--- title: PHP2Shell: Prepare for the Next Vulnerability | daily.dev description: Two unauthenticated remote code execution flaws in the PHP engine itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2), were... canonical: https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP2Shell: Prepare for the Next Vulnerability | daily.dev og:description: Two unauthenticated remote code execution flaws in the PHP engine itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2), were... og:url: https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1 og:image: https://api.daily.dev/og/posts/LEWHmq4u1.png og:image:alt: PHP2Shell: Prepare for the Next Vulnerability og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP2Shell: Prepare for the Next Vulnerability **[Snyk](https://daily.dev/sources/snyk)** · 9 min read · 0 upvotes · 0 comments ## Summary Two unauthenticated remote code execution flaws in the PHP engine itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2), were exploited in the wild four days before public disclosure. Amazon's honeypot network logged an attempt on October 17, while PHP's fix landed October 21. A follow-up bypass, CVE-2026-115560, surfaced October 23 for apps that switch session serialization handlers with ini_set() before starting a session. VirusTotal found about 5.1 million IPs running PHP, but only 1.1 million reveal their version. Snyk argues teams need an outside-in asset inventory, hour-scale checks, and repeated re-tests to catch the next flaw like this. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the PHP2Shell CVE numbers and how severe are they? PHP2Shell refers to two unauthenticated remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. They were reachable before application code ran, so on Apache with mod_php a single unauthenticated request could trigger exploitation. A related partial bypass, CVE-2026-115560, was disclosed October 23 for apps using ini_set() to switch session serialization handlers with upload progress enabled. _Teams tracking critical PHP CVEs and patch windows can follow breakdowns like this on daily.dev._ ### Was PHP2Shell exploited before it was publicly disclosed? Yes. Amazon's honeypot network logged a PHP2Shell exploitation attempt from an anonymized IP on October 17, four days before PHP shipped its fixes on October 21. By the time the patch landed, technical details had already leaked and proof-of-concept exploits were circulating widely, meaning real-world exploitation preceded the official disclosure date. _Developers racing patch timelines can track disclosures like this via daily.dev to avoid being caught off guard._ ### Why is it hard to know exactly which servers are running a vulnerable PHP version? Because most PHP instances hide their version string. VirusTotal fingerprinted roughly 5.1 million IP addresses running PHP, but only about 1.1 million of them announce a version number, meaning roughly four out of five do not. Container and distribution-package scans also miss PHP installations compiled from source, including official PHP Docker images. _Teams building accurate PHP asset inventories can find practical detection gaps like this on daily.dev._ ## Similar posts on daily.dev - [CISA confirms PHP2Shell under attack as researchers clock successful exploits](https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2) · The Register · 0 upvotes · 0 comments - [Websites offline. The internet is on fire. Obviously, we were unprepared.](https://daily.dev/posts/websites-offline-the-internet-is-on-fire-obviously-we-were-unprepared--hv1iepv7z) · Medium · 0 upvotes · 0 comments - [A 14-Year-Old PHP Bug Lets Strangers Run Code on Your Server. Here's How to Stop It](https://daily.dev/posts/a-14-year-old-php-bug-lets-strangers-run-code-on-your-server-here-s-how-to-stop-it-vd0nya50m) · Medium · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP2Shell: Prepare for the Next Vulnerability","url":"https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1"},"datePublished":"2026-10-28T22:10:22.108Z","dateModified":"2026-10-28T22:48:16.199Z","description":"Two unauthenticated remote code execution flaws in the PHP engine itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2), were...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd6e8138ab442224ef0845dd6470df4a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd6e8138ab442224ef0845dd6470df4a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snyk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snyk","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8fb2a7b471c04bac9af29fbeb3ed1cf6","url":"https://daily.dev/sources/snyk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,appsec","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snyk","item":"https://daily.dev/sources/snyk"},{"@type":"ListItem","position":3,"name":"PHP2Shell: Prepare for the Next Vulnerability"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1#faq","mainEntity":[{"@type":"Question","name":"What are the PHP2Shell CVE numbers and how severe are they?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two unauthenticated remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. They were reachable before application code ran, so on Apache with mod_php a single unauthenticated request could trigger exploitation. A related partial bypass, CVE-2026-115560, was disclosed October 23 for apps using ini_set() to switch session serialization handlers with upload progress enabled. Teams tracking critical PHP CVEs and patch windows can follow breakdowns like this on daily.dev."}},{"@type":"Question","name":"Was PHP2Shell exploited before it was publicly disclosed?","acceptedAnswer":{"@type":"Answer","text":"Yes. Amazon's honeypot network logged a PHP2Shell exploitation attempt from an anonymized IP on October 17, four days before PHP shipped its fixes on October 21. By the time the patch landed, technical details had already leaked and proof-of-concept exploits were circulating widely, meaning real-world exploitation preceded the official disclosure date. Developers racing patch timelines can track disclosures like this via daily.dev to avoid being caught off guard."}},{"@type":"Question","name":"Why is it hard to know exactly which servers are running a vulnerable PHP version?","acceptedAnswer":{"@type":"Answer","text":"Because most PHP instances hide their version string. VirusTotal fingerprinted roughly 5.1 million IP addresses running PHP, but only about 1.1 million of them announce a version number, meaning roughly four out of five do not. Container and distribution-package scans also miss PHP installations compiled from source, including official PHP Docker images. Teams building accurate PHP asset inventories can find practical detection gaps like this on daily.dev."}}]} ```