(TLP:CLEAR) Vulnerability Notification – Critical PHP Vulnerabilities “PHP2Shell,” Immediate Action Required (Updated October 21, 2026)
Created: Wednesday, October 21, 2026 - 14:28
Categories: Cybersecurity, Security Preparedness
October 21, 2026
Summary: Team Cymru has identified over one thousand IP addresses (1,187) associated with active exploitation of known vulnerabilities, including systems such as Ivanti, Joomla, Laravel, XWiki, Webmin, and phpunit. These indicators have an active-exploitation score of 90+ and are assessed as likely candidates to adopt PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exploitation once proof-of-concept code becomes available. Access the full list of IOCs attached below.
Members are encouraged to proactively block the identified IP addresses, monitor for related activity, and conduct threat hunting across internet-facing systems, particularly PHP-based infrastructure.
October 21, 2026
ACTION MAY BE REQUIRED for utilities operating systems that use PHP to serve web requests (including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed), as well as third-party applications, hosting environments, and appliances that bundle PHP. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.
Summary: Two critical remote code execution vulnerabilities affecting PHP, a widely used server-side scripting language, were addressed today in an accelerated security release from the PHP security team. Tracked as CVE-2026-109618 and CVE-2026-109619 (both CVSS v4.0 9.2), the vulnerabilities affect all PHP installations serving web requests and could allow a remote attacker to take control of the server and any website or application it hosts. WaterISAC strongly encourages members to review PHP’s security advisory, identify all systems running any version of PHP (prioritizing internet-facing systems), and update affected systems immediately.
The vulnerabilities were disclosed prematurely on October 20, ahead of the coordinated release. Security researchers at watchTowr have reportedly reproduced CVE-2026-109618, and the UK’s National Cyber Security Centre (NCSC) has issued an alert urging organizations to prepare for immediate updating. As of October 21, there is no confirmed exploitation in the wild; however, the premature disclosure and availability of patches that can be reverse-engineered may significantly compress the window before exploitation attempts begin. PHP considers the risk highest for Apache with mod_php, where a demonstrated exploit allows an unauthenticated request to trigger the attack before any application code runs.
These vulnerabilities are particularly concerning for utilities because PHP underpins many internet-facing services, including public websites, customer and payment portals, content management systems, business applications, and hosting control panels. PHP may also be embedded in third-party products and appliances that are not directly managed by internal IT teams. Successful exploitation could allow attackers to deploy webshells, steal sensitive information, and establish a foothold for further intrusion into utility networks.
PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux distributions and long-term support (LTS) vendors received the patches in advance, so updated packages may be available through those vendors. PHP 8.1 and older versions no longer receive updates from the PHP project; however, the PHP security team has provided minimal source backports for PHP 7.4, 8.0, and 8.1, and some distributions and LTS vendors may provide backported fixes.
Fixed Versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35 (PHP 8.2 reaches end of life on December 31, 2026)
For members unable to update immediately, PHP has published Workarounds and Mitigations. PHP notes these measures reduce exposure to specific attack paths but do not make an installation safe; updating is the only complete solution.
Additional Reading