A bug in PHP can run before your login page does.
On 21 October 2026 the PHP project fixed two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell. PHP rates both 9.2 out of 10 (its own severity score, not ours). They sit in the part of PHP that reads a request, so your application's own login code may never get a chance to say no.
Simplified for explanation. Which servers can really be exploited depends on how PHP runs and on the application; see "What PHP says" below.
Is this PHP version fixed?
Type a version or paste a banner such as PHP/8.3.35. This uses the same rules as the website scan and sends nothing to the site.
A version number alone is not proof. Linux vendors can backport the fix without changing it, and a hidden version is "unknown", never "safe".
Fixed releases
| Branch | First fixed |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (end of life 31 Dec 2026) |
| 8.1 and older | No upstream release. Source patches and vendor backports only. |
What happened, in order
- One attempt on a honeypot
Amazon's MadPot sensor logged an exploitation attempt four days before disclosure. AWS says it is unclear whether any attempt would have worked.
Attempt, not a breach - Advance notice, details leak
PHP announced a critical release for the next day. Details circulated and watchTowr confirmed code execution in its lab.
Disclosure - Fixes published at 14:00 UTC
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare reported attack traffic from 07:43 UTC; AWS saw more attempts after public proofs of concept appeared.
Fix released - Reality check
Sansec found the public proofs of concept fail on a default PHP install and judged mass exploitation less likely than feared. CISA had not listed either CVE.
Assessment - Session upload progress notice
PHP advised
Related advisorysession.upload_progress.enabled=0until the next bugfix release. A full advisory for CVE-2026-115560 is still to come.
What PHP says
- Both flaws are rated critical and can be reached over the network without logging in.
- 109618: running out of memory during a request can leave PHP in a half-built state. Apache mod_php is confirmed exploitable with default limits.
- 109619: leftover state from one request is reused by a later one in the same worker. The confirmed case uses PHP 8.5 with
fatal_error_backtraces. - Updating is the only complete fix. The workarounds close single paths.
What is not established
- A working exploit against PHP-FPM, FrankenPHP or LSAPI. PHP calls them likely affected but not proven.
- Any confirmed break-in. The sources report attempts and traffic, not victims.
- That every PHP site is exposed. The attacker needs knowledge of the target and certain conditions.
- The name "Black October". None of the sources we read use it.
What SecureScan Plus does about it
The website scan looks at the PHP version the site announces and raises php2shell-affected-php when it is below the fixed release.
Version 8.1 and older, or a vendor build, comes back as "cannot be established", not as vulnerable. A hidden banner gives no finding.
No exploit payload is sent. Checking local PHP settings, logs and files needs access to the server, which a remote scanner does not have.
Sources: PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp and the php.net archive; Amazon Threat Intelligence; Sansec; watchTowr; Cloudflare. Patching does not prove an earlier compromise is gone.