PHP2Shell Community Hub

PHP2Shell: Find hidden PHP exposure and reduce application risk

Automatic WAF-as-a-Service protection.

Botched PHP2Shell disclosure revealed as panic continues

Patch-rate data from Infrawatch: about 6% of visible instances patched.

CVE-2026-115560 session upload progress follow-up

A related session-handling flaw that the 21 Oct releases do not fix. Interim fix: disable session upload progress.

Analysis of the GitHub php2shell repositories

Of 99 repositories, 46 were defensive and 36 offensive, and 83% of stars went to PoCs.

Understanding PHP2Shell: Everything You Need to Know

Exploit walk-through and Guardicore hunting queries.

PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution

Analysis of Potassium botnet samples, which have 24 attack vectors and use ENS for C2.

PHP2Shell: What Security Teams Need to Know

Two runtime rules. Reports attempts against several customers' production workloads.

php2shell: What you need to know and how to fix it

Remediation guidance.

Technical Advisory: PHP2Shell Pre-Auth RCE

GravityZone detection mapping. Reports no exploitation attempts in its telemetry.

PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution

16 SONAR signatures and 4 Carbon Black App Control rules.

'PHP2Shell' vulnerability: What is it, and is your data at risk?

Mainstream explainer, quoting the PHP Foundation's executive director.

AI found it. AI is stopping it.

WAF signatures (advisory K000163821) and AI-scored request analysis.

FortiGuard Outbreak Alert: PHP2Shell

IPS and web-application signatures.

PHP2Shell: CVE-2026-109618 & CVE-2026-109619 RCE

Fingerprinting of exposed customer assets.

Hunting Leaked PHP2Shell RCE Across Open Directories

Attacker open directories, tooling and target lists. One operator hit up to 123 servers and got no shells.

3,189,999 IPs exposing PHP

2026 - October PHP2SHELL

A running knowledge-base article. Reports no exploitation in partner environments.

PHP2Shell: Early Attack Activity Through Imperva's Lens

First-24-hour attack data, with 64.5% of targeted sites in the US.

482,342 requests to 21,998 sites in 103 countries

php2shell: Critical PHP RCE

An active check for CVE-2026-109618, and the history of the bug class.

PHP2Shell: Critical PHP RCE Flaws Explained

Breach-and-attack simulation threat 60730.

Detection Coverage: PHP2Shell

Suricata SIDs 2072548–2072557.

PHP Patches Two Critical Unauthenticated RCEs

Advisories for unmanaged PHP. Notes that official php: container images need separate checks.

SVD-2026-1013: Vulnerabilities in PHP on Splunk Products

Product advisory: no Splunk products known to be affected.

Synology-SA-26:14 PHP2Shell

Fixed PHP packages for DSM, plus fixes for Calendar and Mail Station.

PHP2Shell: detecting unauthenticated remote code execution in PHP core

How to spot exploitation in running cloud workloads and containers.

PHP Foundation statement on critical vulnerabilities

The PHP Foundation on the 2024 audit and the broken embargo.

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Pre-disclosure attacks and Cloudflare figures.

SECURITY ALERT: PHP Critical RCE Vulnerabilities (KA-0024789)

Deep Security IPS, TippingPoint filters, network detection rules and Vision One workbenches.

PHP2Shell: A Clear Explanation and Response Framework

A response framework for security teams.

Critical Remote Code Execution Vulnerabilities in PHP Core

Initial advisory, with App & API Protector rule 3000991.

PHP2Shell: how to identify and fix vulnerable assets

Search security findings for both CVE numbers, then search devices for PHP installs directly. Scanners can lag behind an emergency disclosure, so looking for PHP itself catches what they miss.

PHP2SHELL: Two Critical Remote Code Execution Vulnerabilities in the PHP Core

Third-party risk view of the exposure, with 72.5% of versioned hosts on end-of-life branches.

1,898,841 PHP hosts

PHP ships emergency patches for critical PHP2Shell flaws

Release coverage, including the PHP security team's statement.

PHP2Shell patch day: honeypot fair

Anthony Tellez of BlinkOps recorded an exploit attempt on a honeypot 37 minutes after disclosure.

PHP2Shell

Original discoverer. Reported the bugs in August and showed pre-auth RCE against more than ten major PHP applications.

PHP2Shell exposure dashboard

A live exposure dashboard, announced on X. Over 3.08M PHP hosts seen by 23 Oct.

Over 3.08M PHP hosts by 23 Oct

PHP2Shell: what we know about the leaked critical PHP vulnerabilities

Background on the flaws, which leaked before the official release, plus an intrusion prevention protection (CPAI-2026-15172).

