PHP2Shell Now Under Active Exploitation Hours After Emergency Patch Shipped (CVE-2026-109618 / CVE-2026-109619)

Scope: PHP branches 8.2 through 8.5, now patched

Severity: Red

We flagged PHP2Shell yesterday when PHP had just announced an emergency release for two critical RCE flaws rated 9.2 on CVSS v4.0, scheduled after details leaked ahead of coordinated disclosure. The situation moved fast. PHP published the fix at 14:00 UTC on October 21, and watchTowr, which had already reproduced one of the two flaws, reported active exploitation attempts against both CVE-2026-109618 and CVE-2026-109619 by 14:19 UTC the same day, barely 19 minutes after the patch went public. Amazon’s Threat Intelligence team separately confirmed it caught an exploitation attempt against its MadPot honeypot service, and reports now describe the flaws as being broadly exploited in the wild. What makes PHP2Shell distinct from most application-level vulnerabilities is that the flaw sits in the PHP runtime itself rather than in any specific piece of code built on top of it, meaning a well-written, fully secure application can still be exposed simply because the language interpreter running it is vulnerable. Organisations running PHP must update to the patched version for their branch (8.2 through 8.5) immediately if this has not already happened, since no workaround exists outside of patching and exploitation is confirmed and active.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.