PHP released emergency updates on Wednesday for the PHP2Shell flaws after details leaked about two days before the planned disclosure, and researchers recorded exploitation attempts before and around the time the fixes shipped. South Korea’s science ministry raised its national cyber alert to “Caution” on Thursday.
Emergency Releases and Backports Across PHP Branches
The PHP project published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on October 21. It also issued minimal source backports for PHP 7.4, 8.0 and 8.1. The fixes cover PHP 8.2 through 8.5 and, through the backports, older branches.
Disclosure had been planned for October 22. Details leaked around October 20, and PHP accelerated the release.
CVE-2026-109618 and CVE-2026-109619 at CVSS 9.2
The two flaws are CVE-2026-109618, described as out-of-memory corruption, and CVE-2026-109619, described as stale global state. They carry a CVSS score of 9.2 and require no authentication. Affected components include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Exploitation Attempts Before and During the Patch
Several security firms documented activity. watchTowr saw in-the-wild attempts around patch time and observed no successful ones. Hadrian reported exploitation “at scale” before the fixes, abusing PHP’s session upload-progress path. Patchstack, Cloudflare and Vega also documented attempts earlier on October 21.
Cloudflare deployed protections about nine hours before public disclosure. The firm’s WAF rules are part of the response alongside the patched releases.
The PHP Foundation’s Position on Mitigations
The PHP Foundation said mitigations “reduce exposure to specific attack paths but do not make an installation safe,” and that only updating fully protects a server. Separate reporting says the guidance for site owners includes pulling unpatched sites offline. Patch guidance also tells operators to restart services after updating, so that running processes pick up the fixed code.
Scale of Exposure
Neither CVE requires credentials, so any internet-facing server running an unpatched build is reachable by the same requests that researchers observed. Hadrian tied the early exploitation to PHP’s session upload-progress path, and the PHP Foundation’s warning means operators cannot treat a firewall rule or a configuration change as a substitute for the update. The PHP project’s guidance is to install the matching fixed release for each branch and restart the service so running processes load it.
The affected scope is described as roughly 70 percent of websites. Sites built on PHP-based platforms, including WordPress, Drupal, Joomla and Magento, face internet-wide exposure until patched or restarted.
South Korea Raises Its Alert Level
South Korea’s science ministry raised its cyber alert to “Caution” on October 22. That detail comes from a single source and has not been corroborated by additional reporting.
Timeline
PHP’s own schedule called for disclosure on October 22, so the release landed roughly a day ahead of plan once the leak surfaced. Details of the flaws leaked on October 20. PHP released the patches at 14:00 UTC on October 21, and exploitation attempts were reported the same day. The national alert in South Korea followed on October 22.
The sequence leaves a narrow gap. Cloudflare’s protections went live about nine hours before public disclosure, Patchstack, Cloudflare and Vega logged attempts earlier on October 21, and Hadrian’s report places exploitation at scale before the fixes were available. The affected stacks are PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. watchTowr’s observation of no successful attempts and Hadrian’s report of exploitation at scale are not reconciled in the available reporting, and the sources give no count of compromised sites.
Impact
Exposure covers web servers running affected PHP versions across multiple server stacks, from PHP-FPM to LiteSpeed. No successful in-the-wild attempts were observed by watchTowr, while Hadrian’s contrary claim of exploitation at scale before the patches means the true scale of compromise remains unsettled. The PHP Foundation’s statement that mitigations alone leave a server unsafe frames the patched releases as the only complete fix for the two CVEs.
