US cyber agency confirms PHP2Shell exploitation and sets patch deadline

Researchers confirmed execution on deliberately favourable decoys

Adel Karimi, Perplexity’s detection and response lead in October 2026, recorded 35 successful shell executions on 24 October across three honeypots—decoy systems used to observe attackers. A shell executes system commands. The attacks came from two IP addresses and targeted PHP 8.4.26 through Apache mod_php, which runs PHP within the web server, The Register said on 27 October.

The attacks exhausted memory and disclosed its contents to achieve remote code execution—running code on a server from elsewhere. Karimi found evidence consistent with CVE-2026-109618, but none involving the second PHP2Shell flaw. Attackers tried to contact external servers using PHP and the download tools curl and wget; no additional malware was successfully downloaded. The decoys used an intentionally favourable single-worker configuration, with one process handling requests. Karimi warned that the results do not measure reliability with other worker counts, PHP builds or applications.

BleepingComputer’s 26 October account described an 800 KiB decoded cookie dump and a function address derived from it that appeared in the later execution payload. This connected usable memory disclosure to code execution, rather than merely a crash followed by suspicious activity. Expel threat researcher Marcus Hutchins corroborated the findings and called them the highest-quality confirmation of in-the-wild PHP2Shell exploitation he had seen. CISA had shared a SIGMA detection rule for exploitation attempts on 23 October, before its formal listing.

Delft counted attempts, not production breaches

Delft University’s Threat Intelligence Lab tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those addresses, 171 went beyond checking for vulnerable servers and sent exploit code or malware droppers—programs intended to install other malicious software. Sending that code does not establish that a receiving server ran it. CISA has not disclosed which organisations were compromised or how many production systems were breached; neither Delft’s request count nor Karimi’s decoy executions supplies that total.

Both flaws can allow code execution without a login

CVE-2026-109618 and CVE-2026-109619 are each rated 9.2 out of 10 in severity. Under suitable conditions, specially crafted web requests can let an attacker run code on a server without logging in.

A challenge demonstrated a target-specific compromise

UK-based developer and penetration tester Jaydip Modhwadia, known as “Killa,” won James Pavur’s Steal My Bitcoin challenge on 25 October. Pavur launched the intentionally vulnerable site on 24 October to test PHP2Shell against a live target. Community contributions raised his initial $500 Bitcoin prize to $2,000, The Register said on 26 October.

The original site served only static HTML pages. Although its PHP version was vulnerable, the attack path needed a reachable PHP file—an endpoint that processes a web request. The Register placed its apparent addition at about 13:00 UTC on 25 October and Modhwadia’s successful execution at 15:47 UTC. The site displayed 19.28 hours elapsed; Modhwadia said his own work took around three hours, began after the challenge attracted attention, and attributed the longer elapsed period to heavy demand making the site effectively unusable.

Pavur confirmed the compromise on 25 October. Tom’s Hardware’s 26 October account described memory disclosure followed by command execution inside PHP, with the final request returning evidence that the command ran. Pavur had placed the wrong wallet key on the server and subsequently sent Modhwadia the award.

The Register said the method bypassed Address Space Layout Randomization, or ASLR, which rearranges program data in memory to make exploitation harder. Modhwadia published a description and said his single-file script needed at most 20 web requests. Alon Gal, Hudson Rock’s co-founder and chief technology officer in October 2026, called the exploit sophisticated and target-specific. He said the result did not show that autonomous superintelligence (SI) agents could compromise arbitrary PHP servers at scale.

Unit 42 withdrew a government-breach link

Palo Alto Networks’ Unit 42 told The Hacker News in its 25 October account that it could not confirm whether either PHP2Shell flaw provided initial access to a European government agency. Researchers had inferred the link because the attack involved a vulnerable PHP application. That intrusion is not a confirmed PHP2Shell compromise.

CYFIRMA described scanning, not confirmed intrusions

In the 25 October account, CYFIRMA said 21 compromised machines were scanning 216 unpatched or partly mitigated hosts across government, finance, logistics, aviation, manufacturing and online transaction platforms. Operators kept traffic low and rotated machines when blocked or rate-limited. CYFIRMA assessed with moderate confidence that the Korean-speaking operator was affiliated with the Lazarus Group ecosystem, describing a suspected North Korea-linked campaign. The company described exploitation as a planned next step: operators intended to shortlist targets and adapt public exploits, rather than reporting successful compromises of those hosts.

Fix PHP itself, not only website code

The flaws affect unpatched PHP 7.x and 8.x releases and expose reachable PHP endpoints, including forms, login routes and health checks. Not every deployment is equally exploitable. CrowdStrike says exposure does not depend on the content management system, application framework or plug-ins: updating website code alone does not repair the PHP engine beneath it.

Earlier traffic counts measured attempts

Amazon’s threat intelligence team detected an attempt against its decoy systems on 17 October, before public disclosure, and later described broad exploitation activity. Cloudflare chief executive Matthew Prince’s 21–22 October account documented rapidly increasing traffic, but counted attempts rather than confirmed compromises.

Ryan Austin, a Calif researcher who helped discover the flaws, gave a more cautious assessment in the Guardian’s 22 October account.

At the moment it doesn’t look like exploitation has taken off or been widespread.

Wordfence’s findings covered its protected sites

WordPress security company Defiant said its Wordfence firewall had blocked more than 74,000 exploit and probing attempts in SiliconANGLE’s 22 October account. It had seen no confirmed compromise across the more than 5 million WordPress sites it protects. That finding concerned those sites at that time, not all PHP servers.

