Last updated: 23rd October 2026, 13:00
| At a glance | |
| Threat | PHP2Shell (CVE-2026-109618 and CVE-2026-109619) |
| Severity | Critical, CVSS v4.0 9.2 for each |
| Status | Fixes available. Attack activity rising, with early signs of successful exploitation being investigated |
| New | A related PHP issue, CVE-2026-115560 |
This update builds on our earlier issued PHP2Shell advisories.
Summary
Attack activity has risen sharply since PHP released fixes on 21 October. The Dutch NCSC is now investigating the first signs of successful exploitation, an exploit that defeats a key memory defence has been reported, and PHP has disclosed a further, related issue. If you have not yet patched, that remains the priority.
What has changed
A new, related issue: CVE-2026-115560
PHP published an advisory on 23 October for a separate flaw that could allow code execution. The 21 October fixes do not cover it. PHP considers it unlikely in practice and is not issuing an emergency fix.
It only affects applications that:
- Set session.serialize_handler to php_binary or php_serialize in their configuration
- Switch it to php at runtime using ini_set(), before calling session_start()
- Still have session upload progress enabled
The fix will arrive in PHP's next routine release. PHP has not yet said which versions are affected, given a severity score, or said whether it shares a root cause with CVE-2026-109619. No exploitation has been reported.
Attack activity is rising
- The Dutch NCSC had said it only saw attempts. It now says it is receiving the first signals, through contact with organisations in the Netherlands and abroad, that the flaws are being exploited successfully
- One security firm says it has built what it believes is the first exploit to achieve code execution on x86-64 servers with ASLR enabled and PHP's recommended production configuration. It works against PHP 8.4.10 to 8.4.26 and is being shared only with its customers
- Cloudflare reports attempts rising from tens of thousands within 45 minutes of disclosure to millions by early 22 October, with attackers altering their payloads to get past its protections
- Amazon saw multiple attempts from 21 October, the first around 02:00 UTC, from several actors. It describes its earlier 17 October attempt as largely a probe
- Attackers have tried to use the flaws to install a Mirai botnet variant. Those attempts have so far failed
- Some vendors report scanning and probing but no confirmed code execution
- Neither CVE was in CISA's Known Exploited Vulnerabilities catalogue as of 23 October
The UK picture
Government services. The tech minister, Baroness Lloyd of Effra, told the House of Lords on 22 October that 32 government services were unavailable and four partially unavailable. She said this was largely down to precautionary measures while updates and mitigations are applied. No confirmed compromise has been reported.
UK NCSC. Its alert, published on 21 October and since updated, says organisations using any version of PHP are affected. It tells UK organisations to identify every PHP system rather than only outdated ones, update, apply PHP's temporary mitigations if they cannot, and consider taking a system offline if they can do neither. It also says that if a system cannot be updated or disabled immediately, it should be assessed for evidence of compromise first, including backdoors, with help from an NCSC-assured Cyber Incident Response provider if needed. The NCSC says it will continue to monitor for any impact on UK organisations.
What the world is seeing
Broad scanning. Several providers report wide, untargeted scanning for vulnerable PHP servers, and reconnaissance across PHP applications.
Exploit tooling and bots. Write-ups and an exploit tool are public. Researchers report scanners built on the documented techniques, existing multi-exploit bots adding PHP2Shell, and scanners that try to install a botnet loader. One of the teams that found the flaws has shown them chained into a single working exploit against WordPress, Drupal and Joomla in lab conditions, and says AI models helped it find and chain the bugs.
Fake and booby-trapped exploits. Public proof-of-concept code is circulating, but its reliability is disputed. One security firm says hundreds of proof-of-concept repositories have appeared on GitHub and only a very small number are legitimate exploits. Researchers have also found fake proofs of concept that carry prank malware, including one that changes the victim's wallpaper. Treat any public exploit code as hostile.
The criminal underground. Demand for a working exploit is high across cybercrime communities. A claim that someone had exploited it successfully was not substantiated. Some well-known criminal forums reportedly took themselves offline as a precaution.
Organisations taking sites offline. Government websites in Germany, France, Belgium, Finland and the Netherlands were taken offline as a precaution, along with the website of Australia's cybersecurity agency. Dozens of UK government services have been affected too.
Faster exploitation. Amazon's view is that AI-assisted analysis is shrinking the time from patch to working exploit to hours, or even minutes.
What an attack looks like
PHP, Wiz and others have published enough detail to explain the shape of an attack, and we have kept to that level. We are deliberately not showing payloads, offsets or request contents.
The key point is that PHP has demonstrated, against Apache with mod_php, that the request is dealt with inside PHP before the application's own login, MFA or logging has a chance to run.
Researches and our teams have observed that a successful attack can leave almost nothing behind. Workers stay stable, responses return normal codes and application logs show no anomalies, because no application code runs. The only server-side trace it describes is a single memory-limit fatal error in the web server's error log.
The FBI advises monitoring for PHP processes unexpectedly launching command shells or downloading files.
Government guidance
The UK NCSC and CISA have both urged organisations to apply the fixes as soon as possible, or consider taking affected systems offline.
Recommended actions
- Identify systems running PHP, prioritising internet-facing ones. Do not limit discovery to outdated versions, and include PHP bundled in appliances and hosted services
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package, and restart every worker. Do internet-facing systems first, then internal ones
- Set session.upload_progress.enabled=0, restart every worker, and keep it off until PHP's next release. It blocks the confirmed session paths for CVE-2026-109619 and is PHP's recommended mitigation for the new issue
- If you cannot update, apply PHP's other temporary mitigations. If you cannot apply them, or they would take too long, consider taking the system offline until it is fully mitigated, as the UK NCSC advises
- If you cannot update or disable a system immediately, assess it for evidence of compromise first and look for backdoors. If you are not confident doing this yourselves, use an NCSC-assured Cyber Incident Response provider
- Follow up any unexplained memory-limit errors in web server logs
- Keep monitoring updates from third-party vendors, including appliances and services that bundle PHP. The Dutch NCSC has published an inventory of software products with a PHP dependency
- Do not run public exploit code on your own systems
- If you run a PHP branch that is no longer supported, ask your vendor about a backport or plan the move to a supported version. One internet scan counted 4.38 million internet-facing PHP services as of 20 October, and 79 per cent were on an unsupported branch
In summary
Attack activity is rising, early signs of successful exploitation are being investigated, and PHP has disclosed a further, related issue. Patching the 21 October releases remains the priority, and session upload progress should stay off until PHP's next release.
Nomios is continuing to monitor, threat hunt and follow this situation closely. If you have any questions or queries, contact your account manager or the Nomios team at [email protected]
Get in touch with our industry experts
Combining deep industry expertise, advanced security and network capabilities and human-led design methodologies to enable clients to act with speed and confidence.
