Attackers are exploiting two flaws in PHP, which runs on roughly 7 in 10 websites with a known server-side language

PHP runs on roughly 7 in 10 websites with a known server-side language, and CISA lists two PHP flaws as exploited; US companies should inventory every PHP copy, including vendor-bundled ones, before patching.

Who is affected, and how widely

W3Techs measured PHP on 69.2% of the websites whose server-side language it can identify, as of October 29, 2026. That counts websites, not servers, and it misses PHP inside appliances, network devices and management interfaces. The Dutch NCSC (NCSC-NL) tracks those: as of 15:29 CET on October 29, its list had 925 products, 223 vulnerable and 153 fixed. The NCSC wrote that "PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly."

As of 21:12 UTC on October 29, TU Delft's live tracker had counted 73,929 exploitation requests from 676 source IPs since October 21.

What happened

CISA says the flaws, CVE-2026-109618 and CVE-2026-109619, known as "php2shell," allow unauthenticated remote code execution and affect all PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older got no new release, only source backports for 7.4, 8.0 and 8.1. On their own the flaws give code execution as the web worker account.

• October 17: Amazon saw an exploitation attempt in its honeypots, four days before disclosure.
• October 21: CISA's bulletin said it "has not observed exploitation" at publication.
• October 26: CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog. The same day, Dream Research reported a campaign that chained the PHP flaws with Linux kernel flaw CVE-2026-46300 to get root on 25 systems: 24 internet-facing Palo Alto Networks PAN-OS firewalls running PHP 8.0.30 and one firewall management server. Dream Research said the artifacts it found appeared to come from a Chinese AI-assisted campaign. On October 29, Palo Alto Networks said it had observed active exploitation targeting PAN-OS management interfaces exposed to the internet.
• October 28: CISA added CVE-2026-46300. Its entry says it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."

The KEV due dates (October 29 for the PHP flaws, October 31 for the kernel flaw) bind only federal civilian agencies under BOD 26-04. CISA encourages all organizations to prioritize KEV entries.

What to do now

1. Asset and vendor management (today): list every PHP instance, including container images, CMS and admin panels, and appliances with web interfaces. Ask each vendor whether its product embeds PHP and when a fixed build ships; NCSC-NL's list is a starting point. This approach is our analysis.
2. Incident response (now): before changing anything, copy web-server and PHP logs, web-root contents and process data. CISA's guidance says to collect evidence first because patching "may jeopardize the availability of artifacts." Private companies are not bound by it; in our view it is sound practice.
3. Platform team (within 24 hours, internet-facing hosts first): patch PHP or install the vendor build, and confirm kernels carry the CVE-2026-46300 fix. Distributions backport fixes, so php -v is not a reliable check; read your vendor's advisory. CISA says to take unpatched PHP systems offline and adds that a web application firewall may provide some protection. PHP lists interim measures, such as session.upload_progress.enabled=0 and restarting all workers, that "do not make an installation safe." Our advice for devices that cannot be patched yet: restrict network access to their web interfaces.
4. Detection team (this week): hunt back to at least October 17, as AWS advises, including POST requests containing PHP_SESSION_UPLOAD_PROGRESS. Deploy CISA's Sigma rule and look for PHP workers launching shells or downloading tools, and new or changed files in web roots. Also look for root processes descended from the web user (our analysis, not published guidance).

Sources and updates

• CISA KEV entry, CVE-2026-109618.
• CISA KEV entry, CVE-2026-109619.
• CISA KEV entry, CVE-2026-46300.
• CISA alert, October 26, 2026, KEV additions.
• CISA bulletin, October 21, 2026.
• CISA BOD 26-04.
• CISA BOD 26-04 implementation guidance.
• CISA Sigma rule for php2shell.
• PHP security advisory GHSA-w8hw-w9fx-j79w.
• CVE record, CVE-2026-46300.
• Ubuntu security notice, CVE-2026-109618.
• Debian security tracker, CVE-2026-109618.
• Red Hat advisory RHSA-2026:87073.
• Red Hat advisory RHSA-2026:87080.
• Palo Alto Networks security advisory CVE-2026-109618.
• W3Techs methodology.