Critical Vulnerabilities in PHP Require Immediate Patching

No exploitation observed at the time of the alert. Recommends taking unpatched and 8.1-or-older systems offline.

Building php2shell detections before coordinated disclosure

An open-source Zeek package and Suricata rules.

CrowdStrike protects customers from threats delivered via PHP2Shell

New detections and correlation rule templates in Falcon Next-Gen SIEM, plus a PHP2Shell section on the Emerging Threat Response dashboard.

php2shell: Assessing Elastic detection coverage

Maps about 11 existing rules to the threat, plus Osquery and EQL inventory queries.

PHP2Shell: what we observed and what to do

What ELLIO has seen in internet scanning and attack traffic, with recommended next steps.

743 requests from 33 IPs on day one

What we know about PHP2Shell and how to prepare

An overview of the two flaws and the steps to take while you patch.

Fastly's Proactive Protection for PHP2Shell

NGWAF rule and a log signature. Advises treating 32-bit PHP deployments as compromised.

FG-IR-26-186: PHP core RCE vulnerability patches

Product impact advisory. FortiDDoS, FortiSOAR and others are under investigation.

Responding to core PHP vulnerabilities

23 curated detections in Google SecOps, Cloud Armor rules and a Security Command Center module.

Emergency Patch! PHP2Shell Opens PHP Servers to Remote Code Execution

OpenVAS checks across 10 distributions.

php2shell Tooling tag

A tag for identifying scanning and exploit infrastructure.

PHP2Shell: leaked critical PHP RCE

Reports exploitation at scale, mostly through the session upload-progress path.

PHP2Shell: critical PHP vulnerabilities patched, update now

News summary of the release, including Amazon's report of an exploitation attempt four days before disclosure.

PHP2Shell: all you need to know

JFrog Security Research's overview of both flaws, from root cause to affected versions.

PHP2Shell: How to Protect Your Server

Server hardening guidance, and detection in NEXT EDR Expert and KATA NDR.

Addressing PHP2Shell: upgrade guidance and Azure WAF mitigations

Upgrade guidance plus Azure mitigations: a header-rewrite option for Application Gateway now, and an Azure Front Door rule rolling out by October 28 that flags suspicious traffic.

Critical PHP "PHP2Shell" RCE Vulnerabilities

Agentless detection of vulnerable PHP across cloud workloads.

Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products

PAN-OS 10.2–12.2, Panorama and WF-500 are affected. Hotfixes expected 26–30 Oct.

Threat Brief: Critical Vulnerabilities in PHP

Unit 42 threat brief. Cortex Xpanse sees over 22.6M exposed, potentially vulnerable instances. NGFW Threat IDs and virtual patching active since 20 Oct.

22.6M potentially vulnerable instances

Major security alert: PHP vulnerable to critical RCE, attacks ongoing

Hosting partners reported active exploitation incidents at 07:34 UTC on 21 Oct.

GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)

GitHub security advisory for CVE-2026-109619.

GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)

GitHub security advisory for CVE-2026-109618.

Security advisory: Critical remote code execution vulnerabilities, update now

The official advisory. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. States that no configuration change fully mitigates the flaws.

Critical Unauthenticated Remote Code Execution in PHP

Unauthenticated checks and a Velociraptor inventory artifact. Found that public PoCs work only on narrow configurations.

PHP2Shell: PHP RCE

Why online stores on Magento, Shopware and WooCommerce are affected even when their own code is clean.

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Includes Cloudflare's attack volume figures and industry reactions.

Stopping PHP2SHELL: how SentinelOne protects customers

How the SentinelOne platform handles the attack technique. As of October 21 it reported no confirmed compromises in the wild.

SiteGround moves early to protect customers ahead of critical PHP security release

What SiteGround did for the sites it hosts before and after the release.

Advisory: PHP2Shell vulnerabilities

Sophos's product advisory. Says its firewall WAF has no protection specific to these flaws yet.

PHP2Shell: responding to CVE-2026-109618 and CVE-2026-109619

How to respond to PHP2Shell across the endpoints and servers Tanium manages.

PHP2Shell: Two Unpatched Critical PHP RCE Flaws Trigger Emergency Security Alert

Running coverage from the leak onward.

TuxCare Patches php2shell for the PHP Versions Upstream Left Behind

Extended-support backports for end-of-life PHP.

Initial assessment: PHP2Shell

An early assessment written before patches shipped, updated since.

PHP2Shell vulnerabilities

Reports probing activity on October 21 aimed at one of the two flaws, sent as a file-upload request to ordinary PHP pages.

2,608,039 PHP hosts

PHP2Shell RCE exploited

watchTowr reports seeing attackers exploit both flaws in the wild.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the internet

Wiz Research's write-up. Reports that every PHP version released in the last decade, back to 5.4, is affected by at least one of the flaws.

