DEV Community: Abdullah Balouch

PHP2Shell: Two Critical PHP Flaws Leave Millions of Servers Exposed

Abdullah Balouch — Thu, 22 Oct 2026 05:50:56 +0000

"Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — allow unauthenticated remote code execution on millions of servers. Governments took national services offline, Cloudflare saw early attacks, and updating WordPress does not fix it. What happened, who is exposed, and what to do right now."

PHP quietly powers the back end of most of the web. W3Techs measures it on 69.3% of all websites whose server-side language can be identified. WordPress alone runs close to 40% of the web, and it sits on PHP — so do Magento, Drupal, Joomla, phpBB, WHMCS and MediaWiki. When a flaw turns up inside PHP itself, the blast radius is not one app. It is the foundation under millions of sites at once.

That is what happened this week. On Tuesday, October 20, word began spreading that two unpatched PHP vulnerabilities were about to be disclosed. Screenshots circulated, including one showing an exploit tool named PHP2Shell. Researchers at watchTowr examined the leaked material and confirmed the bugs were real and led to remote code execution. PHP had planned an orderly, scheduled fix. The leak forced an emergency release instead — shipped on Wednesday afternoon, slightly ahead of the planned 14:00 UTC slot.

The short version

CVE-2026-109618 and CVE-2026-109619 — both rated CVSS 9.2 (Critical)
Unauthenticated remote code execution: no password, no account, no user interaction
One scan flagged more than 22.6 million internet-facing PHP instances as potentially exposed
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — anything below is vulnerable
Flaw one: turning PHP's own safety valve against it
The first bug, CVE-2026-109618, lives in how PHP reacts when a request runs out of memory. Normally, hitting the memory limit triggers a controlled shutdown of that request. The problem is timing: parts of the request's memory can be reached before they are fully initialised, and if an allocation fails in exactly that window, the emergency exit path skips proper accounting. Cleanup then runs over data that was never valid — and a crafted request can steer that confusion into executing the attacker's code.

Forcing that out-of-memory moment turns out to be easy. PHP processes multipart/form-data request bodies — the format browsers use for file uploads — before any application code runs. A request that never declares a usable content length can slip past the post_max_size limit, and empty file fields do not count against the max_file_uploads cap even though PHP still builds internal records for each one. Stack enough of them together and memory runs dry on demand, at the precise spot where the bug sits.

Flaw two: a use-after-free in worker memory
The second bug, CVE-2026-109619, is a different failure with the same destination. A PHP worker process keeps state in memory between requests — error data, session data and similar. That state is supposed to be wiped before the memory is reused. A fatal error, including one triggered by the out-of-memory trick above, can skip the wipe. PHP then frees memory the worker still points to, and the next request to land on that worker reads a dangling pointer. With a carefully shaped heap, that use-after-free also ends in code execution with the web server's privileges.

PHP's own analysis proved the first bug end-to-end over HTTP on Apache with mod_php on default settings. PHP-FPM — the setup most managed hosts run — is considered susceptible to the first flaw, and for the second flaw the session route reached working code execution on both mod_php and FPM. There is no "safe" setup here. Both need the patch.

PHP2Shell infographic: two critical PHP flaws, CVSS 9.2, 22.6 million servers exposed
Why governments switched their own websites off

The clearest signal of how serious this was came from the Netherlands. DigiD, the national login service, put up a "temporarily unavailable" page. MijnOverheid went down with it, as did the websites of the Dutch parliament and the NCSC — the very agency responsible for warning the public. Finland's agencies pulled sites offline as a precaution, and in Germany, Freiburg University took its central websites, intranet, learning platform and student webmail offline at 10:39 on Wednesday morning.

None of these were confirmed break-ins. They were calculated decisions: better unreachable for a day than running a PHP build an unauthenticated stranger could take over. Security agencies across Europe, Australia, Japan and the UK issued the same advice — patch immediately, or take the application off the public internet until you can.

Updating WordPress does not fix this

This is the part that catches site owners out. The bug is not in WordPress, your theme or your plugins, so updating them changes nothing. The vulnerable code is in the PHP interpreter on the server underneath everything. The only question that matters is which PHP version your host runs, and whether they have updated it. If you are on shared hosting, the fix is entirely in your provider's hands — contact them today and ask directly whether they have applied the October 21 PHP security release.

