Introduction to PHP2Shell Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the active exploitation of two critical PHP vulnerabilities, collectively tracked as PHP2Shell, in high-complexity attacks. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow threat actors to gain remote code execution (RCE) on unpatched systems. The PHP security team patched these flaws on October 21, one day after urging security teams to install the updates. Although details on the vulnerabilities were leaked before the patches were released, no functional proof-of-concept (PoC) exploits were found. Multiple cybersecurity firms detected widespread exploitation attempts before public disclosure, but they were unsuccessful. Amazon Threat Intelligence security researchers reported that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released. CISA ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Thursday, as mandated by Binding Operational Directive 26-04. The PHP2Shell vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. While CISA has not shared further details about ongoing attacks, Perplexity detection and response lead Adel Karimi confirmed in-the-wild exploitation over the weekend. The PHP security team also shared mitigation measures for a new RCE flaw (CVE-2026-115560) with no patch, exploitable when targeting systems with an unusual combination of configuration and application code. PHP powers roughly 70% of all websites, with more than 5.1 million PHP hosts exposed online and around 3.8 million instances with at least one port open to attacks, according to VirusTotal estimates. Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. The PHP2Shell vulnerabilities are now successfully exploited in the wild, with Amazon reporting that exploitation began four days before patches were released. The PHP security team has shipped emergency patches for the critical PHP2Shell flaws, and is warning admins of the two critical flaws, with emergency patches coming tomorrow. CISA has also confirmed the active exploitation of PHP2Shell vulnerabilities, chaining Plex flaws in Plex2Shell attacks to breach servers. BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot. This guide provides in-depth information on these vulnerabilities, including details on mitigation and prevention strategies.
