Critical PHP Vulnerabilities: Emergency Security Updates Released

21 Oct

Update: 22 October 2026

Since our initial advisory on 21 October, further security intelligence has confirmed widespread attempts to exploit the two critical PHP vulnerabilities, collectively known as PHP2Shell.

Amazon Threat Intelligence has identified attempted exploitation dating back to 17 October, four days before public disclosure. Cloudflare has also reported a rapid escalation in malicious activity, with millions of exploitation attempts observed.

Independent security researchers have demonstrated that these vulnerabilities can allow attackers to remotely execute malicious code and potentially access sensitive information. However, the extent of successful compromise across affected organisations remains unconfirmed.

The impact extends beyond traditional websites. Third-party applications, hosting platforms and enterprise infrastructure products may also be affected, with vendors continuing to investigate and release security updates. The severity of the vulnerabilities has prompted numerous organisations, including government bodies, to take affected websites and services offline as a precaution.

Organisations should continue to prioritise immediate remediation, including confirming their exposure, applying available security updates, engaging relevant technology suppliers and reviewing potentially exposed systems for suspicious activity dating back to at least 17 October.

Further technical findings and updated recommendations have been incorporated into the sections below.

Executive Summary

The PHP development team has released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both assigned a CVSS v4.0 severity score of 9.2.

PHP is a widely used server-side scripting language underpinning websites, web applications and numerous software products. The vulnerabilities affect PHP's internal memory management and can allow unauthenticated remote code execution (RCE), potentially enabling attackers to compromise affected servers without requiring valid credentials.

The official security advisory, published on 21 October 2026, confirms that successful exploitation has been demonstrated against Apache mod_php environments, including scenarios where malicious requests can trigger exploitation before application code executes. PHP-FPM and other deployment configurations are also potentially affected, although the specific exploitation requirements differ.

The UK's National Cyber Security Centre (NCSC) has issued an alert urging organisations to prioritise remediation. Cloudflare has deployed emergency Web Application Firewall (WAF) protections and confirmed widespread exploitation attempts, while further security research has demonstrated additional exploitation methods and the potential for sensitive information to be exposed. [Updated 22 October 2026]

Security updates are now available for supported PHP versions. Black Arrow strongly recommends that organisations and their IT service providers identify potentially affected systems and apply the appropriate security updates as a matter of urgency.

What's the risk to me or my business?

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with the privileges of the affected PHP web server process.

Depending on the system's configuration and security controls, this could result in:

Unauthorised access: Exposure or theft of sensitive business, customer or application data.
System compromise: Installation of malware, webshells or other mechanisms allowing continued unauthorised access.
Service disruption: Interruption of websites, applications and business-critical services.
Further compromise: Potential access to connected systems, databases or other infrastructure.
Sensitive information disclosure: Exposure of information held in PHP process memory, potentially including credentials, authentication tokens and other sensitive application data. [Updated 22 October 2026]

The exposure is not limited to organisations developing their own PHP applications. PHP is embedded within numerous third-party applications, content management systems and web hosting environments.

Organisations should not assume that systems are protected simply because they use a particular web framework, application platform or PHP deployment method.

The risk may also extend to enterprise infrastructure products and appliances that use PHP within their management interfaces or supporting services. Organisations should check relevant vendor security advisories rather than assuming that only traditional websites and web applications are affected. [Updated 22 October 2026]

What can I do?

Black Arrow recommends that organisations take the following actions immediately:

1. Identify affected PHP installations

Review servers, websites, applications, hosting environments and third-party products that rely on PHP. Prioritise internet-facing services, particularly Apache deployments using mod_php, whilst recognising that PHP-FPM and other deployment methods may also be affected.

Engage relevant application owners, hosting providers, managed service providers and technology suppliers to establish whether any affected PHP components are in use.

For supplier assurance questions and follow-up, see step 7. A product's reported PHP version alone may not establish whether it is vulnerable, as some operating system and extended-support vendors provide security fixes without changing the underlying PHP version number. [Updated 22 October 2026]

2. Apply the emergency security updates

The PHP development team has released the following patched versions:

PHP 8.5: Update to version 8.5.12
PHP 8.4: Update to version 8.4.27
PHP 8.3: Update to version 8.3.36
PHP 8.2: Update to version 8.2.35

For PHP 8.1 and earlier, see step 3 for guidance on unsupported versions and exceptional source-level backports.

Operating system and extended-support vendors, including Canonical, CloudLinux and TuxCare, have also released security updates for affected PHP versions, including some older releases.

Organisations should deploy the appropriate patched PHP version or a verified security backport provided by their operating system, hosting or commercial support vendor.

Following installation, restart affected PHP services and workers, and verify that the updated runtime is active. Where PHP is provided through a managed service or third-party product, obtain confirmation that the relevant updates have been applied. [Updated 22 October 2026]

3. Review unsupported PHP versions

PHP 8.1 and earlier no longer receive standard upstream security updates.

Recognising the severity of these vulnerabilities, the PHP security team has exceptionally provided minimal source-level backports for PHP 7.4, 8.0 and 8.1.

These are intended for organisations with the technical capability to build and maintain their own PHP installations and do not represent a return to official support.

Organisations operating unsupported versions should prioritise migration to a supported release or obtain verified security fixes from their distribution or extended support provider.

4. Maintain temporary security protections

Cloudflare has deployed emergency WAF protections targeting the vulnerabilities, including rules available automatically to customers using its free service tier. These protections have been expanded as additional exploitation techniques have been identified.

