PHP2Shell RCE: Finding Hidden PHP at NC Manufacturers

When a Piedmont Triad plant says "we do not run PHP," it usually means the website. The firewall login page and the storage box on the plant network can run PHP too, and nobody has asked about those yet.

TL;DR: PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. PHP shipped fixes on October 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and says to update immediately. Amazon saw an exploit attempt on October 17, four days before disclosure, so check logs from that date, not from the patch date. Find every PHP install first, including the ones your host or a vendor runs for you.

As of October 24, 2026: neither CVE is in CISA's Known Exploited Vulnerabilities catalog (catalog dated October 23). On October 23, PHP published an informational advisory for a related issue, CVE-2026-115560, covered below.

What are CVE-2026-109618 and CVE-2026-109619?

They are two remote code execution flaws in the PHP engine, so they sit underneath every PHP application rather than in any one plugin. PHP's security advisory says they "can allow unauthenticated remote code execution" and that the risk covers "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." PHP considers mod_php the highest risk, with a demonstrated exploit that fires "before any application code runs."

• CVE-2026-109618 (out-of-memory corruption): PHP can be interrupted while request data is only partly set up, and cleanup then treats the bad data as valid.
• CVE-2026-109619 (stale global state): internal state can outlive the memory it points to, and a later request on the same worker can use it.

As Cloudflare says, "updating website code or a plugin(s) alone does not fix these vulnerabilities."

Which PHP versions fix PHP2Shell?

Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release, though PHP published minimal source backports for 7.4, 8.0 and 8.1. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.

On a distribution package, Google advises checking the changelog for the two CVE numbers (its examples are apt-get changelog php-fpm and rpm -q --changelog php-fpm) and restarting the web-serving process afterwards, because a package upgraded on disk "leaves vulnerable libphp.so or php-fpm binaries resident in running worker processes." Our note: on Debian and Ubuntu, php-fpm is a metapackage, so run the changelog check against the versioned package, such as apt-get changelog php8.3-fpm.

Distribution builds keep their own version numbers. Ubuntu's notice covers 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS, and its 24.04 LTS fix is 8.3.6-0ubuntu0.24.04.13, so a patched Ubuntu server can still show PHP 8.3.6. Also, php -v reports the command-line binary, which may not be the FPM or Apache module build that serves your pages. Our advice: list the installed package versions instead (dpkg -l 'php*' or rpm -qa 'php*'), and do not put up a phpinfo() page to check, because that page shows your configuration to anyone who finds it.

Not sure what your website or portal runs on? Our cybersecurity team can tell you in one call. (336) 886-3282, or send us the list.

Where does a manufacturer run PHP without knowing it?

PHP sits under most of the web. W3Techs puts it at about 69% of websites whose server-side language it knows, and Infosecurity Magazine notes those sites include WordPress, Drupal, Joomla and Magento. It also hides inside equipment. Google tells customers to inventory "edge, gateway, management, storage, and security systems, which frequently embed PHP in administrative control planes."

Two vendor statements show what that means on a plant network:

• Palo Alto Networks says PAN-OS is affected on PA-Series and VM-Series firewalls and Panorama, that the issue "strictly affects the management web interface," and that it "will be fixed in the upcoming releases of PAN-OS." As of October 25, 2026, the advisory says hotfixes 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 "are released," and the other hotfix builds across PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 still carry estimated dates of October 27 to 30. Check the advisory's table for your exact version, because each release line has its own build. Palo Alto says it "is not aware of any malicious exploitation of this issue against our products," and until a fix is available for your version it recommends restricting the management interface to trusted internal addresses. On CVE-2026-115560, its FAQ says "Current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama)."
• Siemens lists its RUGGEDCOM APE1808, an industrial application-hosting platform running PAN-OS, as affected in all listed PAN-OS versions.

Walk this list and mark who patches each one:

Our judgment: start the inventory at the firewall and the storage box, not the website. The website is the one somebody already asked about. A server answering with an X-Powered-By: PHP/... header is PHP announcing itself, but a missing header proves nothing, because expose_php can be switched off.

