October 29 was the deadline CISA gave US federal agencies to patch PHP2Shell. Most businesses sit outside that mandate, yet the date is a fair yardstick for everyone else. Exploitation is confirmed, fixes have been out for eight days, and for many teams the hardest question is still the first one: where exactly are we running PHP?
What PHP2Shell is
PHP2Shell is the name researchers gave two flaws in PHP core, CVE-2026-109618 and CVE-2026-109619≈. The first is an out-of-memory bug that corrupts request memory. The second is a use-after-free in state PHP carries between requests, reachable through the session upload progress handler, which has been on by default since PHP 5.4. Both trigger while PHP parses a multipart POST request, before any application code runs. The result is code execution as the PHP worker user, with no credentials and no user interaction.
The timeline was compressed. Details leaked on Hacker News on October 20, two days before coordinated disclosure, and PHP shipped fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) the next day. Amazon had logged an exploit attempt on its honeypots as early as October 17. On October 24, a researcher recorded working shells on honeypot systems, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog two days later.
Some perspective belongs next to those facts. PHP rates attack complexity as high, which keeps the CVSS v4.0 score at 9.2. The confirmed honeypot compromise ran against a deliberately favorable single-worker mod_php setup, and the researcher was careful to say it doesn’t measure reliability elsewhere. Pentest-Tools.com’s own team says the public proofs-of-concept they tested only worked under lab conditions. That gives defenders room to patch methodically. There is no reason to postpone.
Why businesses should care
PHP runs underneath WordPress, Drupal, Joomla, Magento, cPanel, Plesk and plenty of internal tools nobody remembers deploying. A flaw in the runtime reaches every application on top of it. Once an attacker executes code as the worker, the web root, the database credentials sitting in config files and the neighboring sites on a shared server are all within reach. On disclosure day, Mallory counted about 2.6 million internet-facing services advertising a PHP version, roughly three quarters of them on 8.1 or older. Those are banners, not confirmed victims, but they show how much of the web runs on branches that got no official release.
Version checks don’t help much here. Many servers hide their PHP version, and Linux distributions backport fixes without changing the version string. PHP also lives inside appliances and control panels that the regular patch cycle never touches. Banner-based scanning ends up guessing exactly where you need certainty.
What the Pentest-Tools.com scanner does
The free PHP2Shell scanner from Pentest-Tools.com tests how the server behaves instead of trusting what it advertises. Since October 22, it sends a small multipart baseline request to /index.php, then repeats it with bodies of roughly 1 MB, 8 MB, and 20 MB, stopping at the first one that makes PHP report memory exhaustion. That reproduces the condition behind CVE-2026-109618 without running code on the server. Because PHP fixed both flaws in the same release, a host that fails the check is almost certainly unpatched for CVE-2026-109619 too.
Every finding is marked Certain and includes the full request and response, so whoever owns the fix can verify it independently. The free PDF report lists the fixed release for each PHP branch, plus remediation steps. The same detection runs in the company’s Network Vulnerability Scanner for teams working at scale, and once you’ve patched, the free check confirms the host has actually moved.
Two caveats belong in any runbook. A clean result from behind a web application firewall means the WAF blocked the probe and tells you nothing about the PHP underneath. And memory-exhaustion probes put deliberate load on a worker, so scan only what you’re authorized to test, and tell the owners first.
For the business, the value sits in the evidence. A finding with a request, a response and a named fixed version gives an engineer a ticket to close and gives an auditor something to read, which matters to anyone answering to NIS2 or DORA.
PHP2Shell is still a developing story. PHP has already flagged a further issue in the same session upload feature for its next regular release, and new research and exploitation reports keep arriving. Keep an eye on PHP’s security advisories and CISA’s alerts over the coming weeks, because today’s guidance may not be next week’s.
Anastasios Arampatzis is a cybersecurity content strategist, writer, and consultant with expertise in cybersecurity, digital identity, and regulatory compliance. Tassos has a strong background in creating thought leadership content, marketing materials, and strategic communications tailored to CISOs, security professionals, and business leaders. He has contributed to various cybersecurity publications and collaborates with organizations to develop compelling, insightful content that addresses industry challenges. He is a privacy advocate and a member of the ISC2 Hellenic Chapter. Before joining Bora, Tassos was an Hellenic Air Force Officer with a solid background on IT and Infosec.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.