Hackers are already exploiting critical flaws in PHP, the language behind 70% of websites

On October 24, three decoy servers set up by Adel Karimi, a security researcher at Perplexity, recorded 35 successful command executions. The attacks came from two IP addresses. They targeted Apache servers (mod_php) running PHP 8.4.26, a version that predates the patch. Two days later, on October 26, the US cybersecurity agency (CISA) added the two flaws nicknamed PHP2Shell to its Known Exploited Vulnerabilities (KEV) catalog.

The flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10. They can allow an attacker without an account to execute code remotely on an unpatched PHP server. The language runs about 70% of websites. The PHP team released the patches on October 21, after technical details leaked. Cyberiack previously reported on how these two flaws leaked before their patch.

The versions to install without delay

According to The Register, the patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, depending on your branch. Servers still running a branch that is no longer maintained must be upgraded or receive a patch from their provider. Otherwise, they should be taken off the internet. US federal agencies had until October 29 to comply. That deadline does not apply to businesses, but CISA urges them to treat these flaws as a priority.

A third flaw, CVE-2026-115560, still has no patch. The PHP team released a workaround on October 23. It reportedly can only be exploited in an unusual combination of settings and application code. Cyberiack detailed the setting that protects against it.

What the observed attacks show

Attempts began early. According to Amazon, they date back to October 17, four days before the patches. Cloudflare, Hadrian, watchTowr and Patchstack also reported attempts before the release, but according to them none had succeeded.

Adel Karimi's findings change the picture. According to The Register, the attackers combined memory exhaustion with disclosure of its contents to execute code remotely. They then tried to download other tools with PHP, curl and wget, without success. The traces match the first flaw, CVE-2026-109618. The researcher warns, however, that his decoy servers were configured in a "favorable" way, with a single worker process. Production servers may therefore be harder to reach.

Meanwhile, the threat intelligence lab at Delft University counted more than 50,000 exploitation requests from more than 600 IP addresses in 70 countries. Of these, 171 addresses sent attack code or the means to install malware.

Several announcements have since been corrected. Sophos reclassified its first observations as simple scans and failed attempts. Palo Alto Networks withdrew its claim linking these flaws to an intrusion at a European government agency. CISA, for its part, has not named any victim.

What to do

The patches have been available for a week: the job is mostly about finding every affected server.

• Take inventory of all your PHP servers: websites, intranets, internal tools, containers. Check the version with php -v or through your host's diagnostic page.
• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, ask your host whether this has already been done.
• If a server remained exposed without a patch after October 17, look in the logs for unusual outbound calls, for example curl or wget launched by the web server.
• Isolate or shut down servers that cannot be patched.

It remains to be seen whether compromises will be confirmed on real websites. So far, no victim has been publicly named.