PHP2Shell emergency release

Two unauthenticated RCE flaws in the PHP engine — CVE-2026-109618 / CVE-2026-109619, CVSS 4.0 9.2 — leaked ahead of coordinated disclosure, patched in an emergency release October 21. Cloudflare has observed millions of exploitation attempts, some delivering the Mirai-derived Potassium botnet; watchTowr has observed in-the-wild exploitation of both CVEs. As of Oct 26 exploitation is confirmed working, not just scanning: researchers took over an Apache mod_php honeypot, a European government entity was compromised with agentic-AI post-exploitation, and Mirai operators plus ASLR-bypass exploits have joined. CISA listed both CVEs in KEV on Oct 26 (federal remediation due Oct 29, forensic-triage flag set); on Oct 27 industrial vendors — Siemens, Schneider Electric, ABB, Johnson Controls, Belden, HMS, Wibu-Systems — confirmed PHP-based OT/ICS products affected, Belden NetModule NRSW without a patch.

Verdict: patch outside the normal cycle, and hunt while you patch. Unauthenticated RCE in the engine that runs most of the web, with exploitation observed in the wild and mass probing underway — this does not wait for the monthly window. Successful compromises are now confirmed (Oct 24–26) — treat unpatched internet-facing PHP as presumed targeted, and hunt back to Oct 20 when the details leaked. PHP 7.4 / 8.0 / 8.1 get no binary release — official source-backport branches and distro packages are the only routes, and migration is the real fix. The PHP team published official interim mitigations (below) for installations that cannot patch today. Hunting behaviors are published and concrete, which makes this one of the rare patch events that is also immediately huntable.

30-second read

Both flaws are use-after-frees in PHP core (session upload-progress handling and fatal-error paths), reachable without authentication. Observed exploitation recycles PHP workers, leaks memory through PHPSESSID cookies, and abuses session upload-progress handling to run shell commands; the observed exploit targets Apache mod_php, and exploitation is easier where session upload-progress is enabled. Some attempts fetch a Potassium loader from 92.118.112[.]100.

Fixed versions — October 21, 2026

Official mitigations (php.net) — if you cannot patch today

From the PHP team's advisory: these reduce exposure to the confirmed paths but "do not make an installation safe" — patching is the fix.

# CVE-2026-109619 (stale global state) — blocks the confirmed session path:
session.upload_progress.enabled=0     ; php.ini / FPM pool / server config,
                                      ; NOT ini_set() or .user.ini — then restart every worker
fatal_error_backtraces=0              ; PHP 8.5 only, blocks the fatal-backtrace path

# CVE-2026-109618 (OOM corruption) — starve the allocation-failure primitive:

memory_limit=-1                       ; via php_admin_value so apps cannot override
post_max_size = 8M                    ; (32M if uploads needed); upload_max_filesize below it

# plus web-server/proxy limits on decoded size, field/part/header counts, nesting —
# enforced even without a usable Content-Length
# availability boundary: container/cgroup limit killing only the worker.
# Do NOT use RLIMIT_AS / RLIMIT_DATA — they can trigger the vulnerable allocation failure.

Hunt — published behaviors

• Unusual multipart requests followed by memory-limit errors or HTTP 500 bursts
• Oversized or malformed PHPSESSID response cookies (memory-leak primitive)
• Unexplained PHP worker churn / recycling
• PHP worker processes (php-fpm, php-cgi, httpd, apache2) spawning shells, interpreters, or download tools; new webshells, cron jobs, accounts
• Outbound fetches to 92.118.112[.]100 and the campaign infrastructure — raw values on the IoC card (20 indicators)

Detection coverage — as of Oct 28

Inferred detections — while you wait

The behaviors above are published (Wiz, Huntress) but no vendor has shipped ready-made queries. These translate the published behaviors into generic query logic — tune thresholds to your traffic.

Exploit attempt shape — multipart request then memory error, from the same source:

# web / LB logs
multipart POST (content-type contains multipart/form-data)
followed within 60s by status 500 from same src_ip
| count by src_ip over 10m → investigate bursts; mass probing will be loud

Memory-leak primitive — the PHPSESSID leak is visible in responses:

# proxy / web logs with response headers
response Set-Cookie contains PHPSESSID AND cookie length > 1KB
→ near-zero false positives; any hit is an exploitation attempt that got traction

Post-exploitation lineage — the published Huntress behavior as a query:

# EDR process lineage
parent.name IN (php-fpm, php-cgi, apache2, httpd)
child.name IN (sh, bash, curl, wget, perl, python*)
also: php-fpm "child exited on signal" bursts in syslog (worker churn)

Splunk (index=*) / Elastic ES|QL (FROM logs-*) — CIM Web / Endpoint field names for Splunk, ECS for Elastic, Sysmon names for lineage; tune to your add-on or integration:

# exploit attempt shape: multipart POST then HTTP 500 from the same source inside 60 s
index=* earliest=-30d@d ((http_method=POST http_content_type="multipart/form-data*") OR status=500)
| transaction src maxspan=60s
| search http_method=POST status=500
| stats count as pairs min(_time) as first max(_time) as last values(uri_path) as paths by src
| sort - pairs

