Intelligence briefFall/Winter 2026/2027 Edition
PHP2Shell demands patching and a look back for compromise
October's PHP2Shell flaws can expose web servers before application checks run. This November 3 review explains how to verify runtime fixes, investigate earlier activity, and avoid false reassurance.
At a glance
TR-03 · Technology risk
- Status
- Ongoing risk. CISA added both PHP2Shell vulnerabilities to its exploitation catalog on October 26; this brief reviews the response as of November 3.[5]
- Vulnerabilities
- CVE-2026-109618 and CVE-2026-109619[1]
- Disclosure and fixes
- October 21, 2026[1]
- Earlier attempt
- October 17 in Amazon MadPot telemetry[2]
- First fixed releases
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35[1]
- Response principle
- Patch exposure and investigate the preceding window[2]
What happened
PHP released fixes on October 21 for unauthenticated remote code execution in web-serving installations. This November 3 review calls for runtime verification and an exposure-window investigation. [1][2]
- PHP names memory corruption and stale request state, identifies mod_php as highest risk, and also lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. [1]
- Amazon reported an exploitation attempt in its MadPot sensors on October 17, four days before public disclosure. Its October 21 report describes additional attempts, while explicitly leaving real-world success of the analyzed payloads uncertain. Attempts are not a confirmed victim count. [2]
- CISA's original October 21 bulletin said the agency had not observed exploitation at publication. Its later catalog added both flaws on October 26. Those statements describe different evidence dates and should not be collapsed into a contradiction. [3][5]
- Cisco's product advisory, updated October 30, provides product-specific exposure and fixed-release information. Embedded PHP needs vendor guidance, not an assumption that updating the host operating system fixes every appliance. [4]
How it works
The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.
- entry
- next step
- impact
Read the attack chain
The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
CISA added both PHP2Shell vulnerabilities to its exploitation catalog on October 26; this brief reviews the response as of November 3.
The vulnerable component is the runtime serving requests. PHP describes a demonstrated mod_php attack before application code executes. [1]
The flaws affect internal PHP memory and request state. Application authentication cannot substitute for updating the runtime. [1]
CISA advises watching PHP workers for shell launches and tool downloads. Such activity warrants investigation alongside its legitimate application context. [3]
Installing a fix prevents the addressed path from remaining exposed; it does not retrospectively establish that no intrusion occurred. Amazon recommends investigating back to at least October 17. [2]
Risk follows PHP usage, including components your application team may not directly maintain. [3]
- entry
- next step
- impact
Tap a node to read its story.
Step by step
-
A web request reaches PHP
The vulnerable component is the runtime serving requests. PHP describes a demonstrated mod_php attack before application code executes. [1]
-
Runtime memory state fails
The flaws affect internal PHP memory and request state. Application authentication cannot substitute for updating the runtime. [1]
-
The web process becomes a foothold
CISA advises watching PHP workers for shell launches and tool downloads. Such activity warrants investigation alongside its legitimate application context. [3]
-
Earlier access remains unresolved
Installing a fix prevents the addressed path from remaining exposed; it does not retrospectively establish that no intrusion occurred. Amazon recommends investigating back to at least October 17. [2]
Who is at risk
Risk follows PHP usage, including components your application team may not directly maintain. [3]
- Internet-facing web services using vulnerable PHP builds. [1]
- Organizations with PHP embedded in packaged software or appliances. [3][4]
- Older installations without a verified vendor backport or a supported upgrade path. [1]
Sectors in scope
- Operators of PHP web applications
- Managed hosting and application service providers
- Organizations running products with embedded PHP
What changed since the last edition
Fall/Winter 2026/2027 Edition3 changes
-
October 21: PHP supplied fixed releases, while Amazon published evidence of attempts predating that disclosure.
Source 2 -
October 26: CISA added both vulnerabilities to its Known Exploited Vulnerabilities Catalog.
Source 5 -
October 30: Cisco finalized an updated product advisory, reinforcing the need to check each affected product separately.
Source 4
What to do now
In priority order, highest impact first.
-
Do firstFind every PHP runtime and assign a patch owner.
CISA warns that PHP can be hidden inside other software; begin with reachable web services and supplier-managed systems. [3]
-
Install the applicable fixed release or verified vendor update.
PHP provides fixes across its supported release branches and directs distribution users to their vendors. [1]
-
Restrict or take unpatchable affected services offline.
CISA recommends taking affected systems offline when they cannot be updated; firewall filtering offers only partial interim protection. [3]
Indicators
Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.
| Type | Indicator | Source |
|---|---|---|
| behavior | PHP worker processes launching shells or downloading tools unexpectedly. | [3] |
Sources
Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.
- [1] Security advisory: Critical remote code execution vulnerabilities, update now (opens in a new tab) PHP Group · October 21, 2026 · php.net
- [2] Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (opens in a new tab) AWS Security Blog · October 21, 2026 · aws.amazon.com
- [3] Critical Vulnerabilities in PHP Require Immediate Patching (opens in a new tab) CISA · October 21, 2026 · content.govdelivery.com
- [4] Vulnerabilities in PHP Affecting Cisco Products: October 2026 (opens in a new tab) Cisco · Published October 21; updated October 30, 2026 · sec.cloudapps.cisco.com
- [5] Known Exploited Vulnerabilities Catalog, PHP entries (opens in a new tab) CISA · PHP entries added October 26, 2026; catalog reviewed November 3 · raw.githubusercontent.com
What does this mean for your security?
Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.