Two critical PHP vulnerabilities, tracked together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), were under attack before many servers could be patched.
What's known so far:
- Impact: the flaws sit in how PHP handles certain memory errors during server requests and allow remote code execution without credentials.
- Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The UK's NCSC and the US NSA advised shutting down servers that can't be updated right away.
- Early exploitation: AWS says one actor started hitting its honeypots on October 17, four days before technical details went public; proof-of-concept exploits surfaced in the hours before disclosure.
- Disclosure dispute: the PHP Foundation says Chainguard broke the embargo on October 21 at 07:41 UTC by publishing patched images more than six hours early; Chainguard's CEO says it acted on evidence of active exploitation.
The practical problem, as Sophos CTU puts it, isn't just installing the fix but finding every PHP instance: it often runs inside hosting platforms, CMSs and third-party products, and legacy plugins can push teams to delay upgrades.
Full story on Tadna:
https://www.tadna.com/en/news/php2shell-active-exploitation-of-critical-vulnerabilities-before-patch-release?utm_source=dev&utm_medium=social&utm_campaign=tadna
Top comments (0)