PHP2Shell Exploitation Surges As a Broken Embargo Leaves Defenders Racing To Patch
An earlier advisory from our team covered this incident narrowly, as a distribution-level patch notice for SUSE-SU-2026-4853-1, the important security update for php7. The situation has moved on substantially since then. The two underlying flaws, CVE-2026-109618 and CVE-2026-109619, are now publicly tracked together as PHP2Shell, carry a 9.2 severity rating, and can allow remote code execution against systems running the affected PHP builds. What is new is not the patch itself but the exploitation picture and the manner of disclosure: multiple infrastructure providers report attack traffic that began before the flaws were ever made public, exploit attempts are now counted in the millions, and a number of organisations, including government bodies, have responded by pulling their websites offline entirely. Any organisation running PHP on internet-facing web servers, in container base images, or inside third-party applications that bundle the interpreter is in scope.
The mechanism behind CVE-2026-109618 is described only in outline by the PHP Foundation: the first signs of the out-of-memory condition were spotted by a contractor as far back as 2024, but no concrete attack vectors were found at the time and other issues with clearer impact took priority. Deep research resumed on 30 July 2026 after the project joined OpenAI's Patch the Planet programme, and work by researchers from Calif, OpenAI and Google Cloud's Wiz made the full impact of the out-of-memory problem clear, at which point fixing it became the top priority. Full exploitation details have not been published, and the practical risk in this case came from the disclosure sequence rather than from any released technical write-up. A coordinated embargo was set for 22 October at 14:00 UTC, with distributors receiving patches in advance; on 20 October at around 15:00 UTC the two CVE identifiers began circulating online without technical detail, prompting an early pre-announcement at 19:30 UTC and a decision to bring the fix release forward to 21 October. Calif then mistakenly published, and later deleted, a video showing a proof-of-concept exploit running against multiple targets, and on 21 October at 07:41 UTC Chainguard published built images containing the fix roughly six hours ahead of the agreed release, which the PHP Foundation alleges disregarded weeks of coordinated work and gave attackers a compiled fix to study and diff before defenders could update.
The strategic problem is that the protective value of an embargo collapses the moment any one participant moves, and PHP2Shell shows how many parties now hold a patch early. Chainguard's chief executive has publicly contested the criticism, saying the decision followed disclosure guidelines and was based on how easily the company independently rediscovered and exploited the flaw, how much information was already circulating, and evidence of active exploitation in the wild. That evidence is substantial: Cloudflare reported thousands of exploitation attempts roughly ten hours before the public announcement, rising to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours and millions since, while AWS states that its MadPot sensors recorded at least one exploit attempt on 17 October, four days before disclosure, from an IP address associated with a commercial anonymisation network; how that actor obtained exploit information ahead of time remains unclear. FIRST's EPSS scoring currently puts CVE-2026-109618 at an 11.6% probability of exploitation in the next 30 days and CVE-2026-109619 at 6.0%, elevated figures that sit alongside, rather than replace, the directly observed attack traffic. For defenders the consequence is a compressed response window on one of the most widely deployed runtimes on the internet, with the exposure extending beyond directly managed servers into container base images and vendor-supplied applications that embed PHP and lag behind upstream releases.
Attack Surface
Web Application, Server OS, Supply Chain (Third-party vendors)
Tactics
Reconnaissance, Resource Development, Initial Access, Execution
Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1588.006 – Obtain Capabilities: Vulnerabilities
- T1595.002 – Active Scanning: Vulnerability Scanning
SuperPRO's Threat Countermeasures Procedures
- Apply the PHP security releases published on 21 October 2026 at 14:00 UTC (announced on the php.net 2026 archive page) to every php-cli, php-fpm and mod_php installation; these releases fix both CVE-2026-109618 and CVE-2026-109619.
- On SUSE hosts, install the php7 update shipped in SUSE-SU-2026-4853-1 with zypper patch, then restart php-fpm and apache2 so that already-running worker processes load the patched binaries rather than the vulnerable ones still mapped in memory.
- Rebuild and redeploy every container image whose base layer contains PHP and was built before 21 October 2026, and pin deployments to image digests instead of floating tags – a patched upstream base image provides no protection until downstream images are rebuilt and rolled out.
- Hunt retrospectively from 17 October 2026, the earliest exploitation attempt reported by AWS MadPot: review web server access logs for anomalous requests to PHP endpoints and alert on php-fpm or httpd worker processes spawning /bin/sh, bash, curl or wget.
- Enable your CDN or WAF provider's managed PHP2Shell rule set and confirm it is set to block rather than log-only; Cloudflare has recorded millions of exploitation attempts, so detection-only mode will generate volume without stopping the traffic.
- Treat unexplained PHP memory exhaustion, OOM kills and repeated php-fpm child process restarts as possible exploitation signals rather than capacity problems, since CVE-2026-109618 originates in an out-of-memory condition in the interpreter.
- For internet-facing PHP applications that cannot be patched within the current window, restrict access at the network edge to known source ranges or withdraw the service – several organisations, including government bodies, took their sites offline as an interim measure.
