
Attackers exploit critical PHP flaws 'PHP2Shell' as patches reach servers
Two remote-code-execution bugs rated 9.2 were abused before and after fixes shipped on Oct. 21; unsupported PHP versions get no official patch
Attackers are exploiting PHP2Shell, a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) in the PHP language itself. Each can let an unauthenticated attacker run code on a web server, and each is rated 9.2 on the CVSS v4.0 scale. PHP shipped fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after details leaked ahead of the planned disclosure. Security firm watchTowr said its honeypots saw exploitation the day of release, and SOCRadar relayed an Amazon report that attempts began Oct. 17. The Hacker News reported Oct. 25 that attackers used agentic AI tools after breaking into a government entity through the bugs. Versions 8.1 and older receive no official release, only minimal source backports. PHP says no configuration change fully mitigates the flaws.
Why it mattersPHP runs a large share of the web, and the patch gap on end-of-life versions leaves many sites exposed.