Patched versions — check yours against this list
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Anything lower is exposed. PHP 8.1 and older no longer receive updates from the PHP project — one scan on October 20 counted roughly 884,000 internet-facing servers still on those branches. Minimal backports exist for 7.4, 8.0 and 8.1 for people who compile PHP from source, but if you are on an end-of-life branch, treat this as your sign to migrate. Note that PHP 8.2 itself reaches end of life on December 31, 2026.

What to do right now

Check the version your site actually runs. php -v shows the command-line build, which is not always the one serving your website. Check the web-facing one with a phpinfo page or php-fpm8.3 -v.
Update PHP to one of the patched releases above — or confirm your host already has.
Restart the service. Workers that are already running keep the old code in memory. Restart PHP-FPM or Apache after updating.
Do not trust the version number alone. Linux distributions often backport security fixes into packages that keep an older version string. Check the package changelog for the CVE numbers instead — apt changelog php8.3-cli on Debian/Ubuntu, rpm -q --changelog php on Red Hat systems.
Skip the config workarounds. Tweaks circulating online, such as disabling session upload progress, block only one attack path. They do not make an unpatched server safe. Only the patch closes the hole.
Where things stand
Cloudflare reported early attack attempts against PHP sites on Wednesday morning and pushed out firewall rules to blunt them; hosting companies reported the same pattern. As of October 21, however, there was no confirmed break-in attributed to these flaws — the Dutch NCSC said it had seen no active abuse, and neither CVE had yet appeared on the US government's known-exploited-vulnerabilities list. What is public is proof-of-concept code, and after a leak like this, mass scanning typically begins within hours.

So the window is now. If you run anything on PHP — a blog, a shop, a forum, a company site — the only thing that matters is whether your server was patched before someone came looking. Check your version today.

Read all the details here

PHP2Shell: Two Critical PHP Flaws Leave Millions of Servers Exposed — Hack The Planet

Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — allow unauthenticated remote code execution on millions of servers. Governments took national services offline, Cloudflare saw early attacks, and updating WordPress does not fix it. What happened, who is exposed, and what to do right now.

hackthepalnte.co.uk

Dark Forums: Mining Database Dumps for Early Breach Warning

Abdullah Balouch — Wed, 21 Oct 2026 21:50:02 +0000

Dark Forums: Mining Database Dumps for Early Breach Warning

Between a data breach and the moment a victim learns about it, stolen information typically moves through clandestine marketplaces. Dark forums serve as the primary trading floors where database dumps, infostealer logs, and combolists change hands daily—often long before public disclosure occurs.

For defenders, this lag time represents a critical window of opportunity. If your domain appears in a listing today, you can proactively secure your perimeter before the inevitable wave of credential stuffing begins. Here is how to operationalize an early-warning system based on dark web intelligence.

What Dark Forums Tell Defenders

Dark forums function as clearinghouses for database dumps, logs from infostealers (such as RedLine, Lumma, and Raccoon), and large-scale combination lists. When your company's domain surfaces in a fresh dump or a stealer-log feed, it acts as an immediate signal that your organization's credentials are compromised and likely being prepared for unauthorized access to VPNs, email, and SaaS platforms.

For more Details visit\

Dark Forums: Mining Database Dumps for Early Breach Warning — Hack The Planet

Dark Forums trades in stealer logs, combolists, and database dumps. Monitored responsibly, it gives defenders early warning that corporate credentials are circulating.

hackthepalnte.co.uk

What Are CVEs? The Universal Name for Every Vulnerability

Abdullah Balouch — Wed, 21 Oct 2026 19:49:55 +0000

Originally published on Hack The Planet: https://hackthepalnte.co.uk/blog/what-are-cves.html

CVE-2021-44228. CVE-2023-23397. These codes appear in every breach headline — but what exactly is a CVE, who assigns it, and how do professionals use the system to decide what to patch first? A complete beginner-friendly guide.

A Universal Name for Every Vulnerability

Imagine every security flaw being described differently by every vendor, researcher, and news site: "the Exchange bug", "that Outlook thing", "the printer vulnerability". Coordinating a global response would be chaos. The CVE system exists to end that chaos.

CVE stands for Common Vulnerabilities and Exposures. A CVE is a unique identifier — a standardized name tag — assigned to a publicly known security vulnerability. When a professional anywhere in the world says "CVE-2021-44228", everyone can look up the exact same flaw (in that case, the Log4Shell vulnerability in Apache Log4j), in the same public records, with no ambiguity.

