Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on any PHP installation serving web requests. The pair, nicknamed PHP2Shell, carry a CVSS 4.0 score of 9.2 and were added to CISA's Known Exploited Vulnerabilities catalog on October 26, 2026.
Palo Alto Networks' Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to the two bugs. That number covers PHP running behind Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, which together host a large share of the web.
The PHP Group released fixed versions on October 20, 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA's alert urges organizations to patch immediately and to take PHP-based systems offline if they cannot update right away, including servers still running PHP 8.1 or earlier, which are already out of support. The reader who runs a site on PHP should check their version before reading further; the fix is a routine upgrade, not a migration.
How the bugs work
CVE-2026-109618 stems from how PHP handles out-of-memory errors. When the engine calls longjmp() to recover from an OOM condition, it leaves request memory uninitialized because of improper control flow management. An attacker who can trigger an OOM condition can use that uninitialized memory to achieve reliable remote code execution.
CVE-2026-109619 is a close cousin. The same longjmp() fatal-error path leaves global memory pointing at freed regions. Those regions can later be read or branched on during subsequent requests, which lets an attacker execute arbitrary code on the server.
Both flaws sit in the engine's error-handling core, not in a single extension or framework. That is why the affected list spans every common server API for PHP, and why a web application firewall only buys time rather than closing the hole. A firewall rule can block a known payload signature, but it cannot fix memory that the engine failed to initialize.
Active exploitation is already underway
Unit 42 confirmed on October 29, 2026, that attackers are chaining PHP2Shell with a Linux kernel privilege-escalation bug to gain root access. The campaign, first reported by Dream Research, targets PAN-OS management interfaces exposed to the internet. Unit 42 independently verified the attacker tooling and reproduced the results.
By default, PAN-OS management interfaces are not reachable from the internet, and only about 0.02 percent of Palo Alto's global installed base had them exposed and was affected. Each of those customers was contacted individually. Customers who applied the available PAN-OS fixes are not affected, because the fixes interrupt the observed exploit chain.
The October 23 update from Unit 42 was retracted five days later. Researchers had initially linked post-compromise activity at a European government agency to PHP2Shell, but could not confirm that initial access came from these specific CVEs. That retraction is worth noting because it shows how quickly attribution shifts while an incident is still fresh. It also cautions against treating every post-compromise finding as proof of a particular exploit.
What defenders should do now
CISA's guidance is blunt: inventory every system running any version of PHP, since PHP is often a component of other software and its presence may not be directly observable. Patch internet-facing systems first, and take unpatched or unsupported PHP systems offline until they can be updated. The agency's Known Exploited Vulnerabilities catalog now lists both CVEs, which means federal agencies had a binding deadline to remediate; private organizations face no such mandate but inherit the same exposure.
For organizations that need detection in the meantime, CISA published a SIGMA rule to spot suspicious activity in relevant log sources, including PHP worker processes launching shells or downloading tools. Unit 42 also published XQL hunting queries for Cortex XDR customers to search for post-exploitation command execution within PHP web server or worker processes. Detection is a stopgap, though. It tells you that something already happened; it does not keep the bug from being triggered in the first place.
Palo Alto Networks added protections through Advanced Threat Prevention signatures, Cortex Cloud and Prisma Cloud scanning for vulnerable PHP versions in code and container images, and Cortex Xpanse alerting through the PHP Attack Surface Rule. Those tools help, but they do not replace patching the underlying engine. A patched engine is the only state in which the vulnerability no longer exists.
Why this matters beyond PHP shops
PHP still powers a large share of the web, including most major content management systems. A bug in the engine's error path touches every site running on it, regardless of the application layer above. The 22.6 million exposed instances in Cortex Xpanse telemetry are a floor, not a ceiling, because many PHP deployments sit behind proxies or in internal networks that external scanning cannot see.
The more troubling detail is the root-access chain. A web-server RCE that stops at the web user is serious. The same RCE chained into a kernel privilege escalation that hands over root is a different category of incident, and it is already being used against real targets. Defenders who only watch the web tier miss the second half of that chain.
The patching gap is the real story
The fix exists and has existed since October 20. The risk now is operational, not technical. Organizations that run PHP as a transitive dependency inside larger platforms, or that maintain legacy applications on PHP 8.1 or earlier, may not even know they are exposed. CISA's instruction to take those systems offline until patched is the kind of guidance that only gets followed after an incident, not before.
It is not clear that the patching pace will match the exploitation pace. The window between disclosure and weaponization here was measured in days, not weeks, and the KEV listing on October 26 means federal agencies were already on a clock. For everyone else, the clock is self-imposed. See more cybersecurity coverage on this site.
For the official advisory and SIGMA detection rule, see CISA's alert on the PHP vulnerabilities. Unit 42's threat brief, including the XQL hunting queries, is published at unit42.paloaltonetworks.com.
The next few weeks will show whether the 22.6 million exposed instances shrink faster than new exploitation campaigns appear. Patching is the only fix that closes the door; detection and virtual patching only slow the traffic.