# memory-leak primitive: oversized PHPSESSID in responses

index=* earliest=-30d@d "Set-Cookie" "PHPSESSID"
| regex _raw="PHPSESSID=[^;\s]{1024,}"
| stats count by src dest uri_path

# post-exploitation lineage (Sysmon EID 1 / EDR)

index=* earliest=-30d@d ParentImage IN ("*/php-fpm*","*/php-cgi*","*/apache2","*/httpd")
    Image IN ("*/sh","*/bash","*/dash","*/curl","*/wget","*/perl","*/python*")
| stats count values(CommandLine) as cmds min(_time) as first by host ParentImage Image

# worker churn (syslog)

index=* earliest=-30d@d "php-fpm" "child" "exited on signal"
| timechart span=10m count by host

# campaign infrastructure (Potassium loader)

index=* earliest=-30d@d (dest=92.118.112.100 OR src=92.118.112.100 OR url="*92.118.112.100*")
| stats count min(_time) as first by host src dest

// exploit attempt shape: multipart POST then HTTP 500 from the same source inside the same minute
// (ES|QL has no transaction; one-minute buckets approximate the 60 s window)
FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE (http.request.method == "POST" AND http.request.mime_type LIKE "multipart/form-data*") OR http.response.status_code == 500
| EVAL minute = DATE_TRUNC(1 minute, @timestamp)
| STATS posts = COUNT(*) WHERE http.request.method == "POST", errors = COUNT(*) WHERE http.response.status_code == 500, paths = VALUES(url.path) BY source.ip, minute
| WHERE posts > 0 AND errors > 0
| STATS pairs = COUNT(*), first = MIN(minute), last = MAX(minute), paths = VALUES(paths) BY source.ip
| SORT pairs DESC

// memory-leak primitive: oversized PHPSESSID in responses

FROM logs-*
| WHERE @timestamp > NOW() - 30 days AND message LIKE "*Set-Cookie*PHPSESSID*"
| WHERE message RLIKE ".*PHPSESSID=[^;\\s]{1024,}.*"
| STATS count = COUNT(*) BY source.ip, destination.ip, url.path

// post-exploitation lineage (endpoint process events)

FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE (process.parent.name LIKE "php-fpm*" OR process.parent.name LIKE "php-cgi*" OR process.parent.name IN ("apache2", "httpd"))
    AND (process.name IN ("sh", "bash", "dash", "curl", "wget", "perl") OR process.name LIKE "python*")
| STATS count = COUNT(*), cmds = VALUES(process.command_line), first = MIN(@timestamp) BY host.name, process.parent.name, process.name

// worker churn (syslog)

FROM logs-*
| WHERE @timestamp > NOW() - 30 days AND message LIKE "*php-fpm*child*exited on signal*"
| STATS count = COUNT(*) BY host.name, t = BUCKET(@timestamp, 10 minute)
| SORT t

// campaign infrastructure (Potassium loader)

FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE destination.ip == "92.118.112.100" OR source.ip == "92.118.112.100" OR url.full LIKE "*92.118.112.100*"
| STATS count = COUNT(*), first = MIN(@timestamp) BY host.name, source.ip, destination.ip

Timeline

• Oct 20Details of both flaws leak ahead of coordinated disclosure; PHP announces emergency release
• Oct 21Emergency release 14:00 UTC (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35); watchTowr reproduces CVE-2026-109618
• Oct 22Patch-focused advisories; exploitation reported for miners and a Linux proxy backdoor
• Oct 23Mass exploitation attempts (Cloudflare: millions), Potassium botnet delivery attempts; no confirmed successful compromises reported. PHP issues a follow-up advisory: CVE-2026-115560, another session-upload-progress flaw needing a specific serialize_handler runtime-switch setup — keep session.upload_progress.enabled=0 until the next bugfix release
• Oct 24–26Exploitation confirmed working: researchers compromise an Apache mod_php honeypot; a European government entity is reported compromised via PHP2Shell with agentic-AI post-exploitation; Mirai botnet operators join and ASLR-bypass exploits emerge (SecurityWeek, BleepingComputer, The Hacker News). CVE-2026-115560 remains unpatched — the session.upload_progress.enabled=0 mitigation stands
• Oct 26CISA adds both CVEs to KEV (due Oct 29, forensic-triage flag) and revises its alert: patch now, take unpatchable or ≤8.1 PHP systems offline, Sigma rule attached
• Oct 27Industrial vendors (Siemens, Schneider Electric, ABB, Johnson Controls, Belden, HMS, Wibu-Systems) publish advisories listing affected PHP-based OT/ICS products; Belden NetModule NRSW has no patch (SecurityWeek). CVE-2026-115560 still mitigation-only

Sources

PHP — official announcement · GHSA — CVE-2026-109618 · GHSA — CVE-2026-109619 · Huntress — PHP2Shell · watchTowr — exploitation · The Hacker News — mass attempts, Oct 23 · Wiz — behaviors · Tenable FAQ · Censys live advisory · CISA KEV catalog — both CVEs, added Oct 26 · CISA alert — revised Oct 26, Sigma rule · SecurityWeek — OT/ICS vendor advisories, Oct 27