PHP2Shell: One Request, No Login, Code on Your Server. The Attacks Started Six Hours Before the Fix.

01 What happened, hour by hour

The 17 October line is the one to read twice. Amazon Threat Intelligence saw someone try the attack against its MadPot honeypots four days before anyone outside the embargo should have known the bug existed [ Tenable 2026 ] . Amazon now recommends starting any investigation from that date.

Some operators did not wait for the patch. In the Netherlands, Tweakers, the House of Representatives, the national NCSC and Security.NL took sites offline on 21 October as a precaution [ Sansec 2026 ] . That was the right call for anyone who could not patch within hours.

02 The two bugs in plain terms

Both flaws live in how PHP cleans up after a request. Neither depends on a mistake in your own code.

CVE-2026-109618 breaks PHP when it runs out of memory at the wrong moment. If the memory limit hits while PHP is still building its internal record of a request, the clean-up step later treats that half-built record as complete. An attacker who can push a request into that state, for example with a crafted upload, gets the engine to work on memory they shaped [ Tenable 2026 ] .

CVE-2026-109619 is a use-after-free across requests. When one request crashes, PHP can leave behind a pointer to memory it has already freed. The next request handled by the same worker process picks that pointer up. An attacker who controls both requests controls what sits in that memory. Hadrian reports that most of the attacks it sees go through PHP’s session upload-progress feature to set this up [ Hadrian 2026 ] .

Early copies of the CVE records carried a score of 10.0. The PHP Foundation says that was wrong and the correct score is 9.2 [ Tenable 2026 ] . The difference changes nothing for you. An unauthenticated attacker can run code on the server either way.

03 Who is exposed: more than your website

Every common way of running PHP is affected: PHP-FPM behind nginx, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team ranks Apache with mod_php as the highest risk, because the demonstrated exploit fires before any application code runs [ Tenable 2026 ] .

Calif confirmed unauthenticated code execution against current WordPress, Drupal, Joomla and Magento 2.4.9 installs. Sansec lists WordPress 7.1.2 and Drupal 11.4.3 among ten further applications [ Sansec 2026 ] . A shop with spotless plugins and a fully updated CMS is still open until the PHP underneath is patched. Your developers cannot fix this in the store code.

04 If you cannot patch today

The PHP security team says updating is the only complete fix. If a change window or a dependency stops you, these steps narrow the gap. None of them makes the server safe [ Tenable 2026 ] .

• Turn off upload progress. Set session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0. This blocks the confirmed path for CVE-2026-109619 and does nothing for CVE-2026-109618.
• Remove the memory limit, and fence it from outside. Setting memory_limit=-1 where applications cannot override it removes the trigger for CVE-2026-109618. It also lets one request eat the whole server, so put a container or cgroup memory limit around PHP and restore the setting after you patch.
• Restart every PHP worker. PHP-FPM pools keep the old settings until they restart.
• Block multipart/form-data at the web server. Sansec suggests rejecting these requests in nginx or Apache. It breaks file uploads, so test checkout and contact forms afterwards [ Sansec 2026 ] .
• Put a WAF in front. Cloudflare has deployed rules for the known exploit paths, on the free tier too. It covers only traffic that passes through Cloudflare, so a direct hit on your origin IP bypasses it.
• Go offline or read-only. Stop PHP-FPM and serve a static maintenance page, or reject every method except GET and HEAD. WordPress and Magento maintenance modes do not help, because the bug fires before they run.

CERT-EU advises isolating internet-facing PHP applications until the fix is applied and verified [ CERT-EU 2026 ] . For an online shop that means a few hours of lost sales. For a shop whose payment page gets a skimmer, it means months.

05 Were you hit before you patched?

Patching closes the door. It does not remove anyone who came through it between 17 October and the moment you updated. An attacker who gets code execution on a PHP server usually leaves a web shell, a small PHP file that gives them a way back in. The Cairn operators did exactly that on e-commerce sites this autumn.

Public code claiming to exploit these bugs is circulating. The PHP Foundation says its team found no working exploit at release time, and Tenable warns that unverified exploit code is itself a malware risk [ Tenable 2026 ] . Test your own servers with a vendor scanner or a tester you trust, not a script from a paste site.

06 The next one will also arrive early

PHP already has three entries in CISA’s Known Exploited Vulnerabilities catalogue: CVE-2012-1823, CVE-2019-11043 and CVE-2024-4577. Ransomware groups used the last two [ Tenable 2026 ] . PHP2Shell differs in one way that matters. The attacks started before the patch, because the details escaped the embargo.

You cannot plan around a leak. You can make sure that when the next one lands, you already know three things: every host under your name that runs PHP, which version each one runs, and who can patch it within a day. Teams that had that list on 21 October patched by the afternoon. Teams that did not are still finding servers.

An attacker needs one request to a PHP host you forgot. You can find every one of those hosts first. Your Threat Map maps every web property under your name, flags each unpatched PHP and other critical exposure, and gives you the routes in, proven, with the fix ranked by what each one reaches. 14 days, from $5,000. Enterprise-grade. Not enterprise-priced.