On 20 October Kevin Beaumont noticed two PHP CVE IDs circulating before any patch existed, and by that evening Will Dormann had spotted a Calif video of a proof of concept called php2shell working against WordPress.
The PHP Foundation’s account fills in the rest: no technical details leaked, just a wrong release time and a wrong CVSS of 10.0 (it is 9.2), but the early pre-announcement led Calif to publish that video by mistake, Chainguard shipped patched images more than six hours before the embargo lifted, and the release was pulled forward a day to 21 October.
The advisory describes two unauthenticated RCEs: hitting memory_limit at the wrong moment leaves half-initialised request data that cleanup treats as valid (CVE-2026-109618), and a fatal error can leave global state pointing into a previous request’s freed memory (CVE-2026-109619), with the first triggerable on Apache with mod_php before any application code runs.
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; the stopgaps Dormann passed on (memory_limit=-1, session.upload_progress.enabled=0, a small post_max_size) each close only specific paths.
The Foundation is also unusually frank that the OOM problem was first spotted in 2024 and the fix stalled for months, “a structural failure”, until Calif and OpenAI reported the same root cause on 11 August.
Meanwhile a pre-patch “weaponized” write-up has since demoted its own bug to a non-RCE CVSS 5.3, proving that leaked CVE numbers attract confident guesses long before they attract facts.
Since the release, Arctic Wolf lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected too, and saw wide scanning but only a few attempts to fetch second-stage payloads from a host serving the Mirai-derived Potassium botnet. The Delft Threat Intelligence Lab’s live tracker counted 66,494 requests from 645 IPs by 27 October, 47,900 of them probes only. A Show HN challenge put a bitcoin key worth about $502 on a server running pre-patch PHP 8.4.26, and KillaBoi got it out on 25 October. The released PoC lands about seven runs in ten in a lab; the stored key did not derive the prize address, and the operator paid out anyway. Dream Group says a custom PHP2Shell build, chained with the Fragnesia kernel privilege escalation (CVE-2026-46300), rooted 24 Palo Alto Networks PAN-OS firewalls with internet-facing management interfaces in the US, Japan, Taiwan and South Korea, plus the internal firewall management server of a US government-affiliated organisation, from which the attacker went after its Active Directory. Per Dream, Unit 42 has verified the tooling and tracks the activity as CL-UNK-1280, a Chinese-speaking actor in UTC+8, while Dream’s own “AI-assisted” label rests on Claude Code and a DeepSeek and Kimi driven offensive platform (aiscan) found on the attacker’s infrastructure, plus the scripts’ commenting style.
Update 2026-10-30: A week on, Hunt.io’s look at the tooling finds php2shell mostly crashing on the open web, with PAN-OS as the exception.