2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming: What We Know About php2shell
جدول المحتويات
PHP shipped an emergency security release on 21 October 2026 at about 13:35 UTC, some 25 minutes ahead of schedule, for two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. PHP now confirms they can allow unauthenticated remote code execution, and researchers call them “php2shell”, a name implying an attacker could obtain a shell on a vulnerable server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The incident started with a leak. On the morning of 20 October, a since-removed Hacker News post claimed the two flaws were about to be disclosed; within hours, watchTowr confirmed they were real and said it had reproduced CVE-2026-109618. The PHP security team then scheduled its release a day earlier than the original embargo, and in the end shipped it ahead of that new deadline.
The stakes come from PHP’s reach: it powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and a lot of vendor software that does not advertise it. Attacks started before the patch: at 07:43 UTC, Cloudflare’s CTO reported early attacks emerging, و Aikido has also reported exploitation in the wild. Sansec had warned of mass exploitation within 15 minutes of the release.
The fix happens at the infrastructure level: updating PHP on the server is the only official remediation, and CMS or plugin updates will not apply it.
A Free PHP Check is available هنا.
Paste your domains, see which sites still run a PHP version exposed to php2shell, ranked by what to patch first.
Timeline
The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October at 14:00 UTC, then shipped it about 25 minutes early.
You can review the technical timeline in more detail below.
| Date (UTC) | Event | مصدر |
|---|---|---|
| 21 Oct, 13:35 | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, about 25 minutes ahead of schedule, with minimal source patches for PHP 7.4, 8.0 and 8.1 | Help Net Security |
| 21 Oct, 09:18 | Aikido reports exploitation in the wild, citing Cloudflare | Aikido |
| 21 Oct, 07:43 | Cloudflare’s CTO reports early attacks; Cloudflare’s WAF rules are extended to every plan, including Free | Mattias Geniar |
| 21 Oct | Cloudflare pushes an emergency update to its managed WAF ruleset, adding four rules understood to target these flaws (its changelog does not mention PHP) | The Repository |
| 21 Oct | A site claiming to publish working exploit code goes public; WordPress hosts reportedly start disabling session.upload_progress | The Repository |
| 20 Oct | CERT-EU publishes Security Advisory 2026-018 | CERT-EU |
| 20 Oct | PHP security team posts advance notice: two critical vulnerabilities, both CVSS v4.0 9.2 | CERT-EU |
| 20 Oct | watchTowr confirms the leaked vulnerabilities are real and names CVE-2026-109618 and CVE-2026-109619 | The Repository |
| 20 Oct | A Hacker News post, since removed, reports two upcoming PHP RCE disclosures, breaking the embargo | The Repository |
What we know about the vulnerabilities
PHP has now published the fix and its advisory; some details still come only from researchers and should be treated as provisional.
Confirmed by PHP
- تأثير: PHP’s release announcement describes two critical vulnerabilities that can allow unauthenticated remote code execution, and now names CVE-2026-109618 and CVE-2026-109619 itself.
- Component: the PHP changelog lists both fixes under Core, as two GitHub security advisories that avoid state corruption via “bailout”, a mechanism inside the interpreter itself. Researchers, including Mattias Geniar, link the confirmed attack paths to session upload progress and multipart request parsing, both enabled by default.
- Nature: CVE-2026-109619 is described as remote code execution via stale global state: internal state that survives after the memory behind it has been freed.
- تخفيف: PHP states that there are no complete mitigations and updating is the only safe choice.
- Scope: every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and the PHP team reports finding the flaws in every PHP version since PHP 5.
Reported, not confirmed by PHP
- Exploitation at scale: Cloudflare و Aikido report attacks in the wild.
- Public exploit code: proof-of-concept code is circulating. Before the release, Tenable could not verify that any of it worked; since then, Help Net Security reports that a working exploit has shown a single unauthenticated request can trigger the attack.
- Nature: before the release, GMO Flatt Security read a researcher’s demo video, labelled “php2shell”, as showing a memory corruption bug, reproduced on mod_php and PHP-FPM and on WordPress, Laravel and Symfony setups.
