✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Threat Actors Deploy PEERSTITCH Malware Against Fortinet Firewalls – Active IOCs

October 16, 2026
Rewterz

PHP Releases Emergency Updates for Critical PHP2Shell Vulnerabilities

October 22, 2026

PHP Schedules Emergency Security Update for Two Critical RCE Vulnerabilities

Severity

High

Analysis Summary

PHP is set to release an out-of-cycle security update at 14:00 UTC on October 21, 2026, addressing two critical remote code execution (RCE) vulnerabilities rated 9.2 on the CVSS v4.0 scale. Security researchers at have confirmed that the vulnerabilities are real, but their technical details remain undisclosed. No exploitation has been reported as of October 21.

The vulnerabilities, referred to by researchers as php2shell, are associated with the identifiers CVE-2026-109618 and CVE-2026-109619. These identifiers and claims of a CVSS 10.0 rating initially appeared in a leaked post on October 20. However, PHP has not officially confirmed the CVE identifiers, the leaked severity score, or claims that all versions from PHP 5 onward are affected. PHP's official notice assigns a score of 9.2 using CVSS v4.0 and states that full details, affected versions, and fixes will be published alongside the release.

The update is expected to cover PHP's four supported branches: 8.2, 8.3, 8.4, and 8.5. Anticipated release versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, although these version numbers have not been officially confirmed. Older branches, including PHP 8.1, 8.0, 7.x, and 5.x, are end-of-life and will not receive official PHP security fixes. Mallory identified approximately 884,000 internet-facing hosts reporting PHP 8.1 or older through Shodan, highlighting the potential exposure, although these systems are not confirmed to be vulnerable.

Organizations should inventory all PHP installations, including those embedded in vendor appliances, Windows applications, and hosting control panels. Administrators should prepare to patch immediately upon release, prioritizing internet-facing systems and checking for distribution-specific backported fixes. Systems running unsupported versions should be upgraded or temporarily isolated from public networks, potentially through VPNs or web application firewalls.

Security teams should monitor PHP-related processes, including php-fpm, php-cgi, httpd, and apache2, for suspicious child processes such as shells, interpreters, and download utilities. Where endpoint detection is unavailable, process-monitoring tools can help identify potentially malicious activity.

If compromise is suspected, isolate the affected server, preserve logs, and investigate for web shells, unauthorized files, scheduled tasks, cron jobs, and newly created accounts.

At the time of writing, no workaround or public exploit code had been reported. Organizations should remain alert and apply the official security updates as soon as they become available.

Impact

  • Remote Code Execution
  • Unauthorized System Access
  • Arbitrary Command Execution
  • Sensitive Information Exposure

Indicators of Compromise

CVE

  • CVE-2026-109618

  • CVE-2026-109619

Remediation

  • Upgrade PHP to the latest patched release for the supported branch (8.2, 8.3, 8.4, or 8.5) as soon as it becomes available.
  • Prioritize patching internet-facing PHP applications and servers to reduce exposure to potential remote code execution.
  • Identify all PHP installations, including those embedded in vendor appliances, Windows applications, cPanel, and Plesk.
  • Upgrade end-of-life PHP versions (8.1 and older) to a supported branch, as they will not receive official security fixes.
  • Restrict public access to vulnerable systems using VPNs, network access controls, or web application firewalls until patching is complete.
  • Monitor PHP-related processes, including php-fpm, php-cgi, httpd, and apache2, for suspicious child processes such as shells, interpreters, and download utilities.
  • Deploy process-monitoring tools on Linux servers to detect potentially malicious programs launched by PHP processes.
  • Review web server, PHP, and endpoint security logs for suspicious activity and indicators of compromise.
  • Investigate web roots for unauthorized files, web shells, unexpected cron jobs, scheduled tasks, and newly created accounts.
  • Isolate potentially compromised servers, preserve relevant logs and forensic evidence, and initiate incident response procedures.
  • Verify patch availability through official PHP advisories and operating system or hosting-provider security updates, including backported fixes.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo