Palo Alto confirms PHP2Shell attacks
Palo Alto says active exploitation hit internet-exposed PAN-OS management interfaces. Fixed builds are rolling out; no attribution was given.
Read update Incident file CVE-2026-109618 · CVE-2026-109619 Research cut-off 30 October 2026, 14:47 UTC
PHP2Shell: verified updates, fixes and timeline
Two critical PHP runtime flaws, disclosed together on 21 October 2026. Track the fixes, exposure and exploitation evidence — with each key claim linked to its source.
Patch tracker PHP 7.4–8.1 backports Compared with Log4Shell
Patch · 2 CVEs8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
ExploitationKEV listed; no confirmed mass compromise
Updated30 October 2026, 14:45 UTC
Independent publication. Not affiliated with PHP, any security vendor or any government agency.
01 Now
Latest changes
3 recent updates, newest first. Each links to the full record.
29 Oct: 72,000 PHP2Shell requests logged
An independent tracker logged 72,679 exploitation requests from 664 IPs in 73 countries. LACNIC reports 12.8% patched versus 25.1% globally.
Read updateDream Research: PHP2Shell roots 25 servers
Dream Research says a PHP2Shell and Fragnesia chain rooted 25 servers, including a US government-affiliated environment. Unit 42 verified the tooling.
Read update02 Start here
Start by situation
Source notice. The last automated source check was 30 October 2026, 12:50 UTC. This notice appears when that check is older than 24 hours; published content is retained, but the live status may be out of date. See per-source status.
03 Current assessment
What is established now
- Confirmed impact
-
Two memory-safety flaws in the PHP runtime allow unauthenticated remote code execution in affected configurations. The flaws are below the application layer: updating a CMS or plugin does not remove exposure.
PHP Group GitHub / PHP Security Team GitHub / PHP Security Team - Patch status
-
Fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older have no upstream release; source backports exist and distributions may backport the fix without changing the visible version string.
PHP Group PHP Group CERT-EU - Exploitation evidence
-
CISA added both PHP2Shell CVEs to KEV on 26 October 2026. SecurityWeek also reported 35 shells across honeypots from two IP addresses on 24 October, in a deliberately favorable single-worker mod_php test. That is confirmed command execution in a controlled environment, not a production victim count. No confirmed mass compromise has been established.
CISA SecurityWeek Cloudflare - KEV status
-
CVE-2026-109618, CVE-2026-109619 are present in CISA KEV catalog version 2026.10.29, checked 30 October 2026, 12:50 UTC.
CISA - Last update
-
— last substantive change across news, guides and timeline.
Latest news: Palo Alto confirms PHP2Shell attacks
04 Mechanism
The cross-request state path
CVE-2026-109619 in one figure. The in-request OOM path of CVE-2026-109618 is separate.
05 Timeline
How the record developed
- 29 October 2026Dream names PAN-OS; Unit 42 verifies attacker tooling Exploitation report
- 29 October 2026Palo Alto confirms PHP2Shell exploitation against PAN-OS management interfaces Exploitation report
- 29 October 2026Independent tracker logs 72,679 PHP2Shell exploitation requests Research
- 28 October 2026NVD revises CVE-2026-109619 v3.1 score to 8.1 Correction
- 28 October 2026CISA adds Fragnesia to KEV Advisory
07 Sources and verification
Sources and verification
How to read the labels. “Confirmed” means a primary source — a vendor advisory, a release note or a government alert — supports the claim. “Reported” means a vendor or media organisation says it; repetition does not promote it. “Not established” means the sources reviewed do not support it. That is a boundary of the search, not proof of the opposite. Full sources and method →