PHP2Shell is in the interpreter. Updating WordPress does not patch it.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 closed CVE-2026-109618 and CVE-2026-109619 on 21 October. CISA and the UK NCSC say take unpatched internet-facing PHP offline. Amazon’s MadPot saw an attempt on 17 October. Neither CVE is on KEV.

RWP Ventures · 2026-10-22 · event 2026-10-21 · 12 min read · priority 9.3

Do not collapse five facts.

1. This is not yesterday’s Plex2Shell. [Plex Media Server](/posts/2026-10-21-plex2shell-kev-assume-compromise/) is a four-CVE chain on KEV, due Friday for the file write. PHP2Shell is two bugs in php-src. A CMS or plugin update does not change the runtime under it.
2. CISA’s 21 October alert and Amazon’s 21 October 22:36 UTC MadPot post are not the same claim. CISA, at publication: has not observed exploitation. Amazon, hours later: a MadPot attempt on 17 October from anonymized infrastructure, more attempts 02:00–08:00 UTC on 21 October before the embargo lifted, and after the patch “PHP2Shell is now being broadly exploited in the wild.” Amazon also wrote it is unclear whether those attempts would have succeeded on real-world systems. Huntress, 21 October: no in-the-wild hits on partner systems. Treat sensor traffic as REPORTED exploitation pressure, not a victim census.
3. php -v on Ubuntu is not the close. Distro packages keep the old upstream number. Ubuntu 24.04’s fixed php8.3 is 8.3.6-0ubuntu0.24.04.13. Ubuntu 22.04’s fixed php8.1 is 8.1.2-1ubuntu2.28. Compare the package to the vendor advisory, then restart every worker. A package on disk with the old process still mapped is the unpatched interpreter.
4. A WAF is not the patch. Cloudflare put default WAF rules live at 03:02 UTC on 21 October, including Free, and still told customers to patch. CISA: a WAF may help until the update. PHP: there are no complete mitigations. memory_limit=-1, session.upload_progress.enabled=0, and PHP 8.5 fatal_error_backtraces=0 close named paths. They do not make an install safe.
5. This is not a PLC event. PHP on a plant historian web UI or a vendor portal is an IT/web runtime. A hit is not confirmed OT process impact.

The operator sentence: inventory every process that serves HTTP through PHP, patch or backport it, restart the workers, and do not close the ticket because WordPress is current.

What happened

PHP’s security team posted an advance notice on 20 October: two critical issues, both CVSS v4.0 9.2, release scheduled 21 October 14:00 UTC. The CVE identifiers had already leaked. PHP brought the drop forward a day.

On 21 October PHP published the advisory and the four point releases. GitHub security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp landed around 13:34 UTC, ahead of the announced 14:00 window. CISA’s alert followed the same calendar day. Canada’s Cyber Centre published AL26-026. JVN published JVNVU99905564 on 22 October.

CISA catalog check this morning: version 2026.10.21, dateReleased 2026-10-21T14:04:39Z, count 1754. Newest rows are still the 20 October six (Plex, SiteGuard, Siemens). No PHP CVE. No BOD 26-04 due date.

Amazon Threat Intelligence (CJ Moses, 21 October, 22:36 UTC window):

• First MadPot PHP2Shell exploitation attempt: 17 October, source 103.216.220.92, commercial anonymization network. How the actor had details under embargo: UNKNOWN.
• Earliest public-facing PoCs Amazon saw: about 02:00 UTC 21 October. Further MadPot attempts 02:00–08:00 UTC from other anonymized infrastructure; payloads and providers varied — Amazon assesses multiple actors.
• After 14:00 UTC: more PoCs within hours, used against sensors almost immediately. Amazon’s sentence: broadly exploited in the wild. Technical analysis ongoing; success on production systems not established in that post.

Cloudflare, same day: attack traffic after the leak, payload mutation against its rules, WAF live 03:02 UTC. Disclosers named in that post: Calif.io, Wiz, OpenAI, Quarkslab. CVE.org credit on 109618 includes Ryan at Calif.io, Wiz, and OpenAI.

Unit 42 (21 October): Cortex Xpanse counted over 22.6 million exposed instances potentially vulnerable. That is an exposure telemetry figure, not a compromise count and not a confirmed-vulnerable census.

Why it matters

The bug class is worse than a CMS CVE because the request never has to reach application code.

