More than 13 million internet-facing assets run PHP versions that may be affected, according to Censys Internet Intelligence.
What CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) do
Two critical vulnerabilities in PHP core—CVE-2026-109618 and CVE-2026-109619, commonly called "PHP2Shell"—allow an unauthenticated attacker to execute code on a server by sending a crafted HTTP request. The flaws live in PHP core (not in a framework or plugin), so any service that uses PHP to answer web requests can be reached. Affected setups explicitly include PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed; PHP rates mod_php as the highest risk. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; every earlier release is affected. Minimal source backports for 7.4, 8.0 and 8.1 exist, but PHP warns those are stopgaps and recommends planning an upgrade to a supported release.
Exploitability: ARM64, ASLR, public probes, and early exploitation
Exploitability varies by platform. VulnCheck reproduced both vulnerabilities and found that code execution works on ARM64 and on x86 systems where address space layout randomization (ASLR) is disabled. Dozens of public proof-of-concepts exist, but VulnCheck reported very few actually work and none bypass ASLR on x86-64. Red Hat rates remote code execution as "hard in practice" on default PHP-FPM deployments. That assessment has not, however, stopped activity: watchTowr reported exploitation in its honeypot network as of October 21, and Tenable relayed that Cloudflare's CTO said Cloudflare is seeing early attacks. Patchstack’s telemetry shows mostly probing so far. The PHP security team moved quickly after details leaked before the planned embargo and shipped fixes within about a day of announcing them.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhy finding PHP installs is difficult
Inventorying PHP is harder than checking a single package list. PHP appears in many forms: OS packages on Linux (php, php-fpm, php8.x), Homebrew installs on macOS, bundled or manually extracted copies on Windows (including XAMPP, WampServer, Laragon and vendor products), application bundles that ship their own PHP, containers with PHP baked into the image tag, and developer tools and local stacks on workstations. The practical, reliable approach is to read the PHP binary itself: PHP builds from version 5 through 8 embed their version string (X-Powered-By: PHP/x.y.z) in the file metadata, allowing exact version discovery without executing the binary.
Immediate actions: patch, prioritize, mitigate, and hunt
- Find every PHP installation and record the exact version; include Windows copies that do not register as installed applications.
- Prioritize by exposure: internet-facing servers, mod_php setups and ARM64 hosts come first.
- Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 via your OS vendor, a php.net build or your application vendor, and restart PHP-FPM and web server workers so the new binary is loaded.
- If you cannot patch immediately, isolate internet-facing PHP applications where possible and place WAF or IDS rules in front of them; Cloudflare and VulnCheck have published rules for known vectors.
- Use the partial setting with caution: session.upload_progress.enabled=0 blocks one demonstrated path for CVE-2026-109619 only. It must be set in php.ini, an FPM pool or server config and followed by a worker restart; ini_set() and .user.ini will not apply it.
- Hunt: review recent web server and PHP-FPM logs for worker crashes and malformed multipart uploads. No public indicators of compromise (IoCs) have been released, and neither CVE is in CISA’s KEV catalog yet, so internal log hunting is crucial.
- Plan to move off end-of-life PHP: anything on 8.1 or older has no official fixed release.
How Tanium customers can respond
Tanium reports it does not use PHP and is not affected. Tanium Guardian content for PHP2Shell is available now in Tanium Cloud and the company describes a dashboard that shows installed and running PHP across Linux, Windows and macOS so teams can prioritize. The content combines Installed Applications and Homebrew Applications sensors, a Windows PHP Installations sensor that reads version from binary file metadata (without executing it) and reports install type, path and owning user, plus pre-built Saved Questions listing running PHP processes and identifying PHP containers (matching php, FrankenPHP and about 25 PHP-based images such as WordPress, Drupal, Joomla, Nextcloud and Magento). Tanium Comply finds PHP on disk and surfaces PHP2Shell findings by endpoint with a pivot to the Comply findings page filtered to the two CVEs. Vulnerability Library definitions for Windows, Linux and macOS are live; on-premises customers can import Guardian content manually. Tanium External Attack Surface Management can discover internet-facing assets tied to an organization and identify PHP services and versions; Tanium Attack Path Mapping can show which exposed assets provide paths to cloud instances, roles or privileged identities. Tanium also notes that if you use the Remi repository, Remi was not planning to ship updates on Oct 21 (16:30 UTC), and PHP advised switching to distro packages or building from source if you depend on Remi.
PHP2Shell is a rare, immediate-danger core bug: no login is required, every older release is affected, and early exploitation has been observed. The core technical facts are clear—identify every PHP binary, prioritize internet-facing and mod_php exposures, patch to the fixed releases, and hunt for signs of compromise while vendors and distro packages roll out updates.