PHP2Shell is now producing confirmed remote-code execution against vulnerable servers, not merely scans or crashes. On October 24, 2026, researchers reported 35 shell starts from 35 execution-stage requests across three Apache mod_php honeypots running PHP 8.4.26. Administrators should install a fixed PHP release, restart every worker, verify the web-served version, and hunt for compromise dating back to October 17, 2026.
Is PHP2Shell being actively exploited?
PHP2Shell has progressed to working remote-code execution in 2026. SecurityWeek reported on October 24, 2026, that three vulnerable Apache mod_php honeypots recorded 35 execution-stage requests correlated with 35 /bin/sh process starts. CISA added both associated vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, 2026.
PHP2Shell is an exploit chain that combines PHP memory exhaustion and memory disclosure to execute commands remotely. The confirmed honeypot attacks used a four-stage HTTP sequence in 2026, although researchers observed no second-stage payload download in that dataset.
The raw result is striking: 35 shell starts divided by 35 execution-stage requests equals a 100% observed success rate. Treat that number carefully. SecurityWeek reported that the 2026 test used an intentionally favorable, single-worker Apache mod_php configuration, so it doesn’t prove comparable reliability against PHP-FPM, multiworker deployments, FrankenPHP, LiteSpeed, or every web application.
A separate report adds real-world context. Sophos said on October 22, 2026, that it observed multiple attempts and one successful exploitation from 45.198.224.169, delivering a payload assessed as the Potassium Mirai variant. Sophos reported no associated ransomware, data theft, or supply-chain compromise, but the observation came from one vendor and shouldn’t be generalized beyond its evidence.
AWS MadPot detected an exploitation attempt on October 17, 2026, four days before PHP publicly released its fixes. The sequence resembles other fast-moving vulnerability events, including the site’s coverage of an Atlassian vulnerability under active attack: public patching and retrospective threat hunting must happen together.
Which PHP versions must be patched?
PHP2Shell affects deployments that haven’t received the October 21, 2026, security fixes for CVE-2026-109618 and CVE-2026-109619. The PHP project released corrected builds PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Updating to a fixed build or an authenticated vendor backport is the only complete remediation.
| PHP branch | Minimum upstream fixed release | Required action in 2026 |
|---|---|---|
| PHP 8.5 | PHP 8.5.12 | Update and restart workers |
| PHP 8.4 | PHP 8.4.27 | Update and restart workers |
| PHP 8.3 | PHP 8.3.36 | Update and restart workers |
| PHP 8.2 | PHP 8.2.35 | Update and restart workers |
| PHP 8.1 and older | No regular upstream release | Use a distribution or LTS-vendor backport, or upgrade |
Older branches create the nastiest operational trap. PHP 8.1 and earlier no longer receive upstream releases in 2026. The PHP project supplied minimal source backports for PHP 7.4, 8.0, and 8.1, but packaged installations need a backport from the Linux distribution or long-term-support vendor, unless you move to a supported branch.
Don’t assume an old package is exposed merely because its displayed version looks lower than the upstream fixed build. Linux vendors sometimes retain an older base version while backporting security code and adding a package revision. Check the vendor advisory and package changelog. Conversely, an unsupported package with no documented backport remains a problem regardless of how stable the server appears.
What should administrators patch first?
Internet-facing PHP runtimes should receive the PHP2Shell fixes first, with Apache mod_php at the front of the queue. The PHP project specifically identified Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed installations as at risk on October 21, 2026. Internal systems still require remediation after externally reachable services are secured.
Start with assets accepting untrusted HTTP traffic and multipart form uploads. Public content-management systems, upload endpoints, customer portals, API gateways forwarding to PHP, and forgotten staging hosts deserve immediate inventory checks. A staging hostname with weak monitoring can be a softer entry point than the production site.
Use the following order to contain exposure without confusing a temporary control for a fix:
- Identify every internet-facing host and container that serves PHP requests, including alternate domains and staging systems.
- Patch Apache mod_php deployments first, then PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed services.
- Restart the relevant web and PHP workers so old vulnerable processes leave memory.
- Verify the PHP build through the web-serving path rather than relying only on a shell command.
- Preserve evidence and investigate activity from October 17, 2026, through the confirmed worker-restart time.
Blocking multipart uploads can reduce exposure where the application can tolerate it, according to AWS guidance published in 2026. WAF rules and configuration changes remain incomplete mitigations. In my view, disabling a business-critical upload feature is reasonable for a short maintenance window, but leaving it disabled instead of scheduling the update is poor risk management.