PHP validated unauthenticated RCE over HTTP against Apache mod_php with default input and memory limits, before any application-specific code runs. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are in the affected set. PHP rates mod_php highest. For 109618, FPM is susceptible on source analysis; PHP has not demonstrated a complete FPM exploit for that CVE. For 109619, session-upload-progress RCE was validated on mod_php and FPM.

Three operational reasons this is the daily.

First, the inventory is the interpreter, including the copy you do not think you run. PHP is bundled in appliances, panels, containers, and “the WordPress box.” CISA: prevalence may not be directly observable. php -v on the jump host is not an inventory of every FPM pool, every mod_php vhost, every official Docker image, and every vendor UI that embeds PHP.

Second, the remaining clock is not KEV. FCEB agencies do not yet have a BOD 26-04 due date. CISA still told everyone to patch now and to take unpatchable or EOL PHP offline. That is an emergency-alert posture, not a catalog row. Do not wait for KEV to start the work.

Third, the version string will lie. Ubuntu, Debian, RHEL module streams, and AlmaLinux shipped backports under old upstream numbers. Remi’s volunteer repo was explicitly out on release day — PHP told those users to switch to distro packages or source. A scanner that only matches 8.3.6 will mark patched Ubuntu 24.04 hosts as vulnerable, or worse, will mark unpatched upstream 8.3.6 as fine.

Who / what is affected

• Any PHP that serves web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed. CLI-only PHP is outside the advisory’s web-request scope; do not use that as an excuse to skip FPM on the same box.
• Upstream affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12.
• PHP 8.1 and older: no point releases from the PHP project. PHP published minimal source backports for 7.4, 8.0, and 8.1. Distros and LTS vendors (Ubuntu ESM, Debian LTS, RHEL modules, AlmaLinux streams) are the operational path. CISA: if you cannot update, or you remain on 8.1 or earlier without a vendor backport, take the PHP-based system offline.
• Applications: WordPress, Drupal, Magento, Joomla, MediaWiki, Nextcloud, phpMyAdmin, Laravel, Symfony, and every other PHP app inherit the runtime. Lab reproductions against named app versions are not confirmed mass victim lists.
• Hosting / containers: official Docker PHP images, cPanel, and distro packages. Rebuild and redeploy images; a running container does not pick up a registry tag.
• OT / ICS: UNKNOWN. Do not treat a PHP RCE on an engineering or historian web front end as confirmed process impact. Do not merge this with Plex, Siemens Software Center, or SafePay.

Technical context

High-level, from the PHP advisories. This is not an exploit recipe.

CVE-2026-109618 — RCE via OOM corruption. PHP uses longjmp() for out-of-memory errors. In some contexts, request memory is reachable before it is fully initialized. If an allocation fails there, cleanup can read or branch on invalid state. PHP describes multipart parsing tricks that reach OOM while staying inside apparent post_max_size / memory_limit (undeclared content-length, header amplification, empty-file metadata). Apache mod_php always runs request shutdown, including after a failed startup, and automatic body parsing can hit the limit before application code. The patch replaces OOM longjmp() with a delayed soft OOM at the next VM safe point and a hard _exit() past a second threshold. CWE-416, also CWE-755 / 824 / 1325 / 1419. CVSS v4.0 9.2 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H.

CVE-2026-109619 — RCE via stale global state. Worker-global error, session, object, or extension state can keep pointing at request-owned memory after that heap is freed. A later request on the same worker can consume it before normal initialization. Confirmed consumers: session upload progress (enabled by default; no session_start() required) and, on PHP 8.5, fatal error backtraces. A producer plus a consumer across two requests is required. CWE-416. Same 9.2 vector.

Partial stopgaps PHP lists, each incomplete:

• 109618: administrative memory_limit=-1 (applications must not put a finite limit back); low post_max_size; frontend limits on decoded size, parts, headers. Do not use RLIMIT_AS / RLIMIT_DATA — those recreate the failing mmap() path.
• 109619: session.upload_progress.enabled=0 and, on 8.5, fatal_error_backtraces=0, applied before request parsing, then restart every worker. ini_set() and .user.ini do not count. pm.max_requests=1 breaks same-worker reuse at a performance cost.

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application; execution as the PHP worker account (T1059). Follow-on webshells or miners are not confirmed in the public victim record as of this writing. CISA’s hunt hint is PHP workers launching shells or downloading tools.