What should we ask our web host or vendor, and by when?

The deadline is now. PHP says "All PHP users are strongly encouraged to update immediately," and Amazon says that for critical internet-facing flaws, "A 7-day or 30-day SLA assumes a delay that no longer exists." No CISA federal due date applies: the KEV catalog dated October 23, 2026 lists neither CVE.

Send these questions in writing, today:

1. Which PHP branch and build serves our site or portal, and under which server mode (PHP-FPM, mod_php, CGI, LiteSpeed)?
2. On what date and time did it move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a distribution package whose changelog names both CVEs?
3. Were all PHP workers restarted after the update?
4. If we are on 8.1 or older, whose backport is installed, or when do we move?
5. Do you keep web and PHP error logs from October 17, 2026 onward, and will you preserve them for us?
6. Is session.upload_progress.enabled=0 set in php.ini or the pool configuration (see CVE-2026-115560 below)?

"We patch automatically" is not an answer without a build number and a date. Ask for both.

How do we check October 17 onward without inventing indicators?

Start from October 17, 2026. Amazon Threat Intelligence saw an exploit attempt in its MadPot honeypot that day, more exploit attempts from 02:00 UTC on October 21, before the 14:00 UTC release, and says PHP2Shell "is now seeing broad exploitation attempts in the wild." Amazon adds that "it's unclear if any of these attempts would have succeeded in real-world systems."

Amazon's published checks, in full:

• Look for POST requests containing the string PHP_SESSION_UPLOAD_PROGRESS in form uploads.
• Review web server logs for suspicious activity.
• Check for unexpected process execution or file modification on web application servers.

Amazon's complete IP list, with the dates it observed them: 103.216.220.92 (October 17), and 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188 and 95.217.98.37 (all October 21). Amazon says these include shared anonymization infrastructure and organizations "should investigate any observations involving these addresses as opposed to blocking." Treat a match as a lead to investigate, and keep the log line.

Google Cloud's guidance has a longer hunting table. A sample, not the full list:

• Response PHPSESSID cookies longer than 256 bytes (Google says typical ones run 22 to 256).
• Shell tools such as sh, bash, curl or wget spawned by php-fpm, httpd, apache2 or frankenphp.
• Spikes in PHP-FPM worker respawns (SIGSEGV, exit code 139) or core dumps.

Clean logs are not an all-clear. Google notes some published exploit chains return output with "ZERO SIGSEGV crashes and ZERO error.log entries."

If any check turns up a hit, the order matters (the order is our advice):

1. Contain without wiping evidence. Block internet access to that server at your edge firewall, or disconnect it from the network. Leave it powered on.
2. Call your cyber insurer and incident responder before anything is restarted, patched or reimaged.
3. Preserve. Have your incident responder capture PHP worker memory and a disk image, and copy web server, PHP and firewall or CDN logs from October 17 onward. Google says to capture worker memory "before patching or rebooting," because restarting "permanently destroys volatile heap evidence."
4. Then change the box: install the fixed build, restart every PHP worker, and change the passwords and API keys the application stores, set on the cleaned or rebuilt server. Keep this to hours: PHP's instruction to update immediately still stands, and containment only buys the time to capture.

With no hit, patch and restart now. Copy the logs first if your host allows it; that costs minutes and changes nothing on the server.

Want help working through those logs? Talk to our managed IT team. (336) 886-3282.

What is CVE-2026-115560, the issue PHP flagged on October 23?

It is a separate code execution path that PHP calls "an unlikely RCE vector," and PHP is fixing it in the regular release cycle, not as an emergency. In its informational advisory, PHP suggests setting session.upload_progress.enabled=0 "until the next regular bugfix release," and says it "will publish a full advisory for CVE-2026-115560 with the next release."

