PHP2Shell: the PHP RCE that cannot wait for the next patch cycle

On October 21, 2026, the PHP project released emergency security updates for two memory-corruption flaws that allow unauthenticated remote code execution. The pair is tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell".

Five days later, on October 26, CISA added both to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The European Commission, ENISA, CERT-EU, Europol and the CSIRTs network issued a joint statement when the patches shipped.

This is not a theoretical bug in an obscure component. PHP serves a large share of the web, including most content management systems, internal tools and APIs.

What is affected

CISA describes the impact as unauthenticated RCE in "all PHP installations serving web requests", including:

• Apache with mod_php, which PHP considers the highest-risk configuration.
• PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

Fixed releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and earlier are unsupported and will not receive a fix. CISA's guidance is blunt: systems that cannot be updated immediately, or that run PHP 8.1 or older, should be taken offline until they can be patched or updated.

One more detail matters for inventory: PHP is often embedded in other software. ENISA warns that third-party products may be affected "even if they do not appear to use PHP directly". Your hosting panel, a vendor appliance or a legacy intranet may ship its own runtime.

Why this one is urgent

Three things make this different from a routine patch cycle:

1. No credentials are needed. An attacker does not have to phish an employee or steal a session.
2. Exploitation is confirmed. KEV inclusion means CISA has evidence it is happening, not just a proof of concept.
3. The exposure is invisible in many inventories. A PHP runtime inside a container, a sandbox or a forgotten staging site does not show up in the same place as the main website.

A web application firewall "may provide some protection" while you patch, according to CISA, but it is not a fix. The agency explicitly recommends patching internet-facing systems first.

A patch-and-verify sequence

1. Inventory the runtime. Run php -v on every host and check the PHP version inside containers, CI images and vendor appliances. Do not trust the version in a ticket.
2. Patch the internet-facing systems first. Apply 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or the web server so the new binary is actually loaded.
3. Rebuild images, do not just change tags. A container pinned to an older base image stays vulnerable even if the tag name looks current.
4. Isolate what you cannot patch. If a legacy system runs PHP 8.1 or older, take it off the public internet or put it behind an authenticated proxy until it can be retired.
5. Verify the fix. Request the application again, confirm the runtime version from the host, and keep the evidence.

What to look for if you were exposed

CISA recommends monitoring for PHP worker processes launching shells or downloading tools, which is not normal application behavior. Also review:

• Unexpected files in web roots, especially recently modified PHP files.
• New or changed scheduled tasks, cron entries and service definitions.
• Outbound connections from web servers to unfamiliar hosts.
• Authentication logs for access you cannot explain.

If you find signs of compromise, isolate the host, preserve logs before rebuilding, and rotate credentials and secrets that the application could read.

The EU angle

The ENISA joint statement connects the flaw to the Cyber Resilience Act. The CRA's active-exploitation reporting duty began on September 11, 2026, while the main requirements apply from December 11, 2027. Manufacturers placing products with digital elements on the EU market should confirm whether their reporting process covers a component like PHP, even when they did not write it.

For a small company selling software in Europe, the practical takeaway is the same as the technical one: you need an inventory that reaches third-party components, and a record that shows you acted on a known exploited vulnerability.

Where an audit fits

If you are not sure which PHP runtime is exposed, Izkuna's Exposure Snapshot maps the external surface in three days at the current launch price of $300. The Web Security Audit — Express reviews the application and its server configuration in five days at $600 launch, and Retest & Remediation Verification documents that the patched version is the one actually serving traffic.

The goal is not to create panic. It is to replace "we think we patched it" with evidence.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• ENISA: Joint statement on critical PHP vulnerabilities
• CISA: Known Exploited Vulnerabilities Catalog

If you need a fast, independent check of what is exposed, start with a free 30-minute diagnostic.