PHP Vulnerable to Unauthenticated RCE Attacks

MDR analytics for suspicious commands spawned by web servers and for PHP script creation.

PHP2Shell: Am I affected?

Exposure analysis and a table of about 58 affected products and appliances.

2.6M versioned services

How to find, mitigate and patch PHP2Shell now

Published as PHP announced the release. Covers finding affected systems with Qualys, interim mitigations and patching.

167M PHP installs, 71% on end-of-life branches

PHP2Shell: critical PHP RCE vulnerabilities

Detection guidance. Warns that WAF rules based on request size won't catch the exploit, which is only about 450 bytes, and suggests keeping upload progress turned off after patching if you don't use it.

PHP2Shell: How to fix PHP RCE with patches and free images

Patch guidance, patched base images and a free checker.

PHP2Shell: How to Find, Prioritize, and Patch Affected Systems

Finding and prioritizing PHP across managed and unmanaged assets.

Using AWS WAF to apply mitigations for PHP2Shell

Version 2.3 of the AWS WAF PHP managed rule group adds a rule for CVE-2026-109619 and is now the default.

PHP2Shell: fixed PHP versions and free check

A list of fixed versions plus a free check you can run to see whether your PHP is exposed.

Vulnerabilities in PHP affecting Cisco products: October 2026

Which Cisco products include affected PHP. Cisco says it isn't aware of malicious use against them.

Testing the AWS WAF rules that mitigate PHP2Shell

A hands-on test of the AWS WAF rules from AWS Security Bulletin 2026-143-AWS.

PHP2Shell: check if your PHP is vulnerable

A step-by-step guide to checking your PHP version and patching on common Linux systems.

What we know about php2shell

A running summary of what is known about the flaws, updated as the story develops.

PHP2Shell: detection, analysis and remediation

Datadog Security Labs' analysis of the flaws, with guidance on detecting attacks and fixing affected systems.

Php2Shell: Two critical PHP flaws let attackers run code without logging in

An MDR view. Reports no confirmed customer exploitation.

PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment

Technical explainer of the bailout root cause and the mitigations.

What Imunify360 blocks and what needs the PHP update

Its ModSecurity rulesets 8.83 to 8.85 block the public exploit tool and related variants, but PHP itself still needs updating.

PHP security release: critical patch out October 21

A summary of the release and interim steps, including turning off upload progress tracking.

PHP2Shell: Cloudflare WAF guide

A third-party guide to Cloudflare's WAF rules for PHP2Shell, which started blocking on October 21.

Cyber alert CC-4875

Healthcare-sector alert for PHP2Shell.

Virtual patch and WAF rules for PHP2Shell

Community-written WAF rules to use as a temporary shield. Review them before deploying.

PHP2Shell Exploitation: Two Critical PHP Flaws Explained

Exploitation analysis, leaked-archive timeline, and VirusTotal and Modat exposure counts. Cautions that reporting does not establish confirmed compromises.

Critical RCE vulnerability in PHP: find impacted assets

How to use runZero to locate systems running PHP across your network so you can build a patch list quickly.

High-fidelity detection mechanism for php2shell

Explains a reliable way to test hosts for both flaws and points to an open-source scanner from its Assetnote team.

Patch PHP vulnerability now or take it offline, NSA warns

Coverage of the NSA's warning to patch affected PHP or take it offline.

php2shell: defending against critical unauthenticated PHP remote code execution

Defensive steps for security teams, from stopgaps to monitoring.

PHP2Shell: affected versions and fix

Affected versions, backports for older branches and current exploitation reports. Notes the flaws are not yet in CISA's Known Exploited Vulnerabilities catalog.

php2shell: frequently asked questions about critical PHP remote code execution

Affected versions, workarounds and exploitation status, plus the checks that flag vulnerable PHP: Nessus plugin 369483, local checks for Linux distributions, and Web App Scanning plugins 115719 to 115722.

PHP2Shell: What defenders need to know

Network and endpoint detections, with attack observations.

Security advisory: critical unauthenticated RCE in PHP

Urges patching internet-facing systems today. Notes endpoint tools should catch noisy attacks but may miss quiet ones that stay inside PHP.

Critical PHP vulnerabilities

A university IT notice telling system owners what to update.

PHP security advisory: php2shell

WAF rules deployed before disclosure.

PHP2Shell FAQ: fixes for CVE-2026-109618 and CVE-2026-109619

Answers to common questions about which versions are fixed and which are left without an official patch.

PHP2Shell

An overview of the flaws and the timeline, including Cloudflare's early report of exploitation.