PHP says the issue "can only occur under an unusual combination of configuration and application code": an application sets session.serialize_handler to php_binary or php_serialize, switches it to php at runtime with ini_set() before session_start(), and session upload progress is still on. PHP says applications that never change the serialize handler at runtime "can keep the feature enabled." The setting was already a listed mitigation for CVE-2026-109619, so anyone who applied it on October 21 needs no further action. PHP has not published affected versions or a score.

What if we cannot patch today?

PHP lists stopgaps but says they "reduce exposure to specific attack paths but do not make an installation safe." They include memory_limit=-1 set where applications cannot override it, a low post_max_size (8M without uploads, 32M with), session.upload_progress.enabled=0, and on PHP 8.5, fatal_error_backtraces=0. PHP says to set the upload progress switch in php.ini, an FPM pool or server configuration, not with ini_set() or .user.ini, and to restart every worker.

For a brochure website that takes no orders, we would take it offline until the host confirms the fix. That is our view; a week without the brochure site costs a plant very little. A web application firewall in front helps, but even Cloudflare, which deployed managed rules for these flaws, says customers "should patch their PHP repos even with WAF protections."

Key takeaway: PHP2Shell is in the engine. The useful question is which machines you own or rent answer web requests with PHP, and who has put 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on each one.

What should a Piedmont Triad business do first?

On Monday, call whoever manages your firewall and ask two things: does its maker have an advisory for CVE-2026-109618 and CVE-2026-109619, and can its management page be reached from the internet? On Palo Alto, ask whether the hotfix for your exact PAN-OS version is released or still has an estimated date in the advisory, and when it will be installed. Then send the six questions above to your web host and to every portal or ERP vendor with a web login, and fill in the five-row table with their written answers. We do this for plants from High Point and Greensboro to Winston-Salem, Charlotte and Raleigh; see our manufacturing page for how we work with plants. Preferred Data Corporation has been in business since 1987. We are headquartered in High Point, NC, work on site within 200 miles, and support clients remotely across the US and around the world. Call (336) 886-3282 or contact us.

Frequently Asked Questions

Is our WordPress site affected by PHP2Shell?

If it runs on an unpatched PHP build, yes, whatever the plugins. The flaw is in PHP, so the fix is the host updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distro package naming both CVEs) and restarting it. Ask the host for the build and the date.

Is PHP2Shell on the CISA KEV list?

Not as of the catalog dated October 23, 2026, which lists neither CVE-2026-109618 nor CVE-2026-109619. That does not lower the urgency: Amazon reports broad exploitation attempts, watchTowr reports exploitation in the wild, and PHP says update immediately.

We are still on PHP 8.1. What are our options?

PHP no longer releases 8.1 updates. Use a distribution or LTS vendor package with the fix, PHP's minimal source backport, or move to a supported branch, ideally past 8.2, which ends on December 31, 2026.

Does patching remove an attacker who got in before October 21?

Not on its own, in our view. Patching closes the flaw; it does not clean a server someone already got into. If any check from October 17 onward turns up a hit, follow the four steps above before patching that server.

Do we need to do anything about CVE-2026-115560?

PHP suggests setting session.upload_progress.enabled=0 until its next regular bugfix release, set in php.ini or the pool configuration with the workers restarted. PHP also says applications that never change the serialize handler at runtime can keep the feature on, calls the setup unlikely in practice, and will publish the full advisory with the next release.

Our firewall has a web login page. Is it affected?

Ask its maker. Palo Alto Networks says PAN-OS management web interfaces are affected. As of October 25, three hotfix builds are released and the rest carry estimated dates of October 27 to 30, so check its advisory for your version. Keep any appliance's management page off the internet.

Related Resources

• wp2shell WordPress Core RCE (CVE-2026-63030): NC SMB Defense, an earlier WordPress-layer flaw.
• Joomla JCE CVE-2026-48907: NC SMB Web Defense 2026.
• Palo Alto GlobalProtect CVE-2026-0257: NC SMB Defense Plan.
• Website development and hosting from Preferred Data Corporation.