PHP2Shell CVE-2026-109618: Attackers Were In Before the Patch

PHP2Shell is the name researchers gave to CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution vulnerabilities in core PHP. The PHP project shipped emergency patches after researchers confirmed exploitation attempts had already begun before fixed versions were publicly available. If you run PHP anywhere in your stack, this is not a patch-and-forget event.

Key takeaways

• PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, unauthenticated RCE flaws affecting core PHP, not a single plugin or CMS.
• Exploitation attempts were observed before patches were released, which means any affected host had exposure before a fix existed.
• AWS and Cloudflare warned that exploit attempts are hitting millions of targets as scanning scales up post-disclosure.
• Updating PHP removes the vulnerability going forward. It does not tell you whether a web root was already touched during the exposure window.

What is PHP2Shell (CVE-2026-109618, CVE-2026-109619)?

PHP2Shell refers to a pair of critical, unauthenticated remote code execution vulnerabilities in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619. Because the flaws sit in core PHP rather than a specific application, any site, CMS, or custom codebase running an affected PHP version is a candidate for exploitation, regardless of what framework sits on top of it.

That breadth is what makes PHP2Shell different from a single-product CVE. Tenable's FAQ and watchtowr's analysis both walk through why unauthenticated RCE in the interpreter layer turns into a volume problem fast: there is no single vendor patch cadence to wait on, just a long list of hosting environments, each on its own update schedule.

When did exploitation actually start?

Exploitation started before public patches existed, not after. SecurityWeek reported that attackers were already probing and exploiting PHP2Shell prior to the fixed releases landing, and a follow-up piece confirmed patches arrived as the first exploitation attempts hit sensors. The Register's coverage adds that AWS confirmed attacks began before public disclosure, which is the detail that changes the response calculus for every MSP managing PHP-backed infrastructure.

The practical consequence: a clean CVE scan run today tells you what's patchable, not what already happened. SecurityWeek separately warned that mass exploitation was expected once technical details leaked, and cybernews reported that Amazon and Cloudflare were already seeing exploit attempts scale into the millions as opportunistic scanning picked up the pace.

Who is affected, and how do I check?

Any environment running an unpatched, affected PHP version is exposed, including hosted CMS platforms, custom web applications, and internal tools built on PHP. Brandefense published a free check alongside the list of fixed versions, and SocRadar's breakdown covers which versions remain vulnerable by branch.

Help Net Security's summary and Datadog's technical analysis both lay out detection guidance, including the file and process signatures worth checking before you mark a ticket closed.

Why patching PHP doesn't answer the real question

Patching PHP closes CVE-2026-109618 and CVE-2026-109619 going forward. It does not tell you who exploited the hole during the window before the fix existed, and sansec's research along with Unit 42's threat brief both describe the kind of webshell and backdoor activity that gets dropped during exactly this kind of pre-disclosure exploitation window.

This is the part MSPs keep underestimating with vulnerabilities like PHP2Shell: a ticket to upgrade PHP is necessary, but it's a prevention action, not an investigation. If an attacker already landed a web shell four days before the patch shipped, upgrading the interpreter doesn't remove the shell, it just stops the next one from getting dropped the same way.

Vijilan Security's Global SOC treats a disclosure like PHP2Shell as a hunt trigger, not just a patch-management line item. Analysts look for web-root file drops that don't match deployment history, anomalous PHP-worker child processes spawning shells or outbound tools, and egress connections from web hosts that have no business talking to the internet directly. When one of those shows up, the response isn't a ticket, it's isolating the box. That distinction, between detecting and acting, is what ThreatRespond™ and ThreatHunt™ are built around: hunting for the thing the patch can't retroactively undo, then containing it before it spreads further across the environment.

For partners running PHP-heavy client estates, this is also a good moment to pressure-test whether your current tooling gives you process-tree and egress visibility on every web host, or just a vulnerability scanner that tells you what to patch next. Co-managed SIEM and 24/7 SOC monitoring exist specifically so that question has an answer before the next PHP2Shell-sized event, not during it.

What should MSPs do about PHP2Shell right now?

Patch every PHP instance to a fixed version immediately, using the version lists published by JFrog or Google Cloud's response guidance. Then run a hunt, not just a scan, across every PHP host that was internet-facing during the exposure window, looking specifically for activity that predates the patch timestamp.

Don't treat a clean current-state scan as proof of a clean history. Huntress's rapid response write-up and Abstract Security's analysis both reinforce the same point: the exploitation window started before public awareness, so logs and endpoint telemetry from that period are the only honest source of truth.

If your clients' PHP environments don't have retained logs or endpoint visibility going back far enough to cover the pre-disclosure window, that's the gap to close before the next core-language vulnerability lands, not after.

Next step

If you're not confident your current tooling would have caught web-root activity during the days before PHP2Shell was disclosed, that's worth a direct look. See how ThreatHunt™ and ThreatRespond™ close that exact gap, and what a SOC for MSPs actually watches for when a core-language CVE lands with a head start already in play.