Sophos withdrew an initial successful-exploitation assessment

On 23 October, Sophos described unsuccessful PHP2Shell attempts to install Potassium, a variant of the Mirai botnet malware. The analysed sample could download more software and launch distributed denial-of-service attacks, which overwhelm targets with traffic. Successful installation could recruit a server into an attacker-controlled network. Sophos later withdrew its initial successful-exploitation assessment after determining that the activity amounted to scanning and failed attempts. Previdian separately said its honeypots had recorded probes and exploitation attempts but neither successful code execution nor attackers placing PHP files there; its findings in the 23 October account concerned its monitored systems.

VulnCheck reported a memory-protection bypass

VulnCheck told The Register on 22 October that its CVE-2026-109618 exploit linked a confirmed memory leak to code execution on PHP 8.4.26. The company said it worked on x86-64 servers despite ASLR and with display_errors=off, PHP’s recommended production setting for hiding errors. VulnCheck described ASLR as a major barrier between demonstrations and attacks that defeat real-world protections. Access was restricted to Initial Access Intelligence customers; code execution was not functional on ARM64, a different processor architecture.

UK said shutdowns were largely precautionary

UK cybersecurity minister Liz Lloyd told lawmakers on 22 October that government service shutdowns were largely precautionary while updates and other protections were applied. The UK government said no public-facing critical services were affected and temporary unavailability did not mean services had been hacked.

Older systems can require replacement

The UK’s National Cyber Security Centre, or NCSC, said some organisations running older systems could not use the patch and would have to replace those systems, in the Guardian’s 22 October account. South Korea’s government announced emergency measures on 22 October, raising its private-sector cybersecurity alert level and issuing repair guidance to tens of thousands of companies. The same coverage described China’s industry ministry urging immediate inspections, secure PHP upgrades, stronger monitoring and changes to passwords and keys. Japan’s prime minister encouraged organisations to patch or shut down their websites.

South Africa’s presidency took its site offline

South Africa’s presidency temporarily took its website offline as a precaution after a PHP warning, spokesperson Vincent Magwenya told Reuters on 23 October. He said there was no indication of a security breach and such warnings could affect normal website operation without indicating a breach.

Japan’s disruption included disaster alerts and rail services

Japanese mobile carrier SoftBank announced on 23 October that it was suspending emergency alerts during PHP security maintenance. Customers would not receive earthquake early warnings, tsunami alerts, or disaster and evacuation information through that system during the suspension. The BBC’s 23 October account, citing Mainichi, said alerts would not sound even during a strong earthquake and customers had been urged to use other warning channels. It gave 26 October as the planned restoration date.

East Japan Railway, known as JR East, also temporarily suspended some internet services. On 23 October, it said some group services had resumed and others would return once confirmed safe.

Orange suspended access during security work

France’s telecommunications company Orange said it had suspended access to certain services globally while deploying security fixes, in the BBC’s 23 October account.

Finland began a staged restoration

Finland’s state IT services provider Valtori began lifting blocks on government web services after patching on the night of 21–22 October. Hannu Naumanen, its director general in October 2026, said restoration could take days or even weeks because systems required careful testing. The announcement marked the start, not completion, of restoration.

Final Fantasy 14 restored login access

Square Enix restored new Final Fantasy 14 logins after roughly 24 hours of work, Polygon said on 24 October. The online multiplayer game had not shut down completely worldwide: some players could still enter. Square Enix also paused housing auto-demolition, which reclaims inactive plots when owners do not enter their buildings within a specified time. Each server has a finite number of plots rather than a separate copy for every player. Polygon’s account gave 26 October as the scheduled restart date.

Games recovered at different speeds

Eurogamer described these service positions on 22 October, citing the games’ operators.

Umamusume’s developer said the vulnerability had not been exploited. Alderon Games separately assured Path of Titans players that no data had been compromised.

Older games faced closure while an archive returned

World Quest and Save My Demonic World, Japanese mobile games operating for over a decade, faced permanent closure because their developers said the older technology could not be updated to fix PHP2Shell. Players faced losing access rather than a maintenance interruption, in The Verge’s 22 October account of Kotaku’s reporting. The Internet Archive’s outage was temporary: its operations team patched and secured systems and restored access. Digital librarian Brewster Kahle publicly thanked responding teams in the same account.

A separate flaw requires an unusual configuration

The PHP Foundation also warned of a separate code-execution flaw, CVE-2026-115560, requiring an unusual combination of configuration and application code. It involves changing the format used to store session data while an application is running, with session upload-progress tracking still enabled. The Foundation says applications that never change that format at runtime can keep the feature enabled. The flaw had no patch as of 26 October; a fix was expected through the regular release cycle. Pending it, PHP’s developers advised disabling session upload-progress tracking with session.upload_progress.enabled=0.

Check installed fixes and monitor server processes

CrowdStrike says ordinary web logs can miss PHP2Shell exploitation: server processes may remain stable, responses return the HTTP 200 success status, and application logs show no anomalies because application code never ran. A possible trace is a single fatal memory-limit error in the web server’s error log, which defenders may dismiss as routine noise.

The US Federal Bureau of Investigation advises monitoring PHP processes for unexpected downloads or launches of command shells. The NCSC and CISA urge prompt patching or consideration of taking affected systems offline. VulnCheck also urges patching rather than reliance on memory protections or configuration changes. US federal civilian agencies must apply the fixes by 29 October; that deadline does not apply to organisations outside the federal government.

Operators running unsupported PHP releases need to upgrade or obtain vendor-supported fixes: those releases receive no official PHP patch. That can require application changes and compatibility checks, rather than simply installing an update. Systems that cannot be secured should be taken offline until the risk is addressed.