The program is overseen by the MITRE Corporation, sponsored by the U.S. Department of Homeland Security, and operated through a federation of CVE Numbering Authorities (CNAs) — vendors and research organizations (Microsoft, Google, Apple, and hundreds more) authorized to assign IDs for flaws in their own products or research.

Anatomy of a CVE ID

Every identifier follows the same format:

CVE - YYYY - NNNN
 |      |      |
 |      |      Sequence number (at least 4 digits, assigned in order)
 |      The year the ID was assigned (not necessarily the year of disclosure)
 "CVE" prefix

Real examples you have probably seen in headlines:

CVE-2021-44228 — Log4Shell: remote code execution in Apache Log4j, arguably the most severe flaw of its decade.
CVE-2017-0144 — EternalBlue: the SMBv1 flaw behind WannaCry and NotPetya.
CVE-2023-23397 — a Microsoft Outlook flaw that leaked password hashes when a malicious email was merely received.
CVE-2014-0160 — Heartbleed: the OpenSSL bug that exposed memory (and private keys) of much of the internet.

Notice that old, famous CVEs are still referenced constantly — the ID becomes the flaw's permanent name in reports, patches, and exploit databases.

CVSS: Scoring How Bad a Flaw Is

An ID tells you which flaw; the CVSS score (Common Vulnerability Scoring System) tells you how dangerous it is, on a 0.0–10.0 scale. Scores are computed from factors like: can it be exploited over the network or only locally? Does it need user interaction or valid credentials? What happens on success — full system compromise, data leak, or a crash?

CVSS Score	Severity	Typical Response
9.0 – 10.0	Critical	Patch or mitigate immediately — hours to days
7.0 – 8.9	High	Prioritized patching — within the week
4.0 – 6.9	Medium	Scheduled patching cycle
0.1 – 3.9	Low	Fix when convenient; monitor
0.0	None	No security impact

Professionals treat CVSS as a starting point, not a verdict: a 7.5 on an internet-facing server you own deserves faster action than a 9.8 in software you do not run.

The NVD and the Ecosystem Around an ID

After assignment, a CVE is enriched in the National Vulnerability Database (NVD), run by NIST, which adds the CVSS score, the list of affected products and versions (CPE names), and references to advisories and patches. Around that core sits an ecosystem professionals use daily:

Vendor advisories — the authoritative fix instructions from the product's maker.
CISA's KEV catalog — the Known Exploited Vulnerabilities list: CVEs confirmed to be exploited in the wild. If a flaw is in KEV, it jumps every patch queue.
Exploit databases and scanners — tools like Nessus, Nuclei, and Metasploit map checks and modules to CVE IDs, which is why scan reports speak fluent CVE.
EPSS scores — a probability estimate that a given CVE will be exploited in the next 30 days, used alongside CVSS for smarter prioritization.

A CVE's Lifecycle, End to End

Discovery — a researcher, vendor, or attacker finds the flaw.
Assignment — a CNA reserves and assigns the CVE ID, often before public disclosure.
Disclosure — the advisory publishes with the ID, description, and (ideally) a fix.
Enrichment — NVD analysis adds scores and affected-product data.
Exploitation timeline — scanners add checks; if attackers adopt it, the CVE lands in KEV and incident reports.
Remediation — organizations patch, verify with rescans, and close the ticket — all tracked by CVE ID.

Reserved-but-undisclosed IDs, disputed entries, and the occasional rejected CVE ("this was not actually a vulnerability") are normal parts of the system's housekeeping.

Why Learners Should Care

Fluency in CVE-land is a quiet career superpower. Job interviews assume you can read a vulnerability headline and reason about severity and exposure. SOC analysts triage scanner output written entirely in CVE IDs. Penetration testers chain them. And when the next Log4Shell lands, the people who understand the system — ID, score, KEV status, affected versions — are the ones who respond in hours while everyone else is still decoding the headline.

Start simple: pick one famous CVE per week, read its NVD entry and one technical write-up, and note the attack vector, the fix, and whether it reached the KEV list. In a few months you will read vulnerability news the way professionals do.

Key Takeaways

A CVE is a unique, permanent ID for a specific public vulnerability — the industry's shared language.
MITRE and a federation of CNAs assign IDs; the NVD enriches them with scores and affected products.
CVSS scores severity (0–10); CISA's KEV flags confirmed real-world exploitation — patch KEV first.
Scanners, advisories, and interviews all speak CVE — learning the system pays off immediately.