PHP2Shell was first exploited on 17 October 2026, announced by PHP on 20 October, and fixed in releases available from 21 October (8.5.12, 8.4.27, 8.3.36, 8.2.35). Network-equipment vendors are still assessing impact. This page is updated as new advisories land.
On this page
Latest status (22 October 2026)
- Fixed PHP releases are available for every supported branch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Exploitation attempts are ongoing, and Cloudflare has seen attackers trying to evade its WAF rules.
- Linux distributions received the patches before public release and are shipping backported packages — check your vendor’s tracker.
- Network and security appliances that embed PHP are still being assessed; see the vendor status below.
Timeline
17 October 2026 — first exploitation attempt
Amazon Threat Intelligence’s MadPot honeypot network recorded a PHP2Shell exploitation attempt, four days before public disclosure. The traffic came through a commercial anonymisation service, and Amazon assessed that a threat actor was likely behind it.
20 October 2026 — PHP announces a critical security release
The PHP project announced an upcoming security release fixing two critical remote code execution vulnerabilities, later known as PHP2Shell.
21 October 2026 — fixes released, details published
- PHP published 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus minimal source backports for 7.4, 8.0 and 8.1.
- Advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) went public, both rated CVSS 9.2.
- Wiz published a technical analysis; watchTowr reported exploitation attempts.
- Cloudflare deployed WAF rules for known attack vectors, available on all plans including free.
- Patchstack received exploitation reports from hosting partners.
- Google Cloud published platform guidance (bulletin GCP-2026-070): App Engine standard on PHP 8.2+ is patched automatically; containers, GKE and App Engine flexible need a rebuild and redeploy.
- Security vendors including Qualys released detection checks.
21–22 October 2026 — vendor impact statements
- Palo Alto Networks: confirmed all PAN-OS and Panorama versions are affected; no fixed releases yet as of 22 October.
- Fortinet: reviewing 12 products; none confirmed vulnerable as of the update.
- Cisco: reviewing 31 products and cloud services; none confirmed vulnerable as of the update.
- Remi repository (popular third-party PHP packages for RHEL-family systems): no updated packages at the time of reporting.
- The UK’s NCSC urged organisations to take offline any system that can’t be patched immediately.
What we’re watching
- Fixed releases from appliance vendors that embed PHP
- Updated third-party repository builds (Remi and others)
- New indicators of compromise and detection guidance
- Any follow-up PHP releases or changes to the advisories
Want these updates by email? Subscribe to PHP security alerts — we send a short note when something changes that you need to act on.