Cloudflare has also introduced detection capabilities that examine both incoming requests and server responses to help identify potentially successful exploitation attempts and prevent certain malicious responses from reaching attackers.

Organisations using Cloudflare or other WAF services should confirm that the relevant protections are enabled and operating in blocking mode where appropriate. They should also ensure that exposed origin servers cannot be accessed directly in a manner that bypasses these protections.

The PHP security team has documented temporary configuration measures that can reduce exposure to specific exploitation methods. However, these measures and WAF protections do not provide complete protection. Applying the relevant security updates remains the only reliable remediation. [Updated 22 October 2026]

5. Increase monitoring and investigate suspicious activity

Given the confirmed exploitation attempts observed before public disclosure, organisations should review available web server, application and security logs for suspicious activity dating back to at least 17 October 2026.

Potential indicators include:

Unusual or malformed HTTP requests, particularly multipart form submissions and unexpected session-related activity.
Repeated HTTP errors, PHP memory exhaustion events, unexpected worker restarts or application crashes.
Suspicious process execution originating from PHP or web server processes.
Unexpected file creation, unauthorised configuration changes or unusual outbound connections.
Evidence of attempted access to sensitive information, application credentials or authentication tokens.

Organisations using intrusion detection and prevention systems should also ensure that relevant detection signatures and security updates have been applied.

Where suspicious activity is identified, investigate the possibility of successful compromise, including unauthorised access, persistence mechanisms and potential exposure of sensitive information.

Patching removes the known vulnerabilities but does not address any compromise that may already have occurred. Where there is evidence that credentials or authentication tokens may have been exposed, assess whether these should be revoked or rotated. [Updated 22 October 2026]

6. Restrict access where remediation is delayed

Where systems cannot be updated promptly, organisations should consider restricting external access or temporarily taking affected services offline, subject to business continuity requirements.

This is consistent with the precautionary guidance issued by the NCSC.

7. Engage third-party suppliers and service providers

Organisations should contact relevant technology suppliers, hosting providers and managed service providers to establish whether the products or services they provide, including supporting components, are affected.

Where applicable, request confirmation of:

Whether the products or services are affected by either vulnerability.
Security updates or other remediation measures completed or planned, including expected completion dates.
Any identified evidence of exploitation or compromise affecting the services provided.
Any action required from your organisation.

Where assessments remain ongoing, request an expected date for confirmation and any relevant vendor security advisories. [Updated 22 October 2026]

Technical Summary

The PHP security team has confirmed two distinct vulnerabilities affecting internal request processing and memory management.

CVE-2026-109618: Remote Code Execution via Out-of-Memory Corruption

This vulnerability occurs when PHP encounters memory allocation failures while internal request data is only partially initialised.

Under certain conditions, subsequent request cleanup can process invalid memory state, creating an opportunity for memory corruption and remote code execution.

Unauthenticated exploitation has been demonstrated against Apache mod_php, including through specially crafted requests before application-specific code executes.

PHP-FPM is also considered susceptible under certain conditions, although a complete exploit for this particular vulnerability has not been demonstrated against that deployment method.

CVE-2026-109619: Remote Code Execution via Stale Global State

This vulnerability involves internal PHP state that can persist after its underlying request memory has been released.

Under specific conditions, subsequent requests handled by the same worker can access this stale state, resulting in a use-after-free vulnerability that may be exploited to achieve remote code execution.

Successful RCE has been demonstrated against Apache mod_php and PHP-FPM, although exploitation requires particular request sequences and, in some cases, application or configuration-dependent conditions.

Further research has identified additional exploitation techniques, including the potential disclosure of sensitive data held in PHP process memory. Successful exploitation may therefore result in information exposure, service disruption or remote code execution, depending on the vulnerability, deployment configuration and conditions present.

Security researchers have demonstrated exploitation against commonly used PHP application environments. Because the underlying vulnerabilities exist within PHP itself, updating an individual website, plugin or application does not necessarily address the exposure. The affected PHP runtime must be updated or appropriately patched. [Updated 22 October 2026]

Exploitation Status

Active exploitation attempts have been confirmed, including activity predating public disclosure.

Amazon Threat Intelligence has identified attempted exploitation dating back to 17 October 2026 through its security monitoring infrastructure. Cloudflare has also reported a rapid escalation in malicious requests, with millions of exploitation attempts observed following disclosure on 21 October.

Multiple security research teams have independently demonstrated successful exploitation in controlled environments, including unauthenticated remote code execution against affected PHP configurations.

Publicly available proof-of-concept material has also begun circulating, although the reliability and effectiveness of individual exploits may vary.

Importantly, observed exploitation attempts should not be confused with confirmed successful compromises. Whilst malicious activity is occurring at scale, the number of organisations successfully compromised remains unconfirmed.

Organisations should nevertheless treat the vulnerabilities as an immediate security risk, particularly where affected PHP installations were accessible from the internet before the emergency updates became available.

Further Information

Additional Security Research and Guidance

Black Arrow Cyber Consulting continues to monitor developments surrounding these vulnerabilities and recommends that organisations follow official vendor guidance, expedite security updates and maintain heightened monitoring of potentially affected infrastructure.

For assistance assessing your organisation's exposure, prioritising remediation or reviewing your cyber security arrangements, contact Black Arrow Cyber Consulting.

Black Arrow Admin