Threat / exploitation status

What defenders should do

1. Inventory PHP that serves HTTP, not “the WordPress estate.” Check FPM pools, mod_php, containers, panels, appliances, and vendor web UIs. Package queries: dpkg -l 'php' / rpm -qa 'php'. Running binaries: php -v and php-fpm -v after the restart.
2. Patch, then restart. Upstream: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Distro: the advisory package (Ubuntu USN-8948, Debian DSA-6574-1 / DLA-4848-1, RHEL RHSB-2026-013, AlmaLinux 21 Oct streams, Oracle ELSA-2026-87070 and siblings). **Reload Apache / restart every php*-fpm.** A package upgrade without a restart leaves the old interpreter in memory.
3. Do not trust the three-part version on distro hosts. Match the package revision to the vendor notice. Ubuntu 24.04 staying on 8.3.6 after .13 is expected.
4. EOL PHP: vendor backport or upgrade the branch. If neither is possible, CISA and NCSC: take it offline. PHP’s 7.4 / 8.0 / 8.1 source trees are for people who build from source, not a substitute for a supported package.
5. Remi users: PHP said rpms.remirepo.net would not have updates on 21 October. Move to distro packages or source.
6. WAF is a buffer. Keep Cloudflare / other WAF rules on. Do not close the change record on a WAF hit count.
7. Hunt, especially internet-facing mod_php. CISA: PHP worker processes spawning shells or downloading tools. Amazon: unexpected process execution or file modification on web app servers. Review logs around 17 October onward, not only 21 October. MadPot source IPs Amazon published for hunting (honeypot-facing, not a complete actor set): 103.216.220.92 (17 Oct), 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188, 95.217.98.37 (21 Oct).
8. If you were internet-facing and unpatched through 21 October, do not treat “now patched” as clean. Rotate credentials the worker could read (app secrets, database passwords, API keys in memory or .env). That is prudent hygiene under REPORTED mass scanning, not a confirmed-compromise assertion.
9. Do not wait for KEV. Catalog is still 1754. The federal clock has not started. The internet-facing clock started when the advisory did.

RWP is not publishing exploit code, PoC repositories, or a how-to for the OOM or session-progress paths.

RWP assessment

High confidence that the two CVEs are unauthenticated RCE in php-src, that the four 21 October releases close the documented paths, that CISA and NCSC issued take-offline guidance, and that neither CVE is on KEV catalog 2026.10.21 / 1754.

High confidence that updating an application (WordPress, Magento, a custom app) without updating and restarting PHP does not remediate.

Moderate confidence in “broad exploitation.” Amazon, Cloudflare, and watchTowr independently report attack or honeypot traffic. Amazon’s 17 October MadPot attempt is a primary telemetry claim. Amazon itself will not say those attempts worked on real systems. Huntress saw none on partners. No public named victim. Sensor fire is not a breach ledger.

Low confidence in actor identity and in any ransomware overlay. None is in the current record.

Confidence that this is not OT process impact: high. No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked the rest of the window because yesterday’s Daily Top explicitly deferred PHP until the 14:00 UTC release. That release, the CISA/NCSC alerts, distro packages, and Amazon’s overnight MadPot write-up are the material increment. Plex remains due Friday; it is not a new development. SafePay AA26-293A is a joint TTP pack on already-patched edge CVEs. No new KEV row overnight.

What we are watching

• Whether CISA adds 109618 / 109619 to KEV, and whether the BOD 26-04 forensic-triage bit is set.
• A confirmed production victim, a named payload (webshell, miner, ransomware), or a vendor appliance advisory that embeds PHP.
• Red Hat coverage beyond the streams already in RHSB-2026-013; Remi lag.
• Plex CVE-2026-96656 / 96654 due 23 October (forensic triage Yes on 96656) and SiteGuard CVE-2026-106931 the same day. Not this product.
• #StopRansomware AA26-293A (SafePay). ≥600 victims, old KEV CVEs. IOC pack, not a new interpreter bug.

Sources

Primary: PHP 21 October security advisory and GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp; CVE-2026-109618 / CVE-2026-109619; CISA 21 October PHP alert; CISA KEV JSON 2026.10.21; UK NCSC 21 October PHP notice; Amazon MadPot post 21 October; Cloudflare 21 October WAF post; CCCS AL26-026; Ubuntu php2shell notice; Red Hat RHSB-2026-013. Independent: Unit 42 exposure brief, Huntress, watchTowr FAQ, JVN JVNVU99905564. Prior RWP: Plex2Shell Daily Top 21 October.