Global – October 31, 2026 -- CrowdStrike Counter Adversary Operations has observed no successful exploitation of the PHP2Shell vulnerabilities in the wild or in its honeypot environments, only testing, probing and unsuccessful attempts.
The firm has also found no fully weaponized exploit, and no proof-of-concept (POC) exploit sufficient for widespread exploitation. Opportunistic attackers are likely to favor proven alternatives, because several other vulnerabilities already deliver unauthenticated remote code execution (RCE) against PHP applications reliably and at scale.
PHP disclosed two CVEs affecting four release branches on October 21, 2026
CVE-2026-109618 and CVE-2026-109619 affect PHP versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Preliminary analysis by industry sources and the vendor indicates that many older versions, including end-of-life releases, are also affected and may receive only limited patches.
CrowdStrike reproduced a POC that achieves RCE with the privileges of the running mod_php or PHP-FPM worker process. Under the least-privilege principle, those processes should be unprivileged in most cases.
Three distinct flaws can lead to code execution through reused PHP workers
CVE-2026-109618 is a partial HashTable insertion flaw. If a memory allocation fails during HTTP request-variable parsing, the entry count may update before the bucket is fully initialized. At request shutdown, PHP may treat the incomplete bucket as valid, causing memory corruption, a process crash or potentially arbitrary code execution.
CVE-2026-109619 covers two cross-request use-after-free flaws. In the first, a fatal error triggers zend_bailout() during serialize() or unserialize() and leaves the serialization context pointing at memory freed when the request ends. In the second, a fatal error interrupts multipart request processing before session upload-progress cleanup finishes. In both cases the persistent worker keeps stale pointers, and a later request handled by the same worker may access or modify the released memory.
Depending on configuration, exploitation can cause memory disclosure, worker crashes or arbitrary code execution. The session flaw can also leave a session lock permanently held or make the service unavailable.
CrowdStrike expects targeted exploitation of fixed deployment profiles, not a universal exploit
Attackers must adapt a POC to the specific PHP version and application, such as WordPress. That requires matching the Docker containers, packages and other components of the target.
A reliable exploit is feasible against a fixed Docker image or a known combination of PHP, libc, SAPI and web application versions. An attacker can calibrate exploit offsets and heap grooming in advance for any system running the same unmodified package or image release.
CrowdStrike expects advanced threat actors to target high-value victims where alternative methods are less feasible. If a public exploit for a widely used PHP deployment appears, it says many more actors will almost certainly adopt it immediately. The firm also expects the attention around PHP2Shell, together with AI-assisted vulnerability research, to spur further PHP vulnerability discovery and patch circumvention.
CrowdStrike advises patching internet-facing PHP applications first and rebuilding containers
The recommendations are to patch all PHP applications to the latest version, prioritizing internet-facing systems. Organizations should also rebuild container images and restart all Apache and PHP-FPM workers after deployment to clear stale process state, and disable session upload progress.