Teams handling several urgent maintenance changes should track security work separately from routine certificate automation such as preparations for shorter Let’s Encrypt certificate lifetimes. PHP2Shell has confirmed code-execution evidence and therefore deserves the emergency queue.
How do you verify PHP2Shell remediation?
PHP2Shell remediation is verified only when the PHP build serving web requests contains the 2026 fix and every old worker has been restarted. A community mitigation project warned on October 26, 2026, that php -v may inspect a different command-line installation from the PHP runtime used by Apache or PHP-FPM.
This is the pitfall many patch checklists miss. A server can have one PHP binary for the command line, another loaded into Apache, and a separate PHP-FPM pool inside a container. Seeing PHP 8.4.27 in an SSH session doesn’t prove that a request routed through the load balancer reaches PHP 8.4.27.
Validate through a controlled web endpoint, service inventory, or deployment telemetry that exposes the runtime build without leaving public diagnostic pages behind. Fully restart Apache or PHP-FPM workers after updating. A graceful reload may preserve processes or pools depending on the service design, so confirm process start times and drain old containers.
The patched build also has direct test evidence. SecurityWeek reported in 2026 that researchers did not bypass PHP 8.4.27 in their honeypot testing. That result supports the released fix, but it doesn’t replace checking vendor backports, every execution path, or residual compromise that occurred before the restart.
What evidence of PHP2Shell compromise should you hunt for?
PHP2Shell hunting should correlate suspicious multipart POST requests or PHP_SESSION_UPLOAD_PROGRESS activity with PHP memory-exhaustion errors, HTTP 500 or 502 responses, worker crashes, and abnormal session cookies. AWS said on October 22, 2026, that higher-confidence evidence includes a PHP or Apache worker spawning shells, downloaders, or system-discovery commands.
A memory error by itself is weak evidence because legitimate workloads can exhaust PHP limits. An HTTP 500 response is weaker still. Confidence rises when the same request timeline includes a worker crash, strange session behavior, and a child process such as /bin/sh.
Preserve web access and error logs, PHP logs, service logs, WAF events, process telemetry, cloud audit trails, and authentication records. AWS recommends retaining evidence from at least October 17, 2026, through the time vulnerable workers were restarted. If logs rotate daily, copying them before patching may prevent the update window from erasing the best clues.
AWS published six investigation addresses observed from October 17 through October 21, 2026: 103.216.220.92, 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188, and 95.217.98.37. AWS cautioned that the addresses include shared anonymization infrastructure. Investigate matches; don’t automatically block or treat them as proof of compromise.
Look beyond the listed addresses. Attackers can change infrastructure faster than many organizations deploy firewall rules, and malware may arrive through an address absent from a public advisory. The reported Potassium Mirai activity is a reminder that successful exploitation can become a malware foothold, much as defenders must distinguish indicators from proof when examining malware targeting exposed servers.
Honestly, process ancestry is the most valuable signal here. A web worker launching a shell or downloader is far more actionable than a noisy collection of failed requests. Isolate the host, preserve volatile evidence, rotate exposed credentials, and investigate lateral activity before returning the system to service.
PHP2Shell FAQ
What CVEs are associated with PHP2Shell?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. PHP released fixes for both vulnerabilities on October 21, 2026, and CISA added both to its Known Exploited Vulnerabilities catalog on October 26, 2026.
Can a WAF completely stop PHP2Shell?
A web application firewall cannot provide complete PHP2Shell remediation. AWS said in 2026 that blocking multipart uploads may reduce exposure where feasible, while the PHP project states that updating is the only complete remediation.
Does PHP 8.1 have an official fixed release?
PHP 8.1 has no regular upstream fixed release because the branch was out of upstream support in 2026. Packaged installations require a documented distribution or LTS-vendor backport, or an upgrade to a supported PHP branch.
Should administrators block every published PHP2Shell IP address?
Administrators should investigate the six addresses AWS published in October 2026 rather than automatically blocking all of them. AWS warned that some observed addresses belong to shared anonymization infrastructure, making an address match an investigative lead rather than conclusive attribution.
Does patching remove an existing PHP2Shell infection?
Patching PHP2Shell prevents exploitation of the corrected vulnerabilities but doesn’t remove malware, accounts, scheduled tasks, or credentials left by an earlier compromise. Administrators should preserve evidence, investigate the affected host, and complete incident-response procedures after installing the fix.