PHP2Shell: what CYJAX is seeing as attackers chase the leaked PHP flaws
PHP2Shell is a pair of critical PHP flaws that leaked before disclosure and drew instant interest from attackers. This post covers what CYJAX analysts have seen on cybercriminal forums and code repositories, and what organisations running PHP should do now.
At CYJAX, we have been warning that AI will transform vulnerability detection and patch management. PHP2Shell is that warning playing out. The flaws were found using AI and responsibly disclosed. However, they were then found again by someone else, also with AI, whose disclosure forced PHP to rush its release forward. AI has become a tool for both sides: researchers are using it to find vulnerabilities faster, and attackers are using it to exploit them faster. Threat actors were discussing exploitation before vulnerabilities were even disclosed, and exploits were circulating as soon as patches landed. That makes the hours between disclosure and patching critical, and teams should factor this into how they respond.
This is not just a security team problem. PHP runs nearly 70% of websites, meaning customer portals, online stores, and marketing sites could all be exposed. With 43% of UK businesses reporting a breach or attack in the past year, a flaw that lets attackers run code on web servers is how the next data loss, outage, or regulatory report begins.
Key takeaways
- CYJAX has observed significant PHP2Shell discussion on Russian-language forums XSS and Exploit, including requests to buy working exploits.
- Alleged Proof-of-Concept (PoC) code is circulating on GitHub, a personal blog and forum threads. However, CYJAX has not verified it.
- Some threat actors have stated that exploits must be tailored to each PHP build, but that is unlikely to continue.
- Exploitation attempts have already been reported by Cloudflare and others.
- Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
What is PHP2Shell?
PHP2Shell is the name for two critical remote code execution (RCE) flaws in the PHP core. These flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and have been giving a rating of 9.2. The first flaw occurs from how PHP handles running out of memory mid-request. The second vulnerability occurs from the internal state that survives after its memory is freed and can be picked up by a later request.
PHP released fixes on 21 October for supported versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates, and the minimal source backports for 7.4, 8.0 and 8.1 only help those building from source. With large parts of the internet still on older versions, many organisations have no patch available and face a harder upgrade.
What are threat actors saying about PHP2Shell?
CYJAX has observed a high volume of PHP2Shell discussion across cybercriminal forums. Users are sharing news of the flaws, asking for free exploits, offering to buy working ones, posting PoC code, and claiming to build tools that scan for vulnerable targets.
On Russian-language Exploit forum, a user who has been active since 2018 with positive peer feedback shared what they claim is their own PoC. Other users on XSS and Exploit have reposted a PoC from a personal blog, but have stated that it does not work on every version. Some point out that because each PHP build is compiled differently, exploits need adjusting for specific versions.
A GitHub PoC describing a heap use-after-free in PHP's session upload progress feature has also been observed. That lines up with what Hadrian reports seeing in live attacks, which mostly target the same session upload-progress path.
Is PHP2Shell being exploited in the wild?
Yes, attempts are under way. Cloudflare says its firewall has blocked PHP2Shell exploit attempts since early on 21 October, with attackers changing tactics to evade its rules. Amazon researchers reportedly saw an attempt as early as 17 October, before the leak.
CYJAX assesses that the level of forum interest makes a rise in exploitation attempts highly likely in the coming days.
What should organisations do now?
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers.
- Find every PHP instance being run, including old microsites and supplier-hosted pages.
- Plan migration off PHP 8.1 and older, which no longer get official releases.
- Treat firewall rules as a stopgap, not a fix.
- Check web server logs from mid-October for unusual requests or PHP spawning shell processes.
How does CYJAX help with threats like PHP2Shell?
CYJAX analysts tracked PHP2Shell from the first leak, monitoring cybercriminal forums, code repositories, and social channels and updating customers as it developed. That gives security, IT and leadership teams the same clear picture of how urgent a threat is and what attackers are really doing.
Book a demo or ask an analyst about your PHP2Shell exposure.
Recommended for you
Get Started with CYJAX CTI
Empower Your Team. Strengthen Your Defences.CYJAX gives you the intelligence advantage: clear, validated insights that let your team act fast without being buried in noise.
