PHP2Shell: Two Pre-Auth PHP RCEs Are Patched, but PAN-OS, Panorama and Cisco Expressway Still Wait

PHP shipped fixes on 21 October 2026 for two critical remote code execution bugs in the language core, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are unauthenticated, both score CVSS v4.0 9.2, and both affect every release before PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anyone serving web requests through mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed is in scope. Exploitation attempts are being reported, including one that Amazon saw four days before disclosure. A confirmed compromise had not been published in the sources reviewed, and neither CVE is in CISA's Known Exploited Vulnerabilities catalog.

What the two bugs are

CVE-2026-109618, "RCE via OOM corruption." PHP uses longjmp() to abort a request when a memory allocation fails. If that happens during request initialization, half-built request state is already reachable, and request shutdown then reads it. The PHP advisory classes it as use-after-free (CWE-416). Crafted multipart requests can exhaust memory even when the request looks small enough to fit within configured limits, per Rapid7.

CVE-2026-109619, "RCE via stale global state." PHP workers are reused. A fatal error, out-of-memory condition or timeout can leave request-owned state in a global that survives into the next request. A later request on the same worker can then act on that stale pointer before PHP's normal initialization clears it. The advisory names two consumers: INI diagnostics applied before request startup, and session upload progress handling. Attack requirements are high, because the producing and consuming requests must land on the same worker. Multiple workers and recycling lower the success rate but do not remove the condition.

NVD's primary score for CVE-2026-109618 is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N). PHP's own CVSS v4.0 vector rates attack complexity High and attack requirements Present, which is why it lands at 9.2. Horizon3 reports that Red Hat scores both at 8.1.

Who is exposed

The PHP advisories and Rapid7 draw the line by server API, not just by version.

• Apache mod_php is the highest-risk case. For CVE-2026-109618, full unauthenticated HTTP RCE was validated with default input and memory limits on prefork workers. Shutdown runs even when startup fails, so the corruption is reachable before any application code executes.
• PHP-FPM blocks that specific CVE-2026-109618 sequence because the child exits when startup fails. Source analysis says an OOM after normal startup could still reach the invalid state, but no complete FPM exploit has been demonstrated for it. For CVE-2026-109619, a session-lifecycle RCE was validated on FPM. That path needs an application operation that leaves state behind after a successful startup, a fatal error, and a second request reaching the same worker.
• FrankenPHP and LSAPI are judged likely susceptible by source analysis, but this is unvalidated.
• Session upload progress is the notable default. Per Rapid7, it is enabled by default and can consume stale state without the application ever calling session_start(). A confirmed mod_php RCE on PHP 8.5 uses the fatal_error_backtraces feature, which is also on by default.

Branches at or below PHP 8.1 get no routine upstream updates. PHP released limited source backports for 7.4, 8.0 and 8.1, so those installs depend on a distribution or vendor fix. Rapid7 also relays that the Remi repository would not have updates on 21 October and that PHP urged users to move to distribution packages or build from source.

Exposure counts come only from secondary reporting. CyberScoop cites researcher estimates of more than 1.3 million potentially vulnerable internet-exposed hosts and a Shodan count of about 1.9 million. It also cites VirusTotal finding about 758,000 servers disclosing PHP 5.4 to 8.1, which no longer receive security updates, against about 272,000 on supported branches. Treat these as rough; the methods were not verified, and Rapid7 and Horizon3 publish no counts.

Exploitation status, stated precisely

Exploit attempts started four days before the fix. Sources: PHP, Amazon Threat Intelligence, SecurityWeek, AWS, Horizon3, Palo Alto Networks.

• Amazon: Amazon Threat Intelligence saw an exploit attempt in its MadPot honeypot telemetry on 17 October, four days before disclosure, from an IP on a commercial anonymization network. On 21 October it saw more attempts from other anonymized infrastructure with varied payloads, which it reads as multiple actors. Amazon says it is unclear whether any attempt would have succeeded against real systems and does not report a compromise. It does say PHP2Shell is "now seeing broad exploitation attempts in the wild." Amazon asks defenders to review activity from at least 17 October.
• Others: watchTowr reported first in-the-wild attempts around patch release and none successful. Hadrian said it saw exploitation "at scale", mostly through the session upload-progress path. Vega reported attempts using a public PoC.
• CISA: In comments added on 21 October to CyberScoop's coverage, CISA said it had "not observed exploitation of these vulnerabilities as of the time of publication." That is a statement about CISA's own visibility on that date.
• KEV: The KEV feed checked on 23 October (catalog version 2026.10.21, released 14:04 UTC on 21 October, 1,754 entries) lists neither CVE. That release predates the PHP announcement, and no later release existed when checked. NVD's record carries no KEV date and a CISA coordinator assessment of exploitation "none."
• Exploit quality: Public PoCs exist, but Rapid7 found each works only for a specific combination of OS, PHP version and web server, and it got a working exploit only under narrow lab conditions. Horizon3 said on 22 October that there is no simple, repeatable trigger and that a negative scanner result does not prove a system is safe. Rapid7 still expects in-the-wild exploitation.
• Timing: Details leaked online on 20 October, and PHP moved its release forward from 22 to 21 October, per SecurityWeek.