Affected versions and patch status
Only the four supported branches, PHP 8.2 to 8.5, received official releases. For PHP 7.4, 8.0 and 8.1, the PHP security team published minimal source backports, but these are meant for people who build PHP themselves and are not something a hosting account can apply. PHP publishes nothing for older branches, although some distributions and LTS vendors may backport fixes.
| PHP branch | Support status | Fix |
|---|---|---|
| 8.5 | Active support | 8.5.12 |
| 8.4 | Active support | 8.4.27 |
| 8.3 | Security fixes only | 8.3.36 |
| 8.2 | Security fixes only, until 31 Dec 2026 | 8.2.35 |
| 7.4, 8.0, 8.1 | End of life | No official release; minimal source patches only |
| 7.3 and older | End of life | None from PHP |
Being on a supported branch is not enough on its own: the server must run the new patch level, and Linux distributions that package PHP may ship the fix under their own version numbers, so check your vendor’s advisory. Support dates are based on the php.net supported versions timetable, as reported by mySites.guru.
Exposure: how many assets, and where
About 2.24 million internet-facing hosts advertise PHP, and 59% of those that report a version (883,717 of about 1.5 million) run a branch with no official release. These figures come from Shodan banner counts published by Mallory on 20 October 2026; they count hosts, not organisations or websites.
By version
PHP 8.2 to 8.5 account for 612,269 versioned hosts and are covered by the official release. PHP 5.x (368,570), 7.x (329,358) and 8.0–8.1 (185,789) are not; only some of the 7.x, 8.0 and 8.1 hosts can benefit from PHP’s source patches, if their operators build PHP themselves. PHP 5.6 and 7.2 alone represent about 371,000 hosts for which PHP publishes no fix at all.
By country
The United States has the largest number of hosts with no official release (228,770), followed by China, Japan and Germany. Among these ten countries, Algeria (100%, almost entirely PHP 5.3 on Telecom Algeria), South Korea (82%) and China (75%) have the highest shares. France counts 25,439 such hosts, 54% of its versioned PHP hosts.
By hosting provider
Exposure is concentrated: Amazon (293,480 PHP hosts), Hostinger (142,401) and Alibaba Cloud (81,078) host the largest PHP populations, which makes provider-side patching decisive.
ووردبريس
وفقاً ل WordPress.org statistics reported by The Repository, 35.1% of WordPress sites run a PHP version the PHP project no longer supports, including 16.46% on PHP 7.4. Across the live Joomla and WordPress sites mySites.guru monitors, 22.7% run PHP 8.1 or older.
Limits of these numbers
The real exposure is higher than banner counts suggest: about 740,000 PHP hosts hide their version, and shared hosting puts many websites behind one IP. Conversely, some Linux distributions (Debian, Ubuntu, RHEL) and LTS vendors backport fixes to older packages, so some hosts that report an old version may already be patched.
A different count puts France first
Measuring active PHP services rather than hosts, Infrawatch observes about 11 million services across 4.38 million IP addresses, with France at 6.62 million, more than eight times the United States. Much of that concentration comes from Freebox OS, the management software of Free’s home routers; Infrawatch stresses this does not mean these hosts are exploitable.
What we see across the assets we scanned
After the release, CybelAngel scanned 1.3 million internet-facing assets. Among the sites that reveal their PHP version, 54% run an end-of-life branch.
Recommendations
The fix is out: patch PHP itself now; every other measure only buys time.
- Inventory every internet-facing PHP asset, including those run by hosting providers, agencies and appliance vendors, and record the branch and SAPI (PHP-FPM, mod_php, php-cgi).
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM or the web server so the new interpreter is loaded. Check the version the site reports while serving a request, not
php -v, as the two binaries often differ. - On managed hosting, confirm with your host that the patch is applied, and take a fresh backup before anything changes on the server.
- Upgrade end-of-life branches (8.1 and older) to a supported version, or ask your distribution or LTS vendor for a backported fix. Until then, restrict access (VPN, IP allowlist) or isolate internet-facing applications, as CERT-EU recommends.
- Reduce exposure until you patch: take internet-facing PHP applications offline where you can.
- Check for compromise after patching, going back to at least June 2026: web shells, unexpected or modified PHP files, new admin users and unusual outbound connections. Watch for unexpected child processes of the web server, reduce the data and cloud privileges held by PHP servers, and check that logs are retained.
How CybelAngel is helping
Our teams are reviewing the external perimeters we monitor for the signals that matter here: exposed web servers, outdated software stacks and PHP-based control panels. Where we see heightened risk, we are reaching out to customers directly. If you are not a CybelAngel customer and want to understand your external exposure, contact our team.
Updated on 21 October 2026 after PHP’s security release. We will keep updating this article as exploitation data and vendor advisories emerge.
عن المؤلف
