A pair of critical PHP vulnerabilities dubbed PHP2Shell — CVE-2026-109618 and CVE-2026-109619 — has moved from scanning noise to confirmed remote code execution in the wild. For UK hosting providers and MSPs running unpatched PHP, this is the moment vulnerability management solutions stop being optional overhead and become the difference between a quiet patch night and an incident report.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| Pre-patch scanning detected | 0 | 4 |
| Emergency patches released | 4 | 1 |
| Failed exploit attempts logged | 5 | 3 |
| Confirmed working RCE exploit | 8 | 2 |
What changed: from failed probes to confirmed RCE
Until this week, attempted exploitation of the PHP2Shell flaws had been dismissed as noise. Cloudflare, Hadrian, watchTowr, Previdian and Patchstack had all logged attack attempts before public disclosure, but every one was flagged as unsuccessful, and Dataminr's TRACE team described the activity as limited to scanning and fingerprinting with no known compromises.
That changed when Adel Karimi, detection and response lead at Perplexity, published honeypot evidence of successful remote code execution against an Apache mod_php installation running PHP 8.4.26. Karimi described it as "confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," noting the honeypot's response delivered an 800 KiB decoded cookie dump, with a function address derived from that dump appearing in the subsequent execution payload — and a shell command executing roughly 1.6 milliseconds after the request's final byte. Expel threat researcher Marcus Hutchins, who had been tracking a stream of alleged successful exploitation claims, corroborated the finding as the highest-quality confirmation he had seen.
Why UK hosts and MSPs should treat this as urgent
PHP underpins an estimated 70% of all websites, with roughly 5.1 million PHP hosts exposed online and around 3.8 million carrying at least one open attack-facing port, according to VirusTotal estimates cited in the disclosure. For UK hosting providers managing shared or multi-tenant environments, that scale means a single unpatched customer instance can become a pivot point into adjacent infrastructure.
Amazon Threat Intelligence had already spotted attackers probing the PHP2Shell flaws four days before patches shipped, which tells buyers something important: exploitation attempts begin the moment flaw details leak, not the moment a working exploit is confirmed. Waiting for proof of successful compromise before prioritising a patch window is no longer a defensible posture.
Patch status and timeline
The PHP security team shipped emergency patches on Wednesday, 21 October 2026 — one day after asking administrators to prepare to deploy updates the moment they became available. Details of the flaws, including CVE identifiers and mitigation advice given to some critical infrastructure providers, leaked online ahead of release, and several proof-of-concept exploits circulated publicly. The PHP team maintains that none of the pre-release PoCs were functional, but Karimi's honeypot evidence confirms that a working exploit chain now exists and is being used.
A second, unpatched flaw adds to the pressure
On Friday, the PHP security team disclosed a further RCE vulnerability, CVE-2026-115560, which currently has no patch and is only exploitable against systems with an unusual combination of configuration and application code. Until a fix ships, administrators are advised to set session.upload_progress.enabled=0 — the same mitigation that had already been recommended ahead of the PHP2Shell patches themselves.
For infrastructure operators, this means two simultaneous obligations: urgently patch confirmed PHP2Shell exploitation and apply a configuration-level mitigation for a separate, still-open flaw. Teams relying on manual change processes should expect this to stretch patch cycles this week.
What this means for buying decisions
This episode is a useful stress test for how quickly an organisation can move from disclosure to deployed fix. Hosting providers and MSPs that can already understand CVEs and CVSS scores and triage against known-exploited status will have patched before this week's confirmation even landed. Those without that discipline are now reacting to live exploitation rather than a disclosure window.
It's also a reminder that web-facing PHP estates deserve the same rigour as core network kit. Pairing network security measures with layered managed detection & response gives buyers a way to catch anomalous shell activity even where a patch has been delayed. For legacy or securing end-of-support servers running older PHP stacks that can't be upgraded quickly, compensating controls and a move toward zero trust segmentation reduce blast radius while patching catches up. Operators running third-party or out-of-support hardware alongside these web stacks should also review third-party maintenance for servers arrangements to ensure patch support hasn't quietly lapsed.