Mitigations if you cannot patch today

Patching is the only complete fix, per PHP, Rapid7, Horizon3 and Amazon. Interim measures reduce exposure but each leaves gaps.

• Set session.upload_progress.enabled=0 where it applies before request parsing: php.ini, the FPM pool config or server config. ini_set() and FPM .user.ini are too late.
• On PHP 8.5, set fatal_error_backtraces=0 administratively.
• Set memory_limit=-1 administratively so applications cannot restore a finite limit. This removes the predictable limit the confirmed exploit relies on, but allocation failures can still reach the vulnerable path. Avoid RLIMIT_AS and RLIMIT_DATA, which can make mmap() fail and trigger it.
• Bound request size at the frontend: post_max_size, multipart part counts, headers per part, nesting depth. Block multipart/form-data entirely if the application does not use it.
• Restart every worker after any configuration change. The GHSA also suggests pm.max_requests=1 if performance allows.
• Cloud WAF rules help but do not replace patching. AWS added a rule for CVE-2026-109619 in its PHP managed rule group version 2.3 on 22 October.

For hunting, look for multipart POSTs containing PHP_SESSION_UPLOAD_PROGRESS (it has legitimate uses, so its presence alone is not proof of compromise), PHP workers spawning shells or fetching tools, and unexpected file changes or process execution on web servers. Amazon published six IPs from its observations but warns they sit on shared anonymization infrastructure and should be investigated rather than simply blocked.

The appliance long tail

PHP is embedded in vendor products where administrators cannot swap the interpreter. Palo Alto Networks customers patching this month already had PAN-OS CVE-2026-0322 to deal with. As of the advisories read on 22 to 23 October:

Palo Alto Networks. The advisory says PAN-OS and Panorama "will be fixed in the upcoming releases." Until then it points to Threat Prevention signatures (Threat IDs 543004, 97622, 97623, 97624 and 97625, Applications and Threats content version 9162 or later) and, for PAN-OS 12.2.4 and later, Frontier Virtual Patching coverage through Threat ID 543004. It also advises routing inbound management traffic through a data-plane port, replacing the certificate, decrypting and inspecting that traffic, and limiting management access to trusted internal IPs or a jump box. It rates the issue CVSS-B 8.7 for internet-exposed management interfaces and 7.1 when access is restricted, and says it is "not aware of any malicious exploitation of this issue against our products." Cloud NGFW, Prisma Access, Cortex XDR Agent, XSIAM, XSOAR, Xpanse and GlobalProtect App are listed as unaffected.

Cisco. The advisory, at version 1.4 as of 22 October, rates the bugs Critical, offers Snort rules 67359 and 67360, and says PSIRT is aware of the public announcement but not of malicious use. Cisco lists ASA, Secure Firewall, ISE, IOS, IOS XE, IOS XR, NX-OS, Webex, Umbrella and Meraki MR, MS and MX among products not vulnerable.

NCSC-NL maintains a third-party status list, but it describes the list as incomplete and still expanding. Absence from a vendor table is not a clean bill of health.

What defenders should do

1. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or the distribution build carrying the fix, and restart all workers. Do not rely on a reload that leaves old workers alive.
2. For PHP 8.1 and older, get a vendor backport or move branches. Horizon3 relays CISA guidance to take PHP-based systems offline until they can be patched if that is not possible.
3. Apply the configuration mitigations above immediately where patching is delayed, prioritizing mod_php hosts and anything exposed to the internet.
4. Inventory embedded PHP: PAN-OS and Panorama management interfaces, Cisco Expressway, and any other appliance running a PHP-based management plane. Restrict management access to trusted networks now, because no fixed PAN-OS or Expressway release exists.
5. Hunt back to 17 October, not 21 October.

Sources

• GHSA-w8hw-w9fx-j79w, CVE-2026-109618 (php-src)
• GHSA-6wmf-4rv5-p3rp, CVE-2026-109619 (php-src)
• NVD record for CVE-2026-109618 (API)
• oss-security announcement, 21 October 2026
• Rapid7 emergency threat response
• Horizon3.ai analysis
• Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure in MadPot
• Palo Alto Networks advisory
• Cisco advisory cisco-sa-php-october26-Jj384Daq
• Splunk SVD-2026-1013
• NCSC-NL php2shell tracker
• CyberScoop
• SecurityWeek
• CISA Known Exploited Vulnerabilities feed