PHP2Shell: what we know about the threat two weeks later | Kaspersky official blog

Critical PHP vulnerabilities put millions of websites worldwide at risk, but there are still no reports of mass breaches. We discuss the attacks on PAN-OS, a flaw in Brotli, and the steps businesses need to take beyond patching.

Diana Asadova

November 3, 2026

Late October brought several unsettling cybersecurity stories all at once. Among these were two critical vulnerabilities in PHP, which potentially affected about70% of websitesworldwide.CVE-2026-109618andCVE-2026-109619— dubbed PHP2Shell — could let attackers execute code on a server remotely, without authentication.

On October 21, PHP’s developers released emergency patches for the supported PHP 8.2–8.5 branches and for the unsupported PHP 7.4, 8.0, and 8.1. Experts predicted that attacks on vulnerable servers would start within 15 minutes of the updates going public. Amazon evenreportedexploitation attempts four days before the patches came out. With all this in the news, some organizations sounded the alarm early. For example, in several countries, government service websites weretaken offlineas a precaution. Even Wikipedia’s project management and bug-tracking system suspended service.

Nearly two weeks have passed since the updates came out, but according toCensys data, of the 46 million scannable servers running a vulnerable PHP version, 29 million still contain the flaws. Right after the patches were published, webroke down each flaw in detailand explained whatcompaniesandeveryday usersshould do. In this post we cover what’s known about the threat today, and what extra steps businesses need to take.

The news about critical PHP vulnerabilities set off a flurry of reactions. Researchersnoteda large number of exploitation attempts, and fresh exploits kept appearing in batches — courtesy of AI. A Palo Alto Networks unit even reported a PHP2Shell attack on a government agency in Europe, though it laterretractedthat statement. Solid evidence of how these vulnerabilities can actually be exploited only emerged later. On top of that, a third, unpatched one turned up.

On Friday, October 23, the PHP team warned about a new vulnerability —CVE-2026-115560— which can be used for remote code execution. But attackers can only pull this off on systems with an “unusual combination of configuration and application code”. That configuration is so exotic that the developers decided against an emergency patch, and will close the vulnerability on the regular schedule. In the meantime, they advised users to disable thesession.upload_progress.enabledINI option.

Let’s get back to the more serious threats. The most substantial confirmation of PHP2Shell exploitation in real-world attacks only came on October 24. Honeypot servers run by Adel Karimi of Perplexity running PHP 8.4.26 and presenting ordinary web pagesrecordedsuccessful attacks from two IP addresses. The observed exploit chain was consistent with CVE-2026-109618. There’s an important caveat, though: the researcher’s honeypot ran the Apache mod_php module, which is the configuration most convenient for attackers.

Later, on October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA)addedboth CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog. That confirmed the threat isn’t just theoretical.

On October 26, the technology company Dream reported that 25 firewalls and management servers had been compromised in the U.S., Japan, Taiwan, and South Korea. Three of them were in an environment presumed to be linked to U.S. government agencies. The attackers combined PHP2Shell with a Linux kernel vulnerability dubbed Fragnesia (CVE-2026-46300). Upon gaining full administrative control, they were able to extract the password of an LDAP service account and steal the listing of users and groups, full network configuration, and private keys.

Dream initially didn’t name the device vendor. In its October 29 update, though, the companystatedthat the systems were Palo Alto Networks devices running certain versions of PAN-OS. The vendorconfirmedattacks on management interfaces exposed to the internet. It urged customers to close public access to those interfaces, limit it to trusted internal IP addresses, and install patches.

Exploits are multiplying, but no wave of breaches has materialized, and the possibility of mass compromise of PHP servers remains unconfirmed. Even in the Palo Alto case, the scale of the attack was minimal: out of about 19 000 devices found, the attackers picked just 240, which were running software versions their exploit could handle.

As it turns out, the existing PHP2Shell exploits aren’t one-size-fits-all. To exploit the vulnerabilities in a given environment, attackers have to account for the exact PHP build, memory settings, request handling, and application specifics. Still, the danger remains, so don’t neglect protective measures.

The key advice stays the same: update. You can find the latest versions of the languageon the PHP website. But installing patches isn’t enough. You also need to run a thorough audit of your systems and check every component that runs on PHP for signs of compromise.

Five days after releasing the emergency patches, the PHP developers published another round of fixes. The reason is that the updates that fixed PHP2Shell didn’t cover theCVE-2026-111497vulnerability in Brotli, a third-party library. Exploiting this flaw can lead to code execution when PHP processes a specially crafted compressed response from an external server. The builds from October 25 include a patched version of the library. The latest PHP versions are 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1. The first attack exploiting this vulnerability wasrecordedon October 26, so don’t put off installing the updates.

Possible signs of a PHP2Shell compromise include unusual POST requests that containmultipart/form-datamedia type, suspicious combinations ofPHP_SESSION_UPLOAD_PROGRESSand upload parameters, atypical request sizes and request bursts, and HTTP 500 errors accompanied by PHP out-of-memory messages.

Kaspersky solutions can help you spot the threat at different stages of an attack.

To learn more about how our solutions detect attempts to exploit PHP vulnerabilities, read our expert blog,Securelist.

We’ve discovered a vulnerability that could affect millions of Intelbras IP cameras. If you’ve got one — here’s how to prevent attackers from disabling it.

We’ve discovered a vulnerability that could affect millions of Intelbras IP cameras. If you’ve got one — here’s how to prevent attackers from disabling it.

GReAT

November 2, 2026

We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers

We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers

Oxana Frolova

October 30, 2026

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

Stan Kaminsky

October 28, 2026

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Lama Saqqour

October 15, 2026

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

Maxim Baybarin

September 30, 2026