PHP2Shell: Keep Calm & Carry On

tl;dr: there was a major vulnerability in PHP, we patched it and if you’re a client of ours you’re ok. Keep calm and carry on.

If you want more details…

What is PHP2Shell?

Earlier this year, researchers using AI found a Remote Code Execution (RCE) vulnerability in PHP (a coding language that powers a lot of the modern web). While this was not an easy vulnerability to exploit, with the additional resources available by using AI, it became possible for attackers to execute code without any authentication required.

This was done through a pair of Common Vulnerabilities and Exposures (CVEs), known as CVE-2026-109618(opens in new tab) and CVE-2026-109619(opens in new tab), which were named PHP2Shell(opens in new tab). Their score on the Common Vulnerability Scoring System was a 9.2 out of 10, which is quite high, showing the severe nature of the vulnerability.

With the increase in use of AI for malicious intentions, the community was aware that once the patch was announced, attackers would begin probing for insecurities within minutes of the announcement of the patch. For this reason, releasing news about this vulnerability was embargoed, but the folks at Chainguard broke the embargo, which started attackers looking for the vulnerability before the patch was released. As a result, this announcement and the rush to patch it were more chaotic than they otherwise would have been.

PHP patches(opens in new tab) were released by the PHP Foundation at 9:00 AM EST on 10/21/2026 and we, and just about everyone else on the internet, got to work immediately applying the patches.

Then what happened?

As expected, bots began probing the web at a rate significantly higher than the baseline. It is clear bad actors were scouring the web looking for this vulnerability.

To address it, we, and our partners, took a series of steps intended to protect our clients from the most serious risks first, and then added and refined protection to address the additional risks and stress on resources from increased bot activity.

• Added/updated Web Application Firewall (WAF) rulesets and PHP settings to reject and mitigate the malicious queries that could trigger this vulnerability.
• Immediately began applying the patches across the whole of our client infrastructure.
• Updated and refined traffic filters to challenge and block traffic from suspected malicious regions and endpoints.
• Increased active scanning across all client sites to look for unusual activity or anomalous behavior.

What’s happening now?

While it is clear there are still a lot of bots prowling across the web probing for sites and servers that are vulnerable to this method of attack, the majority of the risk for our clients appears to have passed. All sites have been patched, there has been no anomalous behavior (with the exception of the increased bot activity looking for vulnerabilities), all proactive scans are clean, and we are continuing to challenge and block the increased bot traffic. This last effort has seen site performance stabilize, as the sheer volume of bot activity was essentially acting as a Distributed Denial of Service (DDOS) attack.

What do you need to do?

If you’re a client of ours, you don’t have to do anything. You’re good. No, you’re great. Thanks for being you.

If you’re not a client of ours, you’ll want to consider copying and pasting the note below and sending it to your hosting provider.

Which version of PHP are we currently running?

If they respond with anything older than 8.1, you are vulnerable. Additionally, those older versions of PHP are no longer receiving updates, so you’ll want to migrate/upgrade to a more recent version of PHP. (If you need help with that, you’re welcome to contact us(opens in new tab).)

The versions that are patched against this vulnerability are:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

Which means if you get a response that is even one version prior to those (e.g. 8.5.11, 8.4.26, 8.3.35, or 8.2.34 or older) you’re also vulnerable and should upgrade as soon as possible.