released in the last decade, dating back to version 5.4, is affected by these